# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1224 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1225 --- ## [Index rotation](https://discuss.elastic.co/t/index-rotation/190960)
**Author:** [@maasid](https://discuss.elastic.co/u/maasid)\ **Replies:** 1\ **Last updated:** [July 17, 2019, 10:42am UTC](https://discuss.elastic.co/t/index-rotation/190960 "2019-07-17T10:42:16Z")
Hello, I have upgraded to elasticsearch v7.2.0 and the same has been done for all beats that I used along with kibana. Now, since I upgraded, my indexes have been rotating based on size roughly 100gb, instead of date. H… --- ## [Curator run failing with NewConnectionError(urllib3.connection.HTTPConnection)](https://discuss.elastic.co/t/curator-run-failing-with-newconnectionerror-urllib3-connection-httpconnection/190745)
**Author:** [@sanooprajps](https://discuss.elastic.co/u/sanooprajps)\ **Replies:** 7\ **Last updated:** [July 17, 2019, 9:53am UTC](https://discuss.elastic.co/t/curator-run-failing-with-newconnectionerror-urllib3-connection-httpconnection/190745 "2019-07-17T09:53:00Z")
Hello, When I am trying to delete index on ELK single node cluster using curator it is failing with below error. I know it is a common error having many threads, but I am not able to find a proper solution for any. Whe… --- ## [ES 6.7.2 - "failed to read local state, exiting" on minor k8s pod updates (not ES upgrade)](https://discuss.elastic.co/t/es-6-7-2-failed-to-read-local-state-exiting-on-minor-k8s-pod-updates-not-es-upgrade/190795)
**Author:** [@LucasSh](https://discuss.elastic.co/u/LucasSh)\ **Replies:** 1\ **Last updated:** [July 17, 2019, 10:19am UTC](https://discuss.elastic.co/t/es-6-7-2-failed-to-read-local-state-exiting-on-minor-k8s-pod-updates-not-es-upgrade/190795 "2019-07-17T10:19:50Z")
Our CI/CD is hung on a failed data pod (data-1) that cannot startup due to the following error/exception: \[2019-07-16T16:39:30,650\]\[ERROR\]\[o.e.g.GatewayMetaState \] \[stgsiemv2-elasticsearch-data-1\] failed to read local… --- ## [Azure Not uninstall in elastic search](https://discuss.elastic.co/t/azure-not-uninstall-in-elastic-search/190953)
**Author:** [@tamil6593](https://discuss.elastic.co/u/tamil6593)\ **Replies:** 0\ **Last updated:** [July 17, 2019, 10:09am UTC](https://discuss.elastic.co/t/azure-not-uninstall-in-elastic-search/190953 "2019-07-17T10:09:13Z")
i want to remove the azure repository from elastic search but i could not remove file its show Exception in thread "main" java.nio.file.FileAlreadyExistsException: change the account name command elasticsearch-7.0.1 … --- ## [How to prevent terms aggregation from causing OOM on data nodes](https://discuss.elastic.co/t/how-to-prevent-terms-aggregation-from-causing-oom-on-data-nodes/190941)
**Author:** [@stephen.palfreyman](https://discuss.elastic.co/u/stephen.palfreyman)\ **Replies:** 3\ **Last updated:** [July 17, 2019, 10:15am UTC](https://discuss.elastic.co/t/how-to-prevent-terms-aggregation-from-causing-oom-on-data-nodes/190941 "2019-07-17T10:15:52Z")
We have experienced a similar issue to that described in this thread whereby one of our users tries to create a huge data table in a visualization in Kibana. This table has 2 buckets which result in 180,000 discrete valu… --- ## [Facet aggregate real OR condition](https://discuss.elastic.co/t/facet-aggregate-real-or-condition/190940)
**Author:** [@aagafonov77](https://discuss.elastic.co/u/aagafonov77)\ **Replies:** 0\ **Last updated:** [July 17, 2019, 9:42am UTC](https://discuss.elastic.co/t/facet-aggregate-real-or-condition/190940 "2019-07-17T09:42:52Z")
Dear friends, I have problem with filters in ES 7.2 seach request { 'query': { 'bool': { 'filter': { \[ { "bool": { "should": { "terms": { "properties.tip\_lamp": \[ "led" \] } } } }, { "bool": { "should… --- ## [How to make a query for group by count?](https://discuss.elastic.co/t/how-to-make-a-query-for-group-by-count/190776)
**Author:** [@psyapathy](https://discuss.elastic.co/u/psyapathy)\ **Replies:** 2\ **Last updated:** [July 17, 2019, 9:39am UTC](https://discuss.elastic.co/t/how-to-make-a-query-for-group-by-count/190776 "2019-07-17T09:39:35Z")
Hello! I looking for information by event\_id 2771 And i get result table (example): I want to group the data and hide the duplicate TargetUser by their count in table. I want this result: Is it possible? How to … --- ## [ES 6.6.2 - Synonym Filter Not Working as Expected](https://discuss.elastic.co/t/es-6-6-2-synonym-filter-not-working-as-expected/190935)
**Author:** [@axitxan](https://discuss.elastic.co/u/axitxan)\ **Replies:** 0\ **Last updated:** [July 17, 2019, 9:17am UTC](https://discuss.elastic.co/t/es-6-6-2-synonym-filter-not-working-as-expected/190935 "2019-07-17T09:17:32Z")
Version: 6.6.2 Issue: A word which is not present in synonym file is getting tokenised as a synonym. Steps to reproduce Step 1: Create Index PUT /test1 { "settings": { "index": { "refresh\_interval": "5m… --- ## [ECS - Squid proxy log normalization](https://discuss.elastic.co/t/ecs-squid-proxy-log-normalization/190777)
**Author:** [@herrBez](https://discuss.elastic.co/u/herrBez)\ **Replies:** 3\ **Last updated:** [July 17, 2019, 8:48am UTC](https://discuss.elastic.co/t/ecs-squid-proxy-log-normalization/190777 "2019-07-17T08:48:35Z")
Hi there, I really like to use elastic common schema for my data coming from a squid proxy, but I cannot really understand which ECS Field Reference should I use. Observer seems good to describe the data about the prox… --- ## [ElasticSearch Cluster Nodes File system](https://discuss.elastic.co/t/elasticsearch-cluster-nodes-file-system/190173)
**Author:** [@rsumit](https://discuss.elastic.co/u/rsumit)\ **Replies:** 2\ **Last updated:** [July 17, 2019, 8:34am UTC](https://discuss.elastic.co/t/elasticsearch-cluster-nodes-file-system/190173 "2019-07-17T08:34:05Z")
Hi Team Issue- In a two Node cluster Node A & Node B on Linux, Can we use a common shared (NFS/Cluster) filesystem for path.data and path.log on both nodes or we have to create on local filesystems of the server. Rsumi… --- ## [NEST Client \`BulkAll\` requires \`DefaultIndexFor\` or \`DefaultIndex\` to work](https://discuss.elastic.co/t/nest-client-bulkall-requires-defaultindexfor-or-defaultindex-to-work/189766)
**Author:** [@blemasle](https://discuss.elastic.co/u/blemasle)\ **Replies:** 2\ **Last updated:** [July 17, 2019, 7:18am UTC](https://discuss.elastic.co/t/nest-client-bulkall-requires-defaultindexfor-or-defaultindex-to-work/189766 "2019-07-17T07:18:27Z")
Hello there, Don't know if it's a bug or a requirement, but the NEST client BulkAll method of ElasticClient requires you to call DefaultIndexFor\() or DefaultIndex() before hand. You'll get an ArgumentException otherw… --- ## [Elastic cluster - 3nodes (1master - 2 data)](https://discuss.elastic.co/t/elastic-cluster-3nodes-1master-2-data/190363)
**Author:** [@manosmustang](https://discuss.elastic.co/u/manosmustang)\ **Replies:** 20\ **Last updated:** [July 17, 2019, 6:59am UTC](https://discuss.elastic.co/t/elastic-cluster-3nodes-1master-2-data/190363 "2019-07-17T06:59:10Z")
Hello, I have 3 nodes and started to create a cluster. 1 master and 2 data the problem is that I cannot connect the 3rd node (2nd data) at the cluster. \[root@elastic1 ~\]# curl localhost:9200/\_cat/nodes 172.… --- ## [Index Lifecycle Error: rollover\_alias keep resetting back](https://discuss.elastic.co/t/index-lifecycle-error-rollover-alias-keep-resetting-back/190882)
**Author:** [@TsuWeiQuan](https://discuss.elastic.co/u/TsuWeiQuan)\ **Replies:** 0\ **Last updated:** [July 17, 2019, 6:17am UTC](https://discuss.elastic.co/t/index-lifecycle-error-rollover-alias-keep-resetting-back/190882 "2019-07-17T06:17:16Z")
illegal\_argument\_exception: index.lifecycle.rollover\_alias \[metricbeat\] does not point to index \[metricbeat-pnsgsit1web7-2019.07.17-000006\] Hello, I have configured my ILM to rollover each day and i received this error… --- ## [How to avoid Data too large error for org.apache.spark.sql.streaming.StreamingQueryException](https://discuss.elastic.co/t/how-to-avoid-data-too-large-error-for-org-apache-spark-sql-streaming-streamingqueryexception/190604)
**Author:** [@yuecong](https://discuss.elastic.co/u/yuecong)\ **Replies:** 2\ **Last updated:** [July 17, 2019, 5:57am UTC](https://discuss.elastic.co/t/how-to-avoid-data-too-large-error-for-org-apache-spark-sql-streaming-streamingqueryexception/190604 "2019-07-17T05:57:36Z")
I am using spark streaming to dump data from Kafka to ES and I got the following errors. org.apache.spark.sql.streaming.StreamingQueryException: Job aborted due to stage failure: Task 6 in stage 4888.0 failed 4 times, … --- ## [Causes of High JVM in Data and Master nodes](https://discuss.elastic.co/t/causes-of-high-jvm-in-data-and-master-nodes/190452)
**Author:** [@lonzodc](https://discuss.elastic.co/u/lonzodc)\ **Replies:** 6\ **Last updated:** [July 17, 2019, 4:58am UTC](https://discuss.elastic.co/t/causes-of-high-jvm-in-data-and-master-nodes/190452 "2019-07-17T04:58:57Z")
Hi, What are the possible causes for JVM to be high? Our cluster's JVM Memory Pressure in data nodes are always about 60-75%. Master JVM Memory Pressure peaks at 75% every 10 minutes. We have ~4,000 indices in our clus… --- ## [Suricata Alerts to Maps](https://discuss.elastic.co/t/suricata-alerts-to-maps/190860)
**Author:** [@Taylor23](https://discuss.elastic.co/u/Taylor23)\ **Replies:** 0\ **Last updated:** [July 17, 2019, 3:21am UTC](https://discuss.elastic.co/t/suricata-alerts-to-maps/190860 "2019-07-17T03:21:14Z")
Hey Elasticsearch Team, I am trying to "Maps" to detail Suricata alerts that I am receiving. I use Wazuh to receive the Suricata logs and alert on particular severity levels. However, I am having trouble representing th… --- ## [Python SSL Error](https://discuss.elastic.co/t/python-ssl-error/189407)
**Author:** [@adwaitjoshi](https://discuss.elastic.co/u/adwaitjoshi)\ **Replies:** 12\ **Last updated:** [July 17, 2019, 12:38am UTC](https://discuss.elastic.co/t/python-ssl-error/189407 "2019-07-17T00:38:28Z")
I am trying to use the following code import elasticsearch es = elasticsearch.Elasticsearch(es\_protocol+'://'+es\_host+':'+es\_port,http\_auth=(\_user,\_pass),verify\_certs=None) es.indices.create(index=index\_name, ignore=4… --- ## [Clarification on using date ranges for URI searches](https://discuss.elastic.co/t/clarification-on-using-date-ranges-for-uri-searches/190815)
**Author:** [@Jason\_Baumgartner](https://discuss.elastic.co/u/Jason_Baumgartner)\ **Replies:** 3\ **Last updated:** [July 16, 2019, 9:20pm UTC](https://discuss.elastic.co/t/clarification-on-using-date-ranges-for-uri-searches/190815 "2019-07-16T21:20:33Z")
I am currently experimenting with using a Raspberry Pi 4 to ingest Reddit data in real-time. It is working very well, but I'm having a hard time finding concise documentation on how to use date ranges for a URI search. F… --- ## [How to set elasticsearch field not to be indexed but still need it to be queryable](https://discuss.elastic.co/t/how-to-set-elasticsearch-field-not-to-be-indexed-but-still-need-it-to-be-queryable/190806)
**Author:** [@viphuangwei](https://discuss.elastic.co/u/viphuangwei)\ **Replies:** 4\ **Last updated:** [July 16, 2019, 7:14pm UTC](https://discuss.elastic.co/t/how-to-set-elasticsearch-field-not-to-be-indexed-but-still-need-it-to-be-queryable/190806 "2019-07-16T19:14:01Z")
e.g. "testcolumn" this field in index\_test , let's set it not as a full-txt index, but we still can use the query as below. How we can achieve this? Post \_xpack/sql/ { "query": "select \* from index\_test where test… --- ## [Custom plugin for search](https://discuss.elastic.co/t/custom-plugin-for-search/190809)
**Author:** [@toloo](https://discuss.elastic.co/u/toloo)\ **Replies:** 0\ **Last updated:** [July 16, 2019, 6:03pm UTC](https://discuss.elastic.co/t/custom-plugin-for-search/190809 "2019-07-16T18:03:44Z")
Hello, I'm new to Elasticsearch. I'm looking to write a plugin that at search time, it only looks at some specific sub-fields based on the search query. For example, with the following example I only want to get "Cat Fr… --- ## [Export indexed data using curl](https://discuss.elastic.co/t/export-indexed-data-using-curl/190790)
**Author:** [@vijaykriishna](https://discuss.elastic.co/u/vijaykriishna)\ **Replies:** 4\ **Last updated:** [July 16, 2019, 5:09pm UTC](https://discuss.elastic.co/t/export-indexed-data-using-curl/190790 "2019-07-16T17:09:29Z")
Hi @dadoonet, @all I need to export indexed data from one of index in ES. How do i export it considering it's compatibility with bulk import it after updating mapping of this index ? I need to do this in production e… --- ## [Index creation and template mapping application timing](https://discuss.elastic.co/t/index-creation-and-template-mapping-application-timing/190798)
**Author:** [@Jarett](https://discuss.elastic.co/u/Jarett)\ **Replies:** 0\ **Last updated:** [July 16, 2019, 4:58pm UTC](https://discuss.elastic.co/t/index-creation-and-template-mapping-application-timing/190798 "2019-07-16T16:58:09Z")
We have a template setup with static mappings that are applied to a daily index, the index is only created when a document is stored in that index. We have a stream of data that's always being stored, so when a piece of … --- ## [Filtering based on hostname in metricbeat indices](https://discuss.elastic.co/t/filtering-based-on-hostname-in-metricbeat-indices/190792)
**Author:** [@amitavmohanty01](https://discuss.elastic.co/u/amitavmohanty01)\ **Replies:** 0\ **Last updated:** [July 16, 2019, 4:41pm UTC](https://discuss.elastic.co/t/filtering-based-on-hostname-in-metricbeat-indices/190792 "2019-07-16T16:41:02Z")
I am having metricbeat pushing data to Elasticsearch. A document of the index appeats like the following: { "\_index" : "metricbeat-system-2019.07.16", "\_type" : "doc", "\_id" : "F1nl-WsB5ioPniMf8f… --- ## [Re-index task getting failed](https://discuss.elastic.co/t/re-index-task-getting-failed/190771)
**Author:** [@ajeevpk](https://discuss.elastic.co/u/ajeevpk)\ **Replies:** 0\ **Last updated:** [July 16, 2019, 2:59pm UTC](https://discuss.elastic.co/t/re-index-task-getting-failed/190771 "2019-07-16T14:59:49Z")
Getting es\_rejected\_execution\_exception error Do we need to increase queue size or uplift the data nodes? also , why its showing task completed status true even after failures ? This is production issue, any help will… --- ## [New Index occupy way more disk size than the source index after reindexing](https://discuss.elastic.co/t/new-index-occupy-way-more-disk-size-than-the-source-index-after-reindexing/190769)
**Author:** [@praveengadugin1](https://discuss.elastic.co/u/praveengadugin1)\ **Replies:** 0\ **Last updated:** [July 16, 2019, 2:57pm UTC](https://discuss.elastic.co/t/new-index-occupy-way-more-disk-size-than-the-source-index-after-reindexing/190769 "2019-07-16T14:57:26Z")
I recently re-indexed my 14.7 million documents to a new index. Both source and destination index have 0 replicas. At the end of my re-indexing process, my destination index seems to occupy way more disk space than my s… --- ## [Cluster Problem pt2](https://discuss.elastic.co/t/cluster-problem-pt2/190573)
**Author:** [@thev0yager](https://discuss.elastic.co/u/thev0yager)\ **Replies:** 7\ **Last updated:** [July 16, 2019, 2:55pm UTC](https://discuss.elastic.co/t/cluster-problem-pt2/190573 "2019-07-16T14:55:00Z")
Hi, all I have been working to get an elastic stack cluster. My configration and nodes look as follows. Sorry for the terrible drawing My elastic yml files look as such That is the elasticsearch.yml file for my sec… --- ## [Uneven documents counts/disk-size after re-indexing](https://discuss.elastic.co/t/uneven-documents-counts-disk-size-after-re-indexing/190766)
**Author:** [@zatom](https://discuss.elastic.co/u/zatom)\ **Replies:** 0\ **Last updated:** [July 16, 2019, 2:51pm UTC](https://discuss.elastic.co/t/uneven-documents-counts-disk-size-after-re-indexing/190766 "2019-07-16T14:51:39Z")
I recently re-indexed my 14.7 million documents to a new index. Both source and destination index have 0 replicas. At the end of my re-indexing process, my destination index seems to occupy way more disk space than my s… --- ## [Not stable response time of elastic cluster](https://discuss.elastic.co/t/not-stable-response-time-of-elastic-cluster/190671)
**Author:** [@pa101](https://discuss.elastic.co/u/pa101)\ **Replies:** 7\ **Last updated:** [July 16, 2019, 2:49pm UTC](https://discuss.elastic.co/t/not-stable-response-time-of-elastic-cluster/190671 "2019-07-16T14:49:16Z")
60 shards 3 nodes elastic cluster, response time is pretty volatile from 20ms to 300ms, how could I make response time shorter and more stable? --- ## [Osx connection to elastic service cloud not working](https://discuss.elastic.co/t/osx-connection-to-elastic-service-cloud-not-working/190765)
**Author:** [@Francisco\_Silva](https://discuss.elastic.co/u/Francisco_Silva)\ **Replies:** 0\ **Last updated:** [July 16, 2019, 2:47pm UTC](https://discuss.elastic.co/t/osx-connection-to-elastic-service-cloud-not-working/190765 "2019-07-16T14:47:43Z")
I’m using mac and I have elastic search installed before locally together with kibana. My local Laravel website was working perfectly with this settings: SCOUT\_DRIVER=elastic SCOUT\_ELASTIC\_HOST=localhost:9200 Then I c… --- ## [Rollup a rolled up index](https://discuss.elastic.co/t/rollup-a-rolled-up-index/190764)
**Author:** [@mcguacon](https://discuss.elastic.co/u/mcguacon)\ **Replies:** 0\ **Last updated:** [July 16, 2019, 2:46pm UTC](https://discuss.elastic.co/t/rollup-a-rolled-up-index/190764 "2019-07-16T14:46:19Z")
I currently have a rollup job writing to the index rollup-windows-service with a 1 hour interval. Using both another rollup and an ILM policy, I want to further roll this data up to a 1 day interval once the data reache… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1223) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1225)