# Elasticsearch

**URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1166

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 1167

---

## [Kubernetes cluster in elk](https://discuss.elastic.co/t/kubernetes-cluster-in-elk/198345)

<div class="topic-metadata">

**Author:** [@kotesh\_Ydv](https://discuss.elastic.co/u/kotesh_Ydv)\
**Replies:** 0\
**Last updated:** [September 6, 2019, 5:27am UTC](https://discuss.elastic.co/t/kubernetes-cluster-in-elk/198345 "2019-09-06T05:27:03Z")

</div>

hi please help me how to configure to monitor kubernetes cluster info in elk

---

## [Unable to start elastic search serivice](https://discuss.elastic.co/t/unable-to-start-elastic-search-serivice/198344)

<div class="topic-metadata">

**Author:** [@kotesh\_Ydv](https://discuss.elastic.co/u/kotesh_Ydv)\
**Replies:** 0\
**Last updated:** [September 6, 2019, 5:20am UTC](https://discuss.elastic.co/t/unable-to-start-elastic-search-serivice/198344 "2019-09-06T05:20:53Z")

</div>

Hi i installed elasticsearch and kibana in centos 7 with 7.3.1 version with tar files (bin/elasticsearch and bin/kibana and i enabled x-pack security ----in yaml file and i set the password for elk stack ,command like bi…

---

## [Elastic 7.3.0 Unsafe memory error](https://discuss.elastic.co/t/elastic-7-3-0-unsafe-memory-error/198343)

<div class="topic-metadata">

**Author:** [@khergner](https://discuss.elastic.co/u/khergner)\
**Replies:** 0\
**Last updated:** [September 6, 2019, 5:18am UTC](https://discuss.elastic.co/t/elastic-7-3-0-unsafe-memory-error/198343 "2019-09-06T05:18:49Z")

</div>

Hi We use elasticsearch 7.3.0. ı get the error as follows. How can ı solve below problem becuase elk system is turn off. My configurarion bootstrap.memory\_lock: true cluster.name: asgard http.port: 9200 node.data: tru…

---

## [AWS Elasticsearch on private internal IP](https://discuss.elastic.co/t/aws-elasticsearch-on-private-internal-ip/198340)

<div class="topic-metadata">

**Author:** [@kennethjaysone](https://discuss.elastic.co/u/kennethjaysone)\
**Replies:** 1\
**Last updated:** [September 6, 2019, 5:02am UTC](https://discuss.elastic.co/t/aws-elasticsearch-on-private-internal-ip/198340 "2019-09-06T05:02:24Z")

</div>

Within AWS Elasticsearch service, i've created a new domain and set the defaults for creating a new elastic search + kibana service. When choosing the subnet, i chose the subnet that is our internal zone. Elasticsearch…

---

## [Security elasticsearch](https://discuss.elastic.co/t/security-elasticsearch/196926)

<div class="topic-metadata">

**Author:** [@cristianaxion](https://discuss.elastic.co/u/cristianaxion)\
**Replies:** 5\
**Last updated:** [September 6, 2019, 4:36am UTC](https://discuss.elastic.co/t/security-elasticsearch/196926 "2019-09-06T04:36:35Z")

</div>

Can you have security before starting in kibana or do I need to have x-pack? And if you can how it is done?

---

## [GeoQuery doesn't work](https://discuss.elastic.co/t/geoquery-doesnt-work/197738)

<div class="topic-metadata">

**Author:** [@Diego\_Lucas\_Martinez](https://discuss.elastic.co/u/Diego_Lucas_Martinez)\
**Replies:** 5\
**Last updated:** [September 6, 2019, 4:09am UTC](https://discuss.elastic.co/t/geoquery-doesnt-work/197738 "2019-09-06T04:09:10Z")

</div>

I am trying to do a GeoQuery with Nest but it dosen't work both on kibana and NEST with .net. Here is the NEST Query GeoDistanceQuery a = new GeoDistanceQuery { Boost = 1.1, …

---

## [How to tune up search performance?](https://discuss.elastic.co/t/how-to-tune-up-search-performance/198179)

<div class="topic-metadata">

**Author:** [@ted\_ye](https://discuss.elastic.co/u/ted_ye)\
**Replies:** 3\
**Last updated:** [September 6, 2019, 3:47am UTC](https://discuss.elastic.co/t/how-to-tune-up-search-performance/198179 "2019-09-06T03:47:16Z")

</div>

hello every experts: I want to ask for how to tune up search performance? My cluster: 3 \* Master-eligible nodes with 2 cores 4G RAM 3 \* coordinating nodes with 2 cores 8G RAM 5 \* data nodes with 8cores 32G RAM elas…

---

## [\[ES7.0.1+python3\]\[HELP\]es.bulk() + python3 doesn't ingest csv data into elasticsearch](https://discuss.elastic.co/t/es7-0-1-python3-help-es-bulk-python3-doesnt-ingest-csv-data-into-elasticsearch/197749)

<div class="topic-metadata">

**Author:** [@cheriemilk](https://discuss.elastic.co/u/cheriemilk)\
**Replies:** 3\
**Last updated:** [September 6, 2019, 1:05am UTC](https://discuss.elastic.co/t/es7-0-1-python3-help-es-bulk-python3-doesnt-ingest-csv-data-into-elasticsearch/197749 "2019-09-06T01:05:16Z")

</div>

Hi Team, Please check below code which is use python3 and es.bulk() to ingest data in large csv file into elasticsearch. The result is that it doesn't ingest any data. The for loop looks like is not iterative. what's w…

---

## [How can i have a field in my parent doc in ES to store the number of child docs in it](https://discuss.elastic.co/t/how-can-i-have-a-field-in-my-parent-doc-in-es-to-store-the-number-of-child-docs-in-it/197693)

<div class="topic-metadata">

**Author:** [@yash.tandon](https://discuss.elastic.co/u/yash.tandon)\
**Replies:** 5\
**Last updated:** [September 6, 2019, 12:48am UTC](https://discuss.elastic.co/t/how-can-i-have-a-field-in-my-parent-doc-in-es-to-store-the-number-of-child-docs-in-it/197693 "2019-09-06T00:48:13Z")

</div>

---

## [Error while building the elasticsearch docker image with search guard](https://discuss.elastic.co/t/error-while-building-the-elasticsearch-docker-image-with-search-guard/198326)

<div class="topic-metadata">

**Author:** [@vampire](https://discuss.elastic.co/u/vampire)\
**Replies:** 0\
**Last updated:** [September 5, 2019, 11:38pm UTC](https://discuss.elastic.co/t/error-while-building-the-elasticsearch-docker-image-with-search-guard/198326 "2019-09-05T23:38:10Z")

</div>

I am trying to build the Docker image with search guard 36.0.0 on elasticsearch 7.1.1. The Dockerfile looks like this: # https://github.com/elastic/elasticsearch-docker FROM docker.elastic.co/elasticsearch/elasticsearch…

---

## [Elasticsearch and SEO](https://discuss.elastic.co/t/elasticsearch-and-seo/198325)

<div class="topic-metadata">

**Author:** [@rafaelreale](https://discuss.elastic.co/u/rafaelreale)\
**Replies:** 0\
**Last updated:** [September 5, 2019, 11:26pm UTC](https://discuss.elastic.co/t/elasticsearch-and-seo/198325 "2019-09-05T23:26:48Z")

</div>

What is the best stack for working with Elasticsearch for the best SEO results?

---

## [Question about percentile rank query](https://discuss.elastic.co/t/question-about-percentile-rank-query/198323)

<div class="topic-metadata">

**Author:** [@Nee\_Defeng](https://discuss.elastic.co/u/Nee_Defeng)\
**Replies:** 0\
**Last updated:** [September 5, 2019, 11:02pm UTC](https://discuss.elastic.co/t/question-about-percentile-rank-query/198323 "2019-09-05T23:02:06Z")

</div>

I had this query, with which I would expect to have value '0.000005' below the value returned from the record "system" : { "pct" : 0.016} The question is: why it still shows the percentile…

---

## [Changed the path in Elasticsearch.yml file](https://discuss.elastic.co/t/changed-the-path-in-elasticsearch-yml-file/198314)

<div class="topic-metadata">

**Author:** [@aishu](https://discuss.elastic.co/u/aishu)\
**Replies:** 1\
**Last updated:** [September 5, 2019, 8:22pm UTC](https://discuss.elastic.co/t/changed-the-path-in-elasticsearch-yml-file/198314 "2019-09-05T20:22:59Z")

</div>

Hi I change the Destination file path in elasticsearch.yml to newly created nfs and copied all the file from old nfs to new one and when i try to restart the elastic search i am seeing these in the logs. \[2019-09-05T10…

---

## [Unable to bypass restriction with synonym token filter](https://discuss.elastic.co/t/unable-to-bypass-restriction-with-synonym-token-filter/195334)

<div class="topic-metadata">

**Author:** [@radoslav.sholev](https://discuss.elastic.co/u/radoslav.sholev)\
**Replies:** 6\
**Last updated:** [September 5, 2019, 8:12pm UTC](https://discuss.elastic.co/t/unable-to-bypass-restriction-with-synonym-token-filter/195334 "2019-09-05T20:12:00Z")

</div>

Greetings, I am trying to migrate from ES 5.5 to 7.3, but I got stuck at an issue with the synonym filter. The reference states "This filter tokenize synonyms with whatever tokenizer and token filters appear before it i…

---

## [Index Lifecycle Rollover failing with NullPtrException](https://discuss.elastic.co/t/index-lifecycle-rollover-failing-with-nullptrexception/196580)

<div class="topic-metadata">

**Author:** [@tami](https://discuss.elastic.co/u/tami)\
**Replies:** 9\
**Last updated:** [September 5, 2019, 8:08pm UTC](https://discuss.elastic.co/t/index-lifecycle-rollover-failing-with-nullptrexception/196580 "2019-09-05T20:08:55Z")

</div>

We are running ElasticSearch 6.7.2 in a 3.2.2 (master/client/data) node setup on kubernetes. I have an ILM policy running to rollover a new index every 7 days, move to a warm stage, and then delete after 1 year. Here i…

---

## [How do create a threshold for read\_only\_allow\_delete?](https://discuss.elastic.co/t/how-do-create-a-threshold-for-read-only-allow-delete/198296)

<div class="topic-metadata">

**Author:** [@Luis\_Alejandro\_Galan](https://discuss.elastic.co/u/Luis_Alejandro_Galan)\
**Replies:** 4\
**Last updated:** [September 5, 2019, 7:45pm UTC](https://discuss.elastic.co/t/how-do-create-a-threshold-for-read-only-allow-delete/198296 "2019-09-05T19:45:33Z")

</div>

Hello! I am running to an issue where my indices lock after it reaches a certain limit. Where can I find the limit and/or how can I adjust it so that it only locks when it reaches 5% of disk space used?

---

## [Possible error codes, from elastic server](https://discuss.elastic.co/t/possible-error-codes-from-elastic-server/198294)

<div class="topic-metadata">

**Author:** [@berryma4](https://discuss.elastic.co/u/berryma4)\
**Replies:** 1\
**Last updated:** [September 5, 2019, 7:41pm UTC](https://discuss.elastic.co/t/possible-error-codes-from-elastic-server/198294 "2019-09-05T19:41:35Z")

</div>

Hello, I can't seem to find in the documentation, a list of possible error returns when using the java high level client (or, from using rest directly). A pointer to this information would be great (using version 7.2 el…

---

## [Esrally Http Compress](https://discuss.elastic.co/t/esrally-http-compress/198124)

<div class="topic-metadata">

**Author:** [@waallee](https://discuss.elastic.co/u/waallee)\
**Replies:** 1\
**Last updated:** [September 5, 2019, 7:37pm UTC](https://discuss.elastic.co/t/esrally-http-compress/198124 "2019-09-05T19:37:36Z")

</div>

Hi guys, I'm new to Esrally. Currently I use esrally to benchmark my es cluster. However when I add options --client-options="http\_compress:true" it failed with message: \[ERROR\] Cannot race. Error in race control (Trans…

---

## [Starts snapshot from the begining](https://discuss.elastic.co/t/starts-snapshot-from-the-begining/194707)

<div class="topic-metadata">

**Author:** [@macko003](https://discuss.elastic.co/u/macko003)\
**Replies:** 5\
**Last updated:** [September 5, 2019, 7:20pm UTC](https://discuss.elastic.co/t/starts-snapshot-from-the-begining/194707 "2019-09-05T19:20:22Z")

</div>

Hi We use a graylog with 10 elastic node backend. ES version: elasticsearch-6.6.0 (same problem with prev versions also) Snapshot repo: local "fs" repo, NFS mounted to a local folder OS: CentOS 7 10 elastic nodes in…

---

## [How do people assert the veracity of their snapshots?](https://discuss.elastic.co/t/how-do-people-assert-the-veracity-of-their-snapshots/198309)

<div class="topic-metadata">

**Author:** [@ndtreviv](https://discuss.elastic.co/u/ndtreviv)\
**Replies:** 1\
**Last updated:** [September 5, 2019, 7:15pm UTC](https://discuss.elastic.co/t/how-do-people-assert-the-veracity-of-their-snapshots/198309 "2019-09-05T19:15:28Z")

</div>

We have over 12TB of data in our ES cluster. Most of that is made up of two really massive indices. We take snapshots to an S3 repo - incremental every night, full snapshots once a month. We're starting to wonder how w…

---

## [Master not discovered error](https://discuss.elastic.co/t/master-not-discovered-error/198093)

<div class="topic-metadata">

**Author:** [@esrcon](https://discuss.elastic.co/u/esrcon)\
**Replies:** 8\
**Last updated:** [September 5, 2019, 7:02pm UTC](https://discuss.elastic.co/t/master-not-discovered-error/198093 "2019-09-05T19:02:26Z")

</div>

Hello, I created a cluster contains 2 data/master nodes and 3 master-only nodes on AWS EC2. Due to the bootstrap feature, I specified two data nodes ip for luster.initial\_master\_nodes. After cluster started successful…

---

## [Curator 5.7 Windows Doesnt run Error \[Errno 11001\]](https://discuss.elastic.co/t/curator-5-7-windows-doesnt-run-error-errno-11001/198307)

<div class="topic-metadata">

**Author:** [@Ryan\_Downey](https://discuss.elastic.co/u/Ryan_Downey)\
**Replies:** 0\
**Last updated:** [September 5, 2019, 6:56pm UTC](https://discuss.elastic.co/t/curator-5-7-windows-doesnt-run-error-errno-11001/198307 "2019-09-05T18:56:20Z")

</div>

Solved Elasticsearch OSS-7.0.0 Curator 5.7 I recently had trouble running Curator on a Windows server in which I could run .\\curator curator-action.yml --config curator-config.yml to delete indices older than a set am…

---

## [Elasticsearch with xpack.security.enabled throws Cluster is not yet ready](https://discuss.elastic.co/t/elasticsearch-with-xpack-security-enabled-throws-cluster-is-not-yet-ready/198260)

<div class="topic-metadata">

**Author:** [@O\_K](https://discuss.elastic.co/u/O_K)\
**Replies:** 7\
**Last updated:** [September 5, 2019, 6:37pm UTC](https://discuss.elastic.co/t/elasticsearch-with-xpack-security-enabled-throws-cluster-is-not-yet-ready/198260 "2019-09-05T18:37:05Z")

</div>

Hello, I use the following helm chart Can someone please explain what is pending in order to get elasticsearch running as \> helm install --namespace logging --name elasticsearch -f elasticsearch/values.yaml ./elastic…

---

## [Elasticseach 7.x - Can't add new node to cluster](https://discuss.elastic.co/t/elasticseach-7-x-cant-add-new-node-to-cluster/197941)

<div class="topic-metadata">

**Author:** [@humartinez](https://discuss.elastic.co/u/humartinez)\
**Replies:** 15\
**Last updated:** [September 5, 2019, 6:23pm UTC](https://discuss.elastic.co/t/elasticseach-7-x-cant-add-new-node-to-cluster/197941 "2019-09-05T18:23:23Z")

</div>

Hi there, Im having an issue trying to add a new server to an existing cluster thats is using encription and Im getting the following error. \[2019-09-03T20:11:10,344\]\[WARN \]\[o.e.c.c.ClusterFormationFailureHelper\] \[elas…

---

## [Combining Month's Worth of Daily Logstash Indices into Single Month](https://discuss.elastic.co/t/combining-months-worth-of-daily-logstash-indices-into-single-month/197596)

<div class="topic-metadata">

**Author:** [@jamiejackson](https://discuss.elastic.co/u/jamiejackson)\
**Replies:** 2\
**Last updated:** [September 5, 2019, 6:09pm UTC](https://discuss.elastic.co/t/combining-months-worth-of-daily-logstash-indices-into-single-month/197596 "2019-09-05T18:09:58Z")

</div>

I'm pretty new to ES and brand new to anything like reindexing. I've looked through a handful of search\_phase\_execution\_exception-related posts, but didn't see any that I understood to be the same as my problem. My goa…

---

## [Aggregating on docvalue\_field from inner\_hits](https://discuss.elastic.co/t/aggregating-on-docvalue-field-from-inner-hits/198300)

<div class="topic-metadata">

**Author:** [@Jeff\_Potts](https://discuss.elastic.co/u/Jeff_Potts)\
**Replies:** 0\
**Last updated:** [September 5, 2019, 5:57pm UTC](https://discuss.elastic.co/t/aggregating-on-docvalue-field-from-inner-hits/198300 "2019-09-05T17:57:25Z")

</div>

I have a query that includes a nested query with inner\_hits enabled. I am using docvalue\_fields within inner\_hits to expose the value from within the nested object that I want to aggregate on: { "query": { "bool":…

---

## [Index settings: correct place for the analyzer section](https://discuss.elastic.co/t/index-settings-correct-place-for-the-analyzer-section/198295)

<div class="topic-metadata">

**Author:** [@jetnet](https://discuss.elastic.co/u/jetnet)\
**Replies:** 0\
**Last updated:** [September 5, 2019, 4:52pm UTC](https://discuss.elastic.co/t/index-settings-correct-place-for-the-analyzer-section/198295 "2019-09-05T16:52:51Z")

</div>

quick question - what is the correct place for the analysis configuration: PUT my\_index { "settings": { "index" : { "analysis" : { "analyzer" : { or PUT my\_index { "settings": { "analysis": {…

---

## [SQL Queries](https://discuss.elastic.co/t/sql-queries/198258)

<div class="topic-metadata">

**Author:** [@Sinan\_Kaplan](https://discuss.elastic.co/u/Sinan_Kaplan)\
**Replies:** 1\
**Last updated:** [September 5, 2019, 4:41pm UTC](https://discuss.elastic.co/t/sql-queries/198258 "2019-09-05T16:41:30Z")

</div>

Hi, SELECT \* FROM index where index.id NOT IN ( SELECT index.responseID from index where index.type=3) i am writing this sql in elastic search but it says "not in query not supported yet". I'm wondering can i write thi…

---

## [Elastic Cloud Memory Split](https://discuss.elastic.co/t/elastic-cloud-memory-split/198111)

<div class="topic-metadata">

**Author:** [@shiredude95](https://discuss.elastic.co/u/shiredude95)\
**Replies:** 3\
**Last updated:** [September 5, 2019, 4:14pm UTC](https://discuss.elastic.co/t/elastic-cloud-memory-split/198111 "2019-09-05T16:14:33Z")

</div>

The Elasticsearch guide recommends giving half of the available memory to system cache for lucene-based caching. In the elasticcloud offering, all of the options seem to give everything but 1.5gb of the total memory to e…

---

## [Match\_phrase\_prefix on keyword field inconsistent behavior between ES 5.6.8 and ES 6+](https://discuss.elastic.co/t/match-phrase-prefix-on-keyword-field-inconsistent-behavior-between-es-5-6-8-and-es-6/198151)

<div class="topic-metadata">

**Author:** [@Khoa\_Le](https://discuss.elastic.co/u/Khoa_Le)\
**Replies:** 1\
**Last updated:** [September 5, 2019, 3:50pm UTC](https://discuss.elastic.co/t/match-phrase-prefix-on-keyword-field-inconsistent-behavior-between-es-5-6-8-and-es-6/198151 "2019-09-05T15:50:19Z")

</div>

I'm noticing different behavior on Elasticsearch 5.6.8 and Elasticsearch 6+ on doing a match\_phrase\_prefix on keyword. I was able to do a match\_phrase\_prefix on a keyword exact match on Elasticsearch 5.6.8 but not on Ela…

[Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1165)

[Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1167)
