# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1184 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1185 --- ## [Rollup job issue with wrong time values(v 6.7.1)](https://discuss.elastic.co/t/rollup-job-issue-with-wrong-time-values-v-6-7-1/195570)
**Author:** [@dhruv477](https://discuss.elastic.co/u/dhruv477)\ **Replies:** 1\ **Last updated:** [August 21, 2019, 9:42pm UTC](https://discuss.elastic.co/t/rollup-job-issue-with-wrong-time-values-v-6-7-1/195570 "2019-08-21T21:42:03Z")
Our business problem is to find the duration of a session, and our sample simplified data set is a simple table with 2 columns - request\_date and session\_id. All we need is to find the max(request\_date), min(request\_date… --- ## [What do "actual" and "typical" columns mean in the Anomaly explorer?](https://discuss.elastic.co/t/what-do-actual-and-typical-columns-mean-in-the-anomaly-explorer/196188)
**Author:** [@Rosho](https://discuss.elastic.co/u/Rosho)\ **Replies:** 1\ **Last updated:** [August 21, 2019, 8:33pm UTC](https://discuss.elastic.co/t/what-do-actual-and-typical-columns-mean-in-the-anomaly-explorer/196188 "2019-08-21T20:33:32Z")
Hi I am analyzing data with the Elastic X-Pack. What does the "actual" and "typical" columns mean? Is it the severity? the count of emails? I do not understand. Thank you --- ## [How to increase heap size for local debugging running with build-tools](https://discuss.elastic.co/t/how-to-increase-heap-size-for-local-debugging-running-with-build-tools/196190)
**Author:** [@zcharli](https://discuss.elastic.co/u/zcharli)\ **Replies:** 0\ **Last updated:** [August 21, 2019, 8:26pm UTC](https://discuss.elastic.co/t/how-to-increase-heap-size-for-local-debugging-running-with-build-tools/196190 "2019-08-21T20:26:46Z")
I am trying to debug an ES plugin with build-tools and running into an out of heap error. I'm starting my debug with ./gradlew run? Is there a way to to configure this per project? Is this the right source for the run … --- ## [Active Directory Authentication Basic License](https://discuss.elastic.co/t/active-directory-authentication-basic-license/196187)
**Author:** [@Lucas\_Davites\_Benici](https://discuss.elastic.co/u/Lucas_Davites_Benici)\ **Replies:** 1\ **Last updated:** [August 21, 2019, 7:56pm UTC](https://discuss.elastic.co/t/active-directory-authentication-basic-license/196187 "2019-08-21T19:56:02Z")
Can I use Active Directory Authentication under Basic License? Now I'm using 14days trial. Thanks. --- ## [Erroneous number of documents in the index cannot exceed 2147483519 message?](https://discuss.elastic.co/t/erroneous-number-of-documents-in-the-index-cannot-exceed-2147483519-message/196167)
**Author:** [@Todd\_Sayers](https://discuss.elastic.co/u/Todd_Sayers)\ **Replies:** 2\ **Last updated:** [August 21, 2019, 7:00pm UTC](https://discuss.elastic.co/t/erroneous-number-of-documents-in-the-index-cannot-exceed-2147483519-message/196167 "2019-08-21T19:00:30Z")
I cannot start one of my Elasticsearch nodes. It says, "number of documents in the index cannot exceed 2147483519." However, using the "\_cat/count" API call, I'm not able to find any indices that have two billion documen… --- ## [Elasticsearch 7.3 CPU Usage](https://discuss.elastic.co/t/elasticsearch-7-3-cpu-usage/196029)
**Author:** [@Spock\_Tgai](https://discuss.elastic.co/u/Spock_Tgai)\ **Replies:** 2\ **Last updated:** [August 21, 2019, 5:23pm UTC](https://discuss.elastic.co/t/elasticsearch-7-3-cpu-usage/196029 "2019-08-21T17:23:07Z")
Hi, We are running elasticsearch 7.3 release in 5 node cluster. Two of the nodes in the cluster are suddenly showing constant 50% CPU. The other nodes are showing less than 20% CPU, any ideas on how to understand why i… --- ## [Boosting documents with specific fields while sorting too](https://discuss.elastic.co/t/boosting-documents-with-specific-fields-while-sorting-too/196165)
**Author:** [@Ewoks](https://discuss.elastic.co/u/Ewoks)\ **Replies:** 0\ **Last updated:** [August 21, 2019, 4:57pm UTC](https://discuss.elastic.co/t/boosting-documents-with-specific-fields-while-sorting-too/196165 "2019-08-21T16:57:56Z")
Hello, I would like to boost some results based on value of specific document property. Idea would be to use function\_score with functions/filter, weight and boost\_mode "multiply". If I understood correctly that would b… --- ## [Similar name matching (name aliases)](https://discuss.elastic.co/t/similar-name-matching-name-aliases/195999)
**Author:** [@mikesparr](https://discuss.elastic.co/u/mikesparr)\ **Replies:** 3\ **Last updated:** [August 21, 2019, 4:06pm UTC](https://discuss.elastic.co/t/similar-name-matching-name-aliases/195999 "2019-08-21T16:06:08Z")
What is best way to design for and query similar names and return a single record Names Homer James Simpson vs Homer James Simpson Homer James Simpson vs Homer J Simpson Homer James Simpson vs H J Simpson Orgs / Busi… --- ## [RestHighLevelClient: Force merge async and SocketTimeoutException](https://discuss.elastic.co/t/resthighlevelclient-force-merge-async-and-sockettimeoutexception/196133)
**Author:** [@xavierfacq](https://discuss.elastic.co/u/xavierfacq)\ **Replies:** 0\ **Last updated:** [August 21, 2019, 2:32pm UTC](https://discuss.elastic.co/t/resthighlevelclient-force-merge-async-and-sockettimeoutexception/196133 "2019-08-21T14:32:48Z")
Hi, I have the following problem after trying to upgrade my Java code to the RestHighLevelClient. At the end of a big process of reindexation, there is an old piece of code that run a Force Merge. I have replaced with… --- ## [What is the best way of visualizing SonarQube analysis from Elasticsearch using Kibana?](https://discuss.elastic.co/t/what-is-the-best-way-of-visualizing-sonarqube-analysis-from-elasticsearch-using-kibana/192606)
**Author:** [@berko](https://discuss.elastic.co/u/berko)\ **Replies:** 4\ **Last updated:** [August 21, 2019, 2:29pm UTC](https://discuss.elastic.co/t/what-is-the-best-way-of-visualizing-sonarqube-analysis-from-elasticsearch-using-kibana/192606 "2019-08-21T14:29:52Z")
Hi, I'm trying to visualize SonarQube analysis results. However, I couldn't figure out which configurations to follow. SonarQube version is 7.9 I found this https://discuss.elastic.co/t/elk-sonarqube/127732 discussion … --- ## [Index mappings - IP type also parses port?](https://discuss.elastic.co/t/index-mappings-ip-type-also-parses-port/195993)
**Author:** [@alonchis](https://discuss.elastic.co/u/alonchis)\ **Replies:** 2\ **Last updated:** [August 21, 2019, 2:22pm UTC](https://discuss.elastic.co/t/index-mappings-ip-type-also-parses-port/195993 "2019-08-21T14:22:39Z")
Hi people, I been slowly trying to change my mappings from text to "ip". However, some logs include the port. Before i go on and modify the grok filters, I wonder if this data type can handle IP:PORT fields. Thanks for… --- ## [Simple\_query\_string check if field exists](https://discuss.elastic.co/t/simple-query-string-check-if-field-exists/196106)
**Author:** [@Ennui](https://discuss.elastic.co/u/Ennui)\ **Replies:** 1\ **Last updated:** [August 21, 2019, 2:00pm UTC](https://discuss.elastic.co/t/simple-query-string-check-if-field-exists/196106 "2019-08-21T14:00:23Z")
Hi, How would I use simple\_query\_string to check if a field exists? For example, say if I had the following documents PUT test\_index/\_doc/1 { "user" : "test", "message" : "a" } PUT test\_index/\_doc/2 { "user" : "… --- ## [Return ouput instead of using a hard true or false | Watcher](https://discuss.elastic.co/t/return-ouput-instead-of-using-a-hard-true-or-false-watcher/195942)
**Author:** [@ntran](https://discuss.elastic.co/u/ntran)\ **Replies:** 12\ **Last updated:** [August 21, 2019, 1:42pm UTC](https://discuss.elastic.co/t/return-ouput-instead-of-using-a-hard-true-or-false-watcher/195942 "2019-08-21T13:42:23Z")
Hi all, Is there a way I can return my new array "list" instead of hard coding true? I know they both will come to the same outcome, however, I'm trying my best to not hard code anything which isn't necessary // Watch… --- ## [Elasticsearch 7.x support for ARM64 (Raspberry Pi 4 B)](https://discuss.elastic.co/t/elasticsearch-7-x-support-for-arm64-raspberry-pi-4-b/187976)
**Author:** [@Jason\_Baumgartner](https://discuss.elastic.co/u/Jason_Baumgartner)\ **Replies:** 10\ **Last updated:** [August 21, 2019, 1:37pm UTC](https://discuss.elastic.co/t/elasticsearch-7-x-support-for-arm64-raspberry-pi-4-b/187976 "2019-08-21T13:37:13Z")
Previous versions of Elasticsearch (6.x, etc.) could easily be installed on ARM64 but Elasticsearch 7.x gives an error: "package architecture (amd64) does not match system (armhf)" Previously, I was able to install pac… --- ## [Bug Report : Memory leak when readiness probe Curls to check the cluster health when security is enabled](https://discuss.elastic.co/t/bug-report-memory-leak-when-readiness-probe-curls-to-check-the-cluster-health-when-security-is-enabled/193445)
**Author:** [@Cyril\_James](https://discuss.elastic.co/u/Cyril_James)\ **Replies:** 23\ **Last updated:** [August 21, 2019, 1:24pm UTC](https://discuss.elastic.co/t/bug-report-memory-leak-when-readiness-probe-curls-to-check-the-cluster-health-when-security-is-enabled/193445 "2019-08-21T13:24:11Z")
When I install elasticsearch using "https://github.com/elastic/helm-charts/tree/master/elasticsearch" with security enabled, I could observe that there is memory leak. Memory usage by each pod keeps on increasing and it … --- ## [Status Failure for Slack | Watcher](https://discuss.elastic.co/t/status-failure-for-slack-watcher/196086)
**Author:** [@ntran](https://discuss.elastic.co/u/ntran)\ **Replies:** 2\ **Last updated:** [August 21, 2019, 1:06pm UTC](https://discuss.elastic.co/t/status-failure-for-slack-watcher/196086 "2019-08-21T13:06:54Z")
Hi, My slack message is failing and I was hoping someone could help me with figuring out why. // Action statement thus far "actions": { "notify-slack": { "throttle\_period": "5m", "slack": { "… --- ## [Too Many PoolArena$HeapArena Instances can not be Collected](https://discuss.elastic.co/t/too-many-poolarena-heaparena-instances-can-not-be-collected/196113)
**Author:** [@Liam](https://discuss.elastic.co/u/Liam)\ **Replies:** 0\ **Last updated:** [August 21, 2019, 12:47pm UTC](https://discuss.elastic.co/t/too-many-poolarena-heaparena-instances-can-not-be-collected/196113 "2019-08-21T12:47:37Z")
Default configuration and singleton PreBuiltTransportClient that never be closed. What's the possible reason? --- ## [Automate Reindex API while source is still indexing](https://discuss.elastic.co/t/automate-reindex-api-while-source-is-still-indexing/195099)
**Author:** [@abaullosa](https://discuss.elastic.co/u/abaullosa)\ **Replies:** 4\ **Last updated:** [August 21, 2019, 12:30pm UTC](https://discuss.elastic.co/t/automate-reindex-api-while-source-is-still-indexing/195099 "2019-08-21T12:30:28Z")
Hi. Im using ES 7. And I need to automate a process on Kibana so when I create a new Index, I need to \_reindex it using a query. Im able to do this manually but, How do I automate this process so everytime I have a new … --- ## [Match all words in any order but duplicates consider as individual](https://discuss.elastic.co/t/match-all-words-in-any-order-but-duplicates-consider-as-individual/196090)
**Author:** [@anjireddy543](https://discuss.elastic.co/u/anjireddy543)\ **Replies:** 0\ **Last updated:** [August 21, 2019, 11:08am UTC](https://discuss.elastic.co/t/match-all-words-in-any-order-but-duplicates-consider-as-individual/196090 "2019-08-21T11:08:26Z")
Hi, We have a text field which matches words in any order but when duplicate comes still both words need to exist. Below is my query and results "query": { "match": { "field": { "op… --- ## [Splunk lookup file equivalent](https://discuss.elastic.co/t/splunk-lookup-file-equivalent/196015)
**Author:** [@wengsengtam](https://discuss.elastic.co/u/wengsengtam)\ **Replies:** 2\ **Last updated:** [August 21, 2019, 10:36am UTC](https://discuss.elastic.co/t/splunk-lookup-file-equivalent/196015 "2019-08-21T10:36:25Z")
Hello Elastic Forum members, I have been exploring the different possible data enrichments that are available in Splunk. However, I am trying to understand if there is a plugin or module that can be added to Elastic to … --- ## [Ingest node / source name](https://discuss.elastic.co/t/ingest-node-source-name/195892)
**Author:** [@thaideval](https://discuss.elastic.co/u/thaideval)\ **Replies:** 8\ **Last updated:** [August 21, 2019, 9:45am UTC](https://discuss.elastic.co/t/ingest-node-source-name/195892 "2019-08-21T09:45:08Z")
Hello, i am using filebeat for sending logs to elastic and ingest node for parsing with grok. my logs have 2 fields for datestamp - \> 1/2 is in the name of every file (Year-month-day-hour) and 1/2 is in the beginning … --- ## [Connect node from internal network to external through dynamic dns](https://discuss.elastic.co/t/connect-node-from-internal-network-to-external-through-dynamic-dns/196073)
**Author:** [@heilwood](https://discuss.elastic.co/u/heilwood)\ **Replies:** 0\ **Last updated:** [August 21, 2019, 9:03am UTC](https://discuss.elastic.co/t/connect-node-from-internal-network-to-external-through-dynamic-dns/196073 "2019-08-21T09:03:17Z")
Is it possible to connect nodes from internal network with node from external network through dynamic dns. internal ip address: node1 - 192.168.1.1 node2 - 192.168.2.2 public dns: mypublic.ddns.net Public dns resol… --- ## [Elasticsearch aggregation size](https://discuss.elastic.co/t/elasticsearch-aggregation-size/196046)
**Author:** [@lakmina\_chathurya](https://discuss.elastic.co/u/lakmina_chathurya)\ **Replies:** 2\ **Last updated:** [August 21, 2019, 7:20am UTC](https://discuss.elastic.co/t/elasticsearch-aggregation-size/196046 "2019-08-21T07:20:36Z")
When i use following query, it shows only 10 buckets as default "aggs": { "group": { "terms": { "field": "user.keyword" } when i need to get all buckets i used following query "aggs": { "group": { "terms": { "f… --- ## [Elasticsearch 7.3.0 - Mapping Specific Fields](https://discuss.elastic.co/t/elasticsearch-7-3-0-mapping-specific-fields/195926)
**Author:** [@ShaqFanClub](https://discuss.elastic.co/u/ShaqFanClub)\ **Replies:** 1\ **Last updated:** [August 21, 2019, 7:20am UTC](https://discuss.elastic.co/t/elasticsearch-7-3-0-mapping-specific-fields/195926 "2019-08-21T07:20:10Z")
Hello, I may be missing this in the documentation, so forgive me. I want a template that specifies a handful of fields so unwanted fields aren't indexed, in order to save disk space. However, I don't want to explicitly… --- ## [No jvm.options after having installed JRE 8 and Elasticsearch 7.3.1](https://discuss.elastic.co/t/no-jvm-options-after-having-installed-jre-8-and-elasticsearch-7-3-1/195939)
**Author:** [@scarabas](https://discuss.elastic.co/u/scarabas)\ **Replies:** 6\ **Last updated:** [August 21, 2019, 7:07am UTC](https://discuss.elastic.co/t/no-jvm-options-after-having-installed-jre-8-and-elasticsearch-7-3-1/195939 "2019-08-21T07:07:56Z")
I have just installed JRE by using apt-get install default-jre I then installed Elasticsearch by using apt-get install elasticsearch Now, I have to edit the jvm.options file, which should reside under /etc/elasticse… --- ## [Documents with Regex fields](https://discuss.elastic.co/t/documents-with-regex-fields/195833)
**Author:** [@krish3](https://discuss.elastic.co/u/krish3)\ **Replies:** 3\ **Last updated:** [August 21, 2019, 6:50am UTC](https://discuss.elastic.co/t/documents-with-regex-fields/195833 "2019-08-21T06:50:02Z")
I have documents with fields themselves being a regular expression. For example doc1: regexp:1111.\*01011 doc2: regexp: 111.\*01011 So if I give a query with regexp:1111010111101011 should return doc1 and doc2, while a… --- ## [Elastic nodes large heap usage - "Data too large, data for \[\\] would be..."](https://discuss.elastic.co/t/elastic-nodes-large-heap-usage-data-too-large-data-for-http-request-would-be/195420)
**Author:** [@jenga](https://discuss.elastic.co/u/jenga)\ **Replies:** 4\ **Last updated:** [August 21, 2019, 6:50am UTC](https://discuss.elastic.co/t/elastic-nodes-large-heap-usage-data-too-large-data-for-http-request-would-be/195420 "2019-08-21T06:50:01Z")
Hi, I have a 2-node Elastic cluster, each node has 6GB RAM and 2CPUs. I've assigned a max heap of 2GB to ElasticSearch. There's a tiny amount of data in there as I'm still trying to get it set up properly. At least onc… --- ## [ElasticSearch 6.x failed to start](https://discuss.elastic.co/t/elasticsearch-6-x-failed-to-start/195987)
**Author:** [@debjit](https://discuss.elastic.co/u/debjit)\ **Replies:** 1\ **Last updated:** [August 21, 2019, 6:47am UTC](https://discuss.elastic.co/t/elasticsearch-6-x-failed-to-start/195987 "2019-08-21T06:47:54Z")
● elasticsearch.service - Elasticsearch Loaded: loaded (/usr/lib/systemd/system/elasticsearch.service; enabled; vendor preset: disabled) Active: failed (Result: exit-code) since Tue 2019-08-20 19:19:16 UTC; 5s ago Doc… --- ## [Need assistance on Bitbucket elasticsearch 5.5.3](https://discuss.elastic.co/t/need-assistance-on-bitbucket-elasticsearch-5-5-3/196038)
**Author:** [@arudinesh](https://discuss.elastic.co/u/arudinesh)\ **Replies:** 2\ **Last updated:** [August 21, 2019, 6:43am UTC](https://discuss.elastic.co/t/need-assistance-on-bitbucket-elasticsearch-5-5-3/196038 "2019-08-21T06:43:47Z")
Hi Team, Since a couple of weeks elasticsearch 5.5.3 was stopped working without any clue and we have rebuild the elasticsearch but no luck and received with below. Kindly assist to resolve the issue \[2019-08-21T00:15:… --- ## [Fielddata is disabled on text fields](https://discuss.elastic.co/t/fielddata-is-disabled-on-text-fields/195793)
**Author:** [@jwalls](https://discuss.elastic.co/u/jwalls)\ **Replies:** 4\ **Last updated:** [August 21, 2019, 6:38am UTC](https://discuss.elastic.co/t/fielddata-is-disabled-on-text-fields/195793 "2019-08-21T06:38:07Z")
So an error I'm receiving for "logstash-2019.08.19" is "Fielddata is disabled on text fields by default. Set fielddata=true on \[time\] in order to load fielddata in memory by uninverting the inverted index. Note that this… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1183) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1185)