# Elasticsearch

**URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1231

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 1232

---

## [Realm discovery with SAML integration](https://discuss.elastic.co/t/realm-discovery-with-saml-integration/189270)

<div class="topic-metadata">

**Author:** [@chamilad](https://discuss.elastic.co/u/chamilad)\
**Replies:** 6\
**Last updated:** [July 11, 2019, 5:33am UTC](https://discuss.elastic.co/t/realm-discovery-with-saml-integration/189270 "2019-07-11T05:33:35Z")

</div>

Hi team, I'm researching Elastic's support for SAML for SSO and RBAC. As far as I understand from the documentation, Elasticsearch's SAML auth realm can work with any SAML supported IdP, and along with role mapping base…

---

## [Ingest date with 12 hour format](https://discuss.elastic.co/t/ingest-date-with-12-hour-format/189713)

<div class="topic-metadata">

**Author:** [@Vijayakumar\_Kannan](https://discuss.elastic.co/u/Vijayakumar_Kannan)\
**Replies:** 4\
**Last updated:** [July 11, 2019, 5:20am UTC](https://discuss.elastic.co/t/ingest-date-with-12-hour-format/189713 "2019-07-11T05:20:10Z")

</div>

Trying to extract the date by date processor it's not successful. Still taking the normal timestamp POST \_ingest/pipeline/\_simulate { "pipeline": { "processors": \[ { "grok": { "ignore\_missing": true, …

---

## [Is index creation API atomic?](https://discuss.elastic.co/t/is-index-creation-api-atomic/189881)

<div class="topic-metadata">

**Author:** [@Anfernee\_Xu](https://discuss.elastic.co/u/Anfernee_Xu)\
**Replies:** 1\
**Last updated:** [July 11, 2019, 5:01am UTC](https://discuss.elastic.co/t/is-index-creation-api-atomic/189881 "2019-07-11T05:01:54Z")

</div>

Is index creation API atomic? As I might have multiple clients trying to create the same index at the same time, can I assume index creation is atomic which mimic POSIX file system?

---

## [How get geohash value from a geo\_point in Elastic Search 7 in a simple query?](https://discuss.elastic.co/t/how-get-geohash-value-from-a-geo-point-in-elastic-search-7-in-a-simple-query/189902)

<div class="topic-metadata">

**Author:** [@Izthak\_Zadwing](https://discuss.elastic.co/u/Izthak_Zadwing)\
**Replies:** 0\
**Last updated:** [July 11, 2019, 4:01am UTC](https://discuss.elastic.co/t/how-get-geohash-value-from-a-geo-point-in-elastic-search-7-in-a-simple-query/189902 "2019-07-11T04:01:57Z")

</div>

In Elastic Search 7.1 I have an index and the mapping has some fields. One field is geo\_point How can I make a query that display the corresponding geohash of the geo\_point field? I do not want aggregation, I just wa…

---

## [How can I filter with multiple condition in aggregation bucket?](https://discuss.elastic.co/t/how-can-i-filter-with-multiple-condition-in-aggregation-bucket/189883)

<div class="topic-metadata">

**Author:** [@hangu\_choi](https://discuss.elastic.co/u/hangu_choi)\
**Replies:** 4\
**Last updated:** [July 11, 2019, 3:50am UTC](https://discuss.elastic.co/t/how-can-i-filter-with-multiple-condition-in-aggregation-bucket/189883 "2019-07-11T03:50:57Z")

</div>

I want agg bucket which filtered multiple condition like below. but It is returning Expected \[START\_OBJECT\] error {"error":{"root\_cause":\[{"type":"parsing\_exception","reason":"Expected \[START\_OBJECT\] under \[filter\], …

---

## [ElasticSearch stop on Centos 7](https://discuss.elastic.co/t/elasticsearch-stop-on-centos-7/189894)

<div class="topic-metadata">

**Author:** [@skazhikadyadya](https://discuss.elastic.co/u/skazhikadyadya)\
**Replies:** 3\
**Last updated:** [July 11, 2019, 3:13am UTC](https://discuss.elastic.co/t/elasticsearch-stop-on-centos-7/189894 "2019-07-11T03:13:19Z")

</div>

Hi. I have installed ES 5.6.16 on my Centos 7.3 from yum. After installation I was check status with service elasticsearch status: ● elasticsearch.service - Elasticsearch Loaded: loaded (/usr/lib/systemd/system/elasti…

---

## [Is there any performance problem using docker?](https://discuss.elastic.co/t/is-there-any-performance-problem-using-docker/189897)

<div class="topic-metadata">

**Author:** [@vincentduan](https://discuss.elastic.co/u/vincentduan)\
**Replies:** 0\
**Last updated:** [July 11, 2019, 2:51am UTC](https://discuss.elastic.co/t/is-there-any-performance-problem-using-docker/189897 "2019-07-11T02:51:36Z")

</div>

We have 13 elasticsearch nodes including 10 data nodes and 3 master node. Each node has 512GB memory and 100TB disk. And we have 200GB increasing data everyday using bulk API. If we migrate these into13 docker container…

---

## [Can we add fuzinness to more like this query](https://discuss.elastic.co/t/can-we-add-fuzinness-to-more-like-this-query/189895)

<div class="topic-metadata">

**Author:** [@ivar](https://discuss.elastic.co/u/ivar)\
**Replies:** 0\
**Last updated:** [July 11, 2019, 2:41am UTC](https://discuss.elastic.co/t/can-we-add-fuzinness-to-more-like-this-query/189895 "2019-07-11T02:41:51Z")

</div>

I am using match\_like\_this { "size":30, "query":{ "more\_like\_this":{ "fields":\["Name","ZipCode"\], "like":\[ { "\_index" : "myindex", "\_id" : "267AHVJDJSK2673" …

---

## ["Moving data from Elastic Search to SQL Server"](https://discuss.elastic.co/t/moving-data-from-elastic-search-to-sql-server/189863)

<div class="topic-metadata">

**Author:** [@m2web](https://discuss.elastic.co/u/m2web)\
**Replies:** 1\
**Last updated:** [July 11, 2019, 2:34am UTC](https://discuss.elastic.co/t/moving-data-from-elastic-search-to-sql-server/189863 "2019-07-11T02:34:29Z")

</div>

I have found several SQL Relational Db solutions for moving data from a relational Db to Elastic Search. Is there a way to export data from Elastic Search to a relational Db such as SQL Server?

---

## [Cannot get aggregation result without filter](https://discuss.elastic.co/t/cannot-get-aggregation-result-without-filter/189642)

<div class="topic-metadata">

**Author:** [@hangu\_choi](https://discuss.elastic.co/u/hangu_choi)\
**Replies:** 6\
**Last updated:** [July 11, 2019, 2:25am UTC](https://discuss.elastic.co/t/cannot-get-aggregation-result-without-filter/189642 "2019-07-11T02:25:55Z")

</div>

I want a filtered docs result and not filtered aggregation result in same query. I've been used elasticsearch 1.75 and able to get this result, but I can't do this in elasticsearch 7. If I am missing something, please l…

---

## [Elasticsearch Snapshot Method - is it Synthetic Full Backup?](https://discuss.elastic.co/t/elasticsearch-snapshot-method-is-it-synthetic-full-backup/189889)

<div class="topic-metadata">

**Author:** [@111171](https://discuss.elastic.co/u/111171)\
**Replies:** 1\
**Last updated:** [July 11, 2019, 2:22am UTC](https://discuss.elastic.co/t/elasticsearch-snapshot-method-is-it-synthetic-full-backup/189889 "2019-07-11T02:22:09Z")

</div>

Dear community thank you in advance for your patience and help. I learned that Elasticsearch Snapshot is incremental...but does it mean only what is incremental is stored? Or will it be synthesized with the full backup.…

---

## [Security realm settings structure changed](https://discuss.elastic.co/t/security-realm-settings-structure-changed/189702)

<div class="topic-metadata">

**Author:** [@swapnali](https://discuss.elastic.co/u/swapnali)\
**Replies:** 1\
**Last updated:** [July 11, 2019, 1:53am UTC](https://discuss.elastic.co/t/security-realm-settings-structure-changed/189702 "2019-07-11T01:53:47Z")

</div>

Hi I am trying to update my elasticsearch from 6.7.1 to 7.0 in assistant of 7.0 suggest below changes Security realm settings structure changed these settings must be updated to the new format while the node is offlin…

---

## [ML job does not fairly distribute via all ML nodes](https://discuss.elastic.co/t/ml-job-does-not-fairly-distribute-via-all-ml-nodes/189638)

<div class="topic-metadata">

**Author:** [@jasony](https://discuss.elastic.co/u/jasony)\
**Replies:** 2\
**Last updated:** [July 11, 2019, 1:29am UTC](https://discuss.elastic.co/t/ml-job-does-not-fairly-distribute-via-all-ml-nodes/189638 "2019-07-11T01:29:27Z")

</div>

hello, i am using ML function and set 3 nodes as ML node. First i created 3 ML jobs, the cluster spread 3 jobs into all 3 nodes. but after I restarted the cluster, 3 jobs were allocated into only one node. Is there way…

---

## [Script Score Query Cosine Similarity](https://discuss.elastic.co/t/script-score-query-cosine-similarity/186920)

<div class="topic-metadata">

**Author:** [@angelazhao](https://discuss.elastic.co/u/angelazhao)\
**Replies:** 3\
**Last updated:** [July 11, 2019, 12:07am UTC](https://discuss.elastic.co/t/script-score-query-cosine-similarity/186920 "2019-07-11T00:07:26Z")

</div>

I'm following the example that calculates cosine similarity using sparse vectors found here: https://www.elastic.co/guide/en/elasticsearch/reference/7.x/query-dsl-script-score-query.html My query is the following: GET …

---

## [Stopping any incoming data from filebeat](https://discuss.elastic.co/t/stopping-any-incoming-data-from-filebeat/187497)

<div class="topic-metadata">

**Author:** [@EldrosKandar](https://discuss.elastic.co/u/EldrosKandar)\
**Replies:** 4\
**Last updated:** [July 11, 2019, 12:06am UTC](https://discuss.elastic.co/t/stopping-any-incoming-data-from-filebeat/187497 "2019-07-11T00:06:24Z")

</div>

Since a while, I've been suffering from timeout each time I wanted to make a change through REST API calls. I've given the issue some thoughts and came to the idea of temporary blocking any incoming data so it wouldn't …

---

## [Elastic Common Schema generator scripts](https://discuss.elastic.co/t/elastic-common-schema-generator-scripts/189835)

<div class="topic-metadata">

**Author:** [@Nybble](https://discuss.elastic.co/u/Nybble)\
**Replies:** 2\
**Last updated:** [July 11, 2019, 12:02am UTC](https://discuss.elastic.co/t/elastic-common-schema-generator-scripts/189835 "2019-07-11T00:02:05Z")

</div>

Hello, I want to generate an ES mapping JSON file from my $fields.yml files with scripts on ECS Github (https://github.com/elastic/ecs/tree/master/scripts) but I can't figure out how to use these python scripts. Is it …

---

## [ILM policy being over written](https://discuss.elastic.co/t/ilm-policy-being-over-written/188582)

<div class="topic-metadata">

**Author:** [@syedsfayaz](https://discuss.elastic.co/u/syedsfayaz)\
**Replies:** 7\
**Last updated:** [July 10, 2019, 11:55pm UTC](https://discuss.elastic.co/t/ilm-policy-being-over-written/188582 "2019-07-10T23:55:44Z")

</div>

Hi This is a basic question. But can you please clarify. I have a setting in my file beat configuration. setup.ilm.enabled: auto # Configure the ILM write alias name. setup.ilm.rollover\_alias: "metricbeat" # Configu…

---

## [Sending container service logs to the elasticsearch](https://discuss.elastic.co/t/sending-container-service-logs-to-the-elasticsearch/189509)

<div class="topic-metadata">

**Author:** [@lmoreira](https://discuss.elastic.co/u/lmoreira)\
**Replies:** 2\
**Last updated:** [July 10, 2019, 8:52pm UTC](https://discuss.elastic.co/t/sending-container-service-logs-to-the-elasticsearch/189509 "2019-07-10T20:52:52Z")

</div>

Dears, good morning! I'm trying to set up without success in my compose file sending the logs of my containers / services to the elastic, below the configuration I'm using. I am using elasticstack 7.2.0 and below the c…

---

## [Elasticsearch JAVA Query with nesting](https://discuss.elastic.co/t/elasticsearch-java-query-with-nesting/189870)

<div class="topic-metadata">

**Author:** [@dhughes](https://discuss.elastic.co/u/dhughes)\
**Replies:** 0\
**Last updated:** [July 10, 2019, 8:48pm UTC](https://discuss.elastic.co/t/elasticsearch-java-query-with-nesting/189870 "2019-07-10T20:48:29Z")

</div>

We have two fields in our Elasticsearch index, one is called 'Command' and the other is called 'Code'. What I'm looking to do is have a 'terms' match for 2 possible values for Command. Then, for each of the 2 Commands …

---

## [Ranking across indices using dfs\_query\_then\_fetch](https://discuss.elastic.co/t/ranking-across-indices-using-dfs-query-then-fetch/189865)

<div class="topic-metadata">

**Author:** [@mop\_handler](https://discuss.elastic.co/u/mop_handler)\
**Replies:** 0\
**Last updated:** [July 10, 2019, 8:05pm UTC](https://discuss.elastic.co/t/ranking-across-indices-using-dfs-query-then-fetch/189865 "2019-07-10T20:05:54Z")

</div>

We have a single search across multiple indices using simple\_query\_string. The problem is that the ranking is pretty awful, and the top few results are always from a particular index. I've been told this is because tf/id…

---

## [What's the best practice of keeping logs of data on elastic Search data nodes?](https://discuss.elastic.co/t/whats-the-best-practice-of-keeping-logs-of-data-on-elastic-search-data-nodes/189160)

<div class="topic-metadata">

**Author:** [@Bjen\_Shah](https://discuss.elastic.co/u/Bjen_Shah)\
**Replies:** 0\
**Last updated:** [July 5, 2019, 7:30pm UTC](https://discuss.elastic.co/t/whats-the-best-practice-of-keeping-logs-of-data-on-elastic-search-data-nodes/189160 "2019-07-05T19:30:01Z")

</div>

I am not only looking for personal thought, however I like to learn from other company 's practices. if you could help me out.

---

## [INFO:esrally.actor:Checking capabilities](https://discuss.elastic.co/t/info-esrally-actor-checking-capabilities/187602)

<div class="topic-metadata">

**Author:** [@nachiketdoke01](https://discuss.elastic.co/u/nachiketdoke01)\
**Replies:** 1\
**Last updated:** [July 10, 2019, 7:53pm UTC](https://discuss.elastic.co/t/info-esrally-actor-checking-capabilities/187602 "2019-07-10T19:53:50Z")

</div>

Hey, I am trying to run esrally for the first time on my machine and I am getting the following error. INFO:esrally.actor:Checking capabilities \[{'Thespian ActorSystem Name': 'multiprocQueueBase', 'Thespian ActorSystem…

---

## [How to have all values and not replace them when update a document](https://discuss.elastic.co/t/how-to-have-all-values-and-not-replace-them-when-update-a-document/189858)

<div class="topic-metadata">

**Author:** [@syunusic](https://discuss.elastic.co/u/syunusic)\
**Replies:** 0\
**Last updated:** [July 10, 2019, 7:39pm UTC](https://discuss.elastic.co/t/how-to-have-all-values-and-not-replace-them-when-update-a-document/189858 "2019-07-10T19:39:01Z")

</div>

I have logs that contains data from an email, but is separated in different log lines, so I have to update the document in Elasticsearch in order to have all the data I need. It works, but if a new value appears, replace…

---

## [Constant Expression Script Score Returns Two Different Results for Different Queries](https://discuss.elastic.co/t/constant-expression-script-score-returns-two-different-results-for-different-queries/189624)

<div class="topic-metadata">

**Author:** [@dvisz-inf](https://discuss.elastic.co/u/dvisz-inf)\
**Replies:** 2\
**Last updated:** [July 10, 2019, 7:05pm UTC](https://discuss.elastic.co/t/constant-expression-script-score-returns-two-different-results-for-different-queries/189624 "2019-07-10T19:05:45Z")

</div>

Hi all :slight\_smile: Using Elasticsearch 6.8.1 I'm seeing some very strange behavior with script\_score. Using either expression or painless lang, the script "42" which should be a constant expression in either languag…

---

## [Open Source vs Basic Licences](https://discuss.elastic.co/t/open-source-vs-basic-licences/189625)

<div class="topic-metadata">

**Author:** [@dandago](https://discuss.elastic.co/u/dandago)\
**Replies:** 2\
**Last updated:** [July 10, 2019, 6:24pm UTC](https://discuss.elastic.co/t/open-source-vs-basic-licences/189625 "2019-07-10T18:24:08Z")

</div>

On the Subscriptions page, there's a feature comparison. The two free offerings, Open Source and Basic, point to the same downloads page. Therefore, I have no idea which one I got when I downloaded Elasticsearch. Can a…

---

## [File realm authentication not working in windows machine , elastic search 7.0.0 version](https://discuss.elastic.co/t/file-realm-authentication-not-working-in-windows-machine-elastic-search-7-0-0-version/189842)

<div class="topic-metadata">

**Author:** [@anilk](https://discuss.elastic.co/u/anilk)\
**Replies:** 0\
**Last updated:** [July 10, 2019, 6:02pm UTC](https://discuss.elastic.co/t/file-realm-authentication-not-working-in-windows-machine-elastic-search-7-0-0-version/189842 "2019-07-10T18:02:19Z")

</div>

Hello, File realm not working in my machine having windows operating system, using elastic search 7.0.0 version. Have elastic search basic license in local machine. There is no error in logs, there is no login page fo…

---

## [1.7 to 5.3 Migration: Range filtering on geo\_points not working on v5.3](https://discuss.elastic.co/t/1-7-to-5-3-migration-range-filtering-on-geo-points-not-working-on-v5-3/189273)

<div class="topic-metadata">

**Author:** [@zheryu](https://discuss.elastic.co/u/zheryu)\
**Replies:** 5\
**Last updated:** [July 10, 2019, 5:55pm UTC](https://discuss.elastic.co/t/1-7-to-5-3-migration-range-filtering-on-geo-points-not-working-on-v5-3/189273 "2019-07-10T17:55:43Z")

</div>

Hi friends, I'm migrating my Elasticsearch from 1.7 to 5.3, and have noticed inconsistencies in how range filters interact with geo\_point data types. My query to 1.7 returns data successfully, while my query to 5.3 give…

---

## [Problem encountered in the cosine similarity test sample](https://discuss.elastic.co/t/problem-encountered-in-the-cosine-similarity-test-sample/189114)

<div class="topic-metadata">

**Author:** [@forheroes1994](https://discuss.elastic.co/u/forheroes1994)\
**Replies:** 1\
**Last updated:** [July 10, 2019, 5:51pm UTC](https://discuss.elastic.co/t/problem-encountered-in-the-cosine-similarity-test-sample/189114 "2019-07-10T17:51:03Z")

</div>

With the ES 7.2.0 environment，I wanted to use cosineSimilarity function to calculate cosine similarity.But I got this error. { "error": { "root\_cause": \[ { "type": "script\_exception", "reason…

---

## [Terms query is not working in Elasticsearch 7.1.0 and 7.2.0](https://discuss.elastic.co/t/terms-query-is-not-working-in-elasticsearch-7-1-0-and-7-2-0/189749)

<div class="topic-metadata">

**Author:** [@KRISHNA\_SINHA](https://discuss.elastic.co/u/KRISHNA_SINHA)\
**Replies:** 10\
**Last updated:** [July 10, 2019, 5:17pm UTC](https://discuss.elastic.co/t/terms-query-is-not-working-in-elasticsearch-7-1-0-and-7-2-0/189749 "2019-07-10T17:17:31Z")

</div>

The terms query does not give any output. However, it does not give any error message as well. Sample Query GET filebeat\*/\_search { "query" : { "bool": { "must": \[ {"terms": { "model": \["CM5","(null)"\] } } \] }…

---

## [Could the unavailability of replicas be the reason for slow shard recovery/relocation processes?](https://discuss.elastic.co/t/could-the-unavailability-of-replicas-be-the-reason-for-slow-shard-recovery-relocation-processes/189838)

<div class="topic-metadata">

**Author:** [@praveengadugin1](https://discuss.elastic.co/u/praveengadugin1)\
**Replies:** 0\
**Last updated:** [July 10, 2019, 5:14pm UTC](https://discuss.elastic.co/t/could-the-unavailability-of-replicas-be-the-reason-for-slow-shard-recovery-relocation-processes/189838 "2019-07-10T17:14:09Z")

</div>

Our recovery/relocating process for a particular shard is really really slow. It was 20 percent 2 days before and 60 percent now. It was not this slow before. We have removed replica from that index and only have primary…

[Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1230)

[Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1232)
