# Elasticsearch

**URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1212

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 1213

---

## [ElasticSearch 7.2.0 immediately fails with Java out of memory error](https://discuss.elastic.co/t/elasticsearch-7-2-0-immediately-fails-with-java-out-of-memory-error/192048)

<div class="topic-metadata">

**Author:** [@paulwnelson](https://discuss.elastic.co/u/paulwnelson)\
**Replies:** 1\
**Last updated:** [July 26, 2019, 5:37pm UTC](https://discuss.elastic.co/t/elasticsearch-7-2-0-immediately-fails-with-java-out-of-memory-error/192048 "2019-07-26T17:37:08Z")

</div>

Java version 1.8.0\_221 32 Gigs of memory on machine If we choose anything over 2048m for the heap size ( like 4096m in the attached screenshot ) elastic search dies IMMEDIATELY upon launch. The memory shows as only 20…

---

## [How can I use arcDistance in 6.7 painless](https://discuss.elastic.co/t/how-can-i-use-arcdistance-in-6-7-painless/191763)

<div class="topic-metadata">

**Author:** [@111183](https://discuss.elastic.co/u/111183)\
**Replies:** 1\
**Last updated:** [July 26, 2019, 5:31pm UTC](https://discuss.elastic.co/t/how-can-i-use-arcdistance-in-6-7-painless/191763 "2019-07-26T17:31:10Z")

</div>

How can I use arcDistance in 6.7 painless? doc\['location'\].arcDistanceInKm(37.495359, 127.033065) "type": "illegal\_argument\_exception", "reason": "dynamic method \[org.elasticsearch.index.fielddata.ScriptDoc…

---

## [How does one set passwords in a pod with x-pack true](https://discuss.elastic.co/t/how-does-one-set-passwords-in-a-pod-with-x-pack-true/192360)

<div class="topic-metadata">

**Author:** [@Soumitra\_Ghosh](https://discuss.elastic.co/u/Soumitra_Ghosh)\
**Replies:** 6\
**Last updated:** [July 26, 2019, 5:26pm UTC](https://discuss.elastic.co/t/how-does-one-set-passwords-in-a-pod-with-x-pack-true/192360 "2019-07-26T17:26:44Z")

</div>

All the examples are related to running bin/elasticsearch-setup-passwords interactive or auto however once elastic pod is started there is no way to shutdown to run these commands. Is there an env variable that can be p…

---

## [JAVA License change](https://discuss.elastic.co/t/java-license-change/191633)

<div class="topic-metadata">

**Author:** [@mmarzec](https://discuss.elastic.co/u/mmarzec)\
**Replies:** 1\
**Last updated:** [July 26, 2019, 5:22pm UTC](https://discuss.elastic.co/t/java-license-change/191633 "2019-07-26T17:22:59Z")

</div>

We have a question about java license change. Is there any impact on elastic search component? https://www.oracle.com/technetwork/java/javase/downloads/server-jre8-downloads-2133154.html

---

## [Append to an existing field (String)](https://discuss.elastic.co/t/append-to-an-existing-field-string/192478)

<div class="topic-metadata">

**Author:** [@bobsmith](https://discuss.elastic.co/u/bobsmith)\
**Replies:** 6\
**Last updated:** [July 26, 2019, 4:59pm UTC](https://discuss.elastic.co/t/append-to-an-existing-field-string/192478 "2019-07-26T16:59:29Z")

</div>

I have to be able to index very large files and part of that includes indexing on their content. For the sake of this post let's assume all of my files are just .txt files. If my file is 1GB I will have trouble indexing …

---

## [Elasticsearch adding new documents all by itself](https://discuss.elastic.co/t/elasticsearch-adding-new-documents-all-by-itself/192266)

<div class="topic-metadata">

**Author:** [@PaulaM](https://discuss.elastic.co/u/PaulaM)\
**Replies:** 4\
**Last updated:** [July 26, 2019, 4:24pm UTC](https://discuss.elastic.co/t/elasticsearch-adding-new-documents-all-by-itself/192266 "2019-07-26T16:24:48Z")

</div>

I've been using Elasticsearch for a few weeks, and now I also installed Kibana to create some visualizations for my data. I have a Python script which I open in three instances (I collect data with three different senso…

---

## [Docker health check powershell cmd high CPU usage Windows Server issue](https://discuss.elastic.co/t/docker-health-check-powershell-cmd-high-cpu-usage-windows-server-issue/192476)

<div class="topic-metadata">

**Author:** [@Aidar\_Gatin](https://discuss.elastic.co/u/Aidar_Gatin)\
**Replies:** 0\
**Last updated:** [July 26, 2019, 4:14pm UTC](https://discuss.elastic.co/t/docker-health-check-powershell-cmd-high-cpu-usage-windows-server-issue/192476 "2019-07-26T16:14:43Z")

</div>

Hi, Maybe this is more Docker related question, but maybe someone can suggest something. I use Windows Server 2016 Hosting ES version 7.1.1 in Docker container microsoft/windowsservercore- ltsc2016 I've built an imag…

---

## [Likely root cause: org.elasticsearch.gateway.CorruptStateException: codec footer mismatch (file truncated?): actual footer=-993495054 vs expected footer=-1071082520](https://discuss.elastic.co/t/likely-root-cause-org-elasticsearch-gateway-corruptstateexception-codec-footer-mismatch-file-truncated-actual-footer-993495054-vs-expected-footer-1071082520/192397)

<div class="topic-metadata">

**Author:** [@pperiketi](https://discuss.elastic.co/u/pperiketi)\
**Replies:** 7\
**Last updated:** [July 26, 2019, 4:02pm UTC](https://discuss.elastic.co/t/likely-root-cause-org-elasticsearch-gateway-corruptstateexception-codec-footer-mismatch-file-truncated-actual-footer-993495054-vs-expected-footer-1071082520/192397 "2019-07-26T16:02:26Z")

</div>

Hello, I am getting below error when trying to start the ElasticSearch service. Please let me know if you how to resolve this issue. \[2019-07-26 06:38:15,086\]\[ERROR\]\[bootstrap \] Guice Exception: Elastic…

---

## [Elastic Common Schema for IPS Logs](https://discuss.elastic.co/t/elastic-common-schema-for-ips-logs/189259)

<div class="topic-metadata">

**Author:** [@Nybble](https://discuss.elastic.co/u/Nybble)\
**Replies:** 3\
**Last updated:** [July 26, 2019, 3:55pm UTC](https://discuss.elastic.co/t/elastic-common-schema-for-ips-logs/189259 "2019-07-26T15:55:52Z")

</div>

Hello, I'm currently working on implementing ECS but i'm stuck with IPS Logs. As many Antivirus, IPS, HIPS and other detection softwares, my IPS generate logs containing "Application" information and behavior thought n…

---

## [Identifying/fixing latency (95th percentile between 1-4.5 seconds)](https://discuss.elastic.co/t/identifying-fixing-latency-95th-percentile-between-1-4-5-seconds/190866)

<div class="topic-metadata">

**Author:** [@jader201](https://discuss.elastic.co/u/jader201)\
**Replies:** 9\
**Last updated:** [July 26, 2019, 3:47pm UTC](https://discuss.elastic.co/t/identifying-fixing-latency-95th-percentile-between-1-4-5-seconds/190866 "2019-07-26T15:47:14Z")

</div>

We have had Elasticsearch \[1\] running in a production environment for a while, and started doing some analysis on performance. Unfortunately, our performance seems to be very hit or miss. Our 50th percentile is usually …

---

## [Querying multiple fields at once](https://discuss.elastic.co/t/querying-multiple-fields-at-once/191616)

<div class="topic-metadata">

**Author:** [@Champ](https://discuss.elastic.co/u/Champ)\
**Replies:** 6\
**Last updated:** [July 26, 2019, 3:41pm UTC](https://discuss.elastic.co/t/querying-multiple-fields-at-once/191616 "2019-07-26T15:41:53Z")

</div>

I was just wondering if there is a way to query two fields at the same time. This is the query I'm using right now setQuery(QueryBuilders.matchPhraseQuery("message", searchString)).get(); I would also like to add a ra…

---

## [Log type converter? RMS/VMS logs into ascii or syslog format for Elastic Ingest](https://discuss.elastic.co/t/log-type-converter-rms-vms-logs-into-ascii-or-syslog-format-for-elastic-ingest/192468)

<div class="topic-metadata">

**Author:** [@lnxjenn](https://discuss.elastic.co/u/lnxjenn)\
**Replies:** 0\
**Last updated:** [July 26, 2019, 2:57pm UTC](https://discuss.elastic.co/t/log-type-converter-rms-vms-logs-into-ascii-or-syslog-format-for-elastic-ingest/192468 "2019-07-26T14:57:09Z")

</div>

Greetings We are trying to onboard new system logs into our ELK stack. But they logs are in an RMS format, not usual syslog/ASCII type logs. Is there a converter or someway elastic can convert those log into a readable…

---

## [Is there a way to draw infrastructure map](https://discuss.elastic.co/t/is-there-a-way-to-draw-infrastructure-map/192466)

<div class="topic-metadata">

**Author:** [@rschirin](https://discuss.elastic.co/u/rschirin)\
**Replies:** 0\
**Last updated:** [July 26, 2019, 2:52pm UTC](https://discuss.elastic.co/t/is-there-a-way-to-draw-infrastructure-map/192466 "2019-07-26T14:52:16Z")

</div>

hi guys, is there a way to draw an infrastructure map of Elastic cluster? I mean, since I have to write documentation about all the components (elastic, kibana, beats), I would like to know if I can find a way to do it…

---

## [Querystring search on special characters](https://discuss.elastic.co/t/querystring-search-on-special-characters/192305)

<div class="topic-metadata">

**Author:** [@diliprajamani1](https://discuss.elastic.co/u/diliprajamani1)\
**Replies:** 2\
**Last updated:** [July 26, 2019, 2:45pm UTC](https://discuss.elastic.co/t/querystring-search-on-special-characters/192305 "2019-07-26T14:45:08Z")

</div>

Hello there, I am looking a weird behavior on one of my query, see if you can help. I am indexing the following 2 documents PUT ramptestindex/\_doc/360238 { "OriginRamp" : { "RampID" : 360238, "RampCode" : "D!", "R…

---

## [Handling lost replicas in preemptible instances](https://discuss.elastic.co/t/handling-lost-replicas-in-preemptible-instances/192462)

<div class="topic-metadata">

**Author:** [@aclowkey](https://discuss.elastic.co/u/aclowkey)\
**Replies:** 0\
**Last updated:** [July 26, 2019, 2:31pm UTC](https://discuss.elastic.co/t/handling-lost-replicas-in-preemptible-instances/192462 "2019-07-26T14:31:43Z")

</div>

I have a set up which has two instance groups on GCP: One is just a normal instance group, and the other is preemptible. The preemptible instance group is autoscaled based on QPS. At this moment, the setup is that of an…

---

## [How to solve "Fielddata is disabled on text fields by default"](https://discuss.elastic.co/t/how-to-solve-fielddata-is-disabled-on-text-fields-by-default/192322)

<div class="topic-metadata">

**Author:** [@jcaballero](https://discuss.elastic.co/u/jcaballero)\
**Replies:** 3\
**Last updated:** [July 26, 2019, 2:00pm UTC](https://discuss.elastic.co/t/how-to-solve-fielddata-is-disabled-on-text-fields-by-default/192322 "2019-07-26T14:00:06Z")

</div>

Hi \[again\], I already opened a while ago a Topic on this issue, but it expired. So I am opening a new one. https://discuss.elastic.co/t/how-to-apply-mappings-just-once/181280 ElasticSearch 5.6.10 When I try to sort i…

---

## [Faceting on Elasticsearch 7.2.0](https://discuss.elastic.co/t/faceting-on-elasticsearch-7-2-0/192444)

<div class="topic-metadata">

**Author:** [@angelo.caci](https://discuss.elastic.co/u/angelo.caci)\
**Replies:** 0\
**Last updated:** [July 26, 2019, 12:58pm UTC](https://discuss.elastic.co/t/faceting-on-elasticsearch-7-2-0/192444 "2019-07-26T12:58:50Z")

</div>

Hi to everyone, I need to populate my filters graphic components(EUI) with the Java api. The desired behaviour is that when i make a search on elastic, my filters would be populated according to the search results. Ho…

---

## [Shard stuck with stage FINALIZE but RELOCATING for more than 7 hours](https://discuss.elastic.co/t/shard-stuck-with-stage-finalize-but-relocating-for-more-than-7-hours/192404)

<div class="topic-metadata">

**Author:** [@sabdoul](https://discuss.elastic.co/u/sabdoul)\
**Replies:** 0\
**Last updated:** [July 26, 2019, 10:30am UTC](https://discuss.elastic.co/t/shard-stuck-with-stage-finalize-but-relocating-for-more-than-7-hours/192404 "2019-07-26T10:30:31Z")

</div>

Hello, We have indexes that we wanted to move on other nodes but since the shards have been RELOCATING for more than 7 hours. Then the files and bytes have all been moved to 100%. Below is the monitoring capture of the…

---

## [Frozen indices does not return data](https://discuss.elastic.co/t/frozen-indices-does-not-return-data/192273)

<div class="topic-metadata">

**Author:** [@aurimas](https://discuss.elastic.co/u/aurimas)\
**Replies:** 2\
**Last updated:** [July 26, 2019, 9:45am UTC](https://discuss.elastic.co/t/frozen-indices-does-not-return-data/192273 "2019-07-26T09:45:38Z")

</div>

Hi, I am running Elastic 6.61 version and trying to use frozen indices. But same queries I used before does not return any data neither in Grafana nor in Postman. Do I have to do anything different when I use frozen in…

---

## [Unable to build elasticsearch from source on mac: Could not set unknown property 'excludes'](https://discuss.elastic.co/t/unable-to-build-elasticsearch-from-source-on-mac-could-not-set-unknown-property-excludes/191394)

<div class="topic-metadata">

**Author:** [@nkoothrappahli](https://discuss.elastic.co/u/nkoothrappahli)\
**Replies:** 1\
**Last updated:** [July 26, 2019, 9:44am UTC](https://discuss.elastic.co/t/unable-to-build-elasticsearch-from-source-on-mac-could-not-set-unknown-property-excludes/191394 "2019-07-26T09:44:05Z")

</div>

git checkout v7.2.0 HEAD ist jetzt bei 508c38a450a Mute DieWithDignityIT test. (#43415) ./gradlew run \> Configure project :benchmarks ======================================= Elasticsearch Build Hamster says Hello! Gr…

---

## [Outputting new values in the last X months compared to entire timeline](https://discuss.elastic.co/t/outputting-new-values-in-the-last-x-months-compared-to-entire-timeline/192244)

<div class="topic-metadata">

**Author:** [@yananas](https://discuss.elastic.co/u/yananas)\
**Replies:** 1\
**Last updated:** [July 26, 2019, 9:24am UTC](https://discuss.elastic.co/t/outputting-new-values-in-the-last-x-months-compared-to-entire-timeline/192244 "2019-07-26T09:24:02Z")

</div>

Greetings, Using Elasticsearch 2.4, directly by DSL query. I am looking for a way to output values that only appeared in the last X months compared to the entire timeline. Example: given a dataset with these data …

---

## [Performance hit causing high search latency](https://discuss.elastic.co/t/performance-hit-causing-high-search-latency/191405)

<div class="topic-metadata">

**Author:** [@kirancodify](https://discuss.elastic.co/u/kirancodify)\
**Replies:** 1\
**Last updated:** [July 26, 2019, 9:20am UTC](https://discuss.elastic.co/t/performance-hit-causing-high-search-latency/191405 "2019-07-26T09:20:21Z")

</div>

I am trying to understand what is causing this. There was a increase in search latency and query latency during some part of time on our cluster causing some reports to fail. On looking into some cluster stats, I observ…

---

## [HELP PLEASE! Multiple Search Fields on Page causing one search not to work](https://discuss.elastic.co/t/help-please-multiple-search-fields-on-page-causing-one-search-not-to-work/192320)

<div class="topic-metadata">

**Author:** [@gbucha](https://discuss.elastic.co/u/gbucha)\
**Replies:** 1\
**Last updated:** [July 26, 2019, 9:18am UTC](https://discuss.elastic.co/t/help-please-multiple-search-fields-on-page-causing-one-search-not-to-work/192320 "2019-07-26T09:18:38Z")

</div>

I have two search inputs on my page, one on the page and one that is available when you click a search icon in the top nav, it brings a popup box in focus with a search input. I updated my Results Container to go to thi…

---

## [Way to avoid hitting max field length. term\_vectors vs offsets](https://discuss.elastic.co/t/way-to-avoid-hitting-max-field-length-term-vectors-vs-offsets/192390)

<div class="topic-metadata">

**Author:** [@elk11](https://discuss.elastic.co/u/elk11)\
**Replies:** 0\
**Last updated:** [July 26, 2019, 8:49am UTC](https://discuss.elastic.co/t/way-to-avoid-hitting-max-field-length-term-vectors-vs-offsets/192390 "2019-07-26T08:49:55Z")

</div>

Hi, We are hitting errors "The length of \[some\_field\] field of \[some\_doc\] doc of \[index\] index has exceeded \[10000000\] - maximum allowed to be analyzed for highlighting. For large texts, indexing with offsets or term ve…

---

## [Problem with Filebeat \> Logstash \> Elasticsearch](https://discuss.elastic.co/t/problem-with-filebeat-logstash-elasticsearch/192337)

<div class="topic-metadata">

**Author:** [@oliverlucas1](https://discuss.elastic.co/u/oliverlucas1)\
**Replies:** 2\
**Last updated:** [July 26, 2019, 8:33am UTC](https://discuss.elastic.co/t/problem-with-filebeat-logstash-elasticsearch/192337 "2019-07-26T08:33:44Z")

</div>

I'm trying to fix/upgrade my Elasticsearch cluster and i think i'm nearly there i have a few massive problems so hopefully someone will be able to assist. I am not familiar with Elasticsearch or Logstash but i'm working …

---

## [Elasticsearch can't handle after 10 to 15 days indexs data](https://discuss.elastic.co/t/elasticsearch-cant-handle-after-10-to-15-days-indexs-data/190988)

<div class="topic-metadata">

**Author:** [@Aftab\_Ali](https://discuss.elastic.co/u/Aftab_Ali)\
**Replies:** 6\
**Last updated:** [July 26, 2019, 8:07am UTC](https://discuss.elastic.co/t/elasticsearch-cant-handle-after-10-to-15-days-indexs-data/190988 "2019-07-26T08:07:47Z")

</div>

Dear Team, I am happy to use elk stack, but after 7 to 10 days elasticsearch is not working fine and it can't handle more indexes, to fix that issue, I will have to restart the elasticsearch and delete indexes, Kindly g…

---

## [Error while importing json file](https://discuss.elastic.co/t/error-while-importing-json-file/192374)

<div class="topic-metadata">

**Author:** [@pharshil9697](https://discuss.elastic.co/u/pharshil9697)\
**Replies:** 0\
**Last updated:** [July 26, 2019, 7:19am UTC](https://discuss.elastic.co/t/error-while-importing-json-file/192374 "2019-07-26T07:19:25Z")

</div>

I created one index and then tried to import a json file. But it displays a parsing error. Elasticsearch 7.2.0 POST accounts/acc { "mappings": { "default": { "properties": { "account\_number": { "type": "integer" …

---

## [Open Source Features - ELK](https://discuss.elastic.co/t/open-source-features-elk/192372)

<div class="topic-metadata">

**Author:** [@chandramohan.j](https://discuss.elastic.co/u/chandramohan.j)\
**Replies:** 0\
**Last updated:** [July 26, 2019, 7:16am UTC](https://discuss.elastic.co/t/open-source-features-elk/192372 "2019-07-26T07:16:53Z")

</div>

What can we monitoring (Performance Metrics) using ELK by Open source and what are the features include for Open source?Does open source support APM if it is yes then what are the metrics can provide in open source?

---

## [Use my own global ordinals with a painless script?](https://discuss.elastic.co/t/use-my-own-global-ordinals-with-a-painless-script/192366)

<div class="topic-metadata">

**Author:** [@Kazim\_Zaidi](https://discuss.elastic.co/u/Kazim_Zaidi)\
**Replies:** 0\
**Last updated:** [July 26, 2019, 6:31am UTC](https://discuss.elastic.co/t/use-my-own-global-ordinals-with-a-painless-script/192366 "2019-07-26T06:31:08Z")

</div>

Here's what one of my document might look like { "CC":{"colors":\["Blue","Green","Yellow"\]}, "CN":{"colors":\["White","Green","Blue"\]}, "WA":{"colors":\["Orange","Green","Blue"\]} } I want a terms aggregation, on the…

---

## [\_cat/indices counts not updating in7.2?](https://discuss.elastic.co/t/cat-indices-counts-not-updating-in7-2/192350)

<div class="topic-metadata">

**Author:** [@esmattdawson](https://discuss.elastic.co/u/esmattdawson)\
**Replies:** 1\
**Last updated:** [July 26, 2019, 5:33am UTC](https://discuss.elastic.co/t/cat-indices-counts-not-updating-in7-2/192350 "2019-07-26T05:33:37Z")

</div>

I'm indexing a large number of records using bulk requests and watching the index counts using watch 'curl \_cat/indices'. The index counts update for about 30s then stop. If I query the total count of all indexes using…

[Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1211)

[Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1213)
