# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1244 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1245 --- ## [Reading from Elasticsearch to Spark is very slow](https://discuss.elastic.co/t/reading-from-elasticsearch-to-spark-is-very-slow/188307)
**Author:** [@Rami\_Batal](https://discuss.elastic.co/u/Rami_Batal)\ **Replies:** 0\ **Last updated:** [July 1, 2019, 12:01pm UTC](https://discuss.elastic.co/t/reading-from-elasticsearch-to-spark-is-very-slow/188307 "2019-07-01T12:01:11Z")
Hi, I am using Spark 2.4.0, Elasticsearch 6.6.2, and elasticsearch-spark-20\_2.11-6.8.1.jar as connector. I am running Spark local mode and configured the memory to 8GB. I have an Elasticsearch index with 14 million doc… --- ## [Convert Date to Human readable form](https://discuss.elastic.co/t/convert-date-to-human-readable-form/188305)
**Author:** [@mkhayyam\_q](https://discuss.elastic.co/u/mkhayyam_q)\ **Replies:** 0\ **Last updated:** [July 1, 2019, 12:00pm UTC](https://discuss.elastic.co/t/convert-date-to-human-readable-form/188305 "2019-07-01T12:00:05Z")
The following is the Index mapping created using NEST .AutoMap from object { "staff" : { "mappings" : { "staff" : { "properties" : { "dob" : { "type" : "date" }, … --- ## [Retrieve Search Results Based on the First Letter in a Specific Field](https://discuss.elastic.co/t/retrieve-search-results-based-on-the-first-letter-in-a-specific-field/185852)
**Author:** [@maryam\_abdullah](https://discuss.elastic.co/u/maryam_abdullah)\ **Replies:** 29\ **Last updated:** [July 1, 2019, 11:50am UTC](https://discuss.elastic.co/t/retrieve-search-results-based-on-the-first-letter-in-a-specific-field/185852 "2019-07-01T11:50:32Z")
Hey, Is it possible to search based on the first letter in a specified field of documents? for example, when the query is letter 'A", all documents that have titles that start with 'A' are returned. thanks. --- ## [Multi term Sources NEST v6.8](https://discuss.elastic.co/t/multi-term-sources-nest-v6-8/188172)
**Author:** [@mkhayyam\_q](https://discuss.elastic.co/u/mkhayyam_q)\ **Replies:** 2\ **Last updated:** [July 1, 2019, 11:13am UTC](https://discuss.elastic.co/t/multi-term-sources-nest-v6-8/188172 "2019-07-01T11:13:41Z")
Trying to Write NEST Query in C# for the following DSL GET staff/\_search { "size": 0, "aggregations" : { "groupby" : { "composite" : { "size" : 1000, "sources" : \[ { "4… --- ## [Aggregation for change in text field](https://discuss.elastic.co/t/aggregation-for-change-in-text-field/184756)
**Author:** [@smlbiobot](https://discuss.elastic.co/u/smlbiobot)\ **Replies:** 2\ **Last updated:** [July 1, 2019, 10:55am UTC](https://discuss.elastic.co/t/aggregation-for-change-in-text-field/184756 "2019-07-01T10:55:58Z")
Is there an aggregation I can use to note a change of value in a text field in a time series? Essentially, i have an index which logs a string value of over time. I wish to detect when that value gets changed and return… --- ## [I am trying to create index and upload data in elasticsearch using curl](https://discuss.elastic.co/t/i-am-trying-to-create-index-and-upload-data-in-elasticsearch-using-curl/188213)
**Author:** [@SalOomeii](https://discuss.elastic.co/u/SalOomeii)\ **Replies:** 2\ **Last updated:** [July 1, 2019, 10:47am UTC](https://discuss.elastic.co/t/i-am-trying-to-create-index-and-upload-data-in-elasticsearch-using-curl/188213 "2019-07-01T10:47:03Z")
Hello everyone ! I am trying to create new index with those data in Elasticsearch I have big data in json format I save it in a file named weather\_to\_json.json and then I use this curl $ curl -s -H "Content-Type: … --- ## [Elastic search Cluster health due to disk space](https://discuss.elastic.co/t/elastic-search-cluster-health-due-to-disk-space/188278)
**Author:** [@mark.penner](https://discuss.elastic.co/u/mark.penner)\ **Replies:** 1\ **Last updated:** [July 1, 2019, 10:45am UTC](https://discuss.elastic.co/t/elastic-search-cluster-health-due-to-disk-space/188278 "2019-07-01T10:45:26Z")
Hi, I am currently experiencing an issue on my elastic cluster due to low disk space. "explanation" : "the node is above the low watermark cluster setting \[cluster.routing.allocation.disk.watermark.low=85%\], using more… --- ## [I'm looking for a grammar/parser for elasticsearch query\_string](https://discuss.elastic.co/t/im-looking-for-a-grammar-parser-for-elasticsearch-query-string/188283)
**Author:** [@Dave\_Hangman](https://discuss.elastic.co/u/Dave_Hangman)\ **Replies:** 0\ **Last updated:** [July 1, 2019, 10:16am UTC](https://discuss.elastic.co/t/im-looking-for-a-grammar-parser-for-elasticsearch-query-string/188283 "2019-07-01T10:16:49Z")
What I'm trying to achieve is to generate a valid elasticsearch query\_string form inputs preferably in frontend. In worst case it can be generated in the backend (nodeJS, NestJS). I'm looking for libraries which can ge… --- ## [Elasticsearch sql response change](https://discuss.elastic.co/t/elasticsearch-sql-response-change/187730)
**Author:** [@SukeshGupta](https://discuss.elastic.co/u/SukeshGupta)\ **Replies:** 17\ **Last updated:** [July 1, 2019, 10:14am UTC](https://discuss.elastic.co/t/elasticsearch-sql-response-change/187730 "2019-07-01T10:14:53Z")
Hi, when i use the match query like below: GET test/\_search { "query": { "match": { "name": "elastic" } } } The response is : { "took" : 2, "timed\_out" : false, "\_shards" : { "total" : 1, … --- ## [Value gets truncated](https://discuss.elastic.co/t/value-gets-truncated/187787)
**Author:** [@elk3](https://discuss.elastic.co/u/elk3)\ **Replies:** 1\ **Last updated:** [July 1, 2019, 9:59am UTC](https://discuss.elastic.co/t/value-gets-truncated/187787 "2019-07-01T09:59:27Z")
In database,school\_id(field datatype:'string') values like this (0611,0391,0301,0311,0071,0651) but when i moves to elastic index via logstash then the school\_id(field datatype:'string') values shows like this (611,391,… --- ## [Function Score (gauss) on multiple indexes "unknown field" error](https://discuss.elastic.co/t/function-score-gauss-on-multiple-indexes-unknown-field-error/187910)
**Author:** [@Bo\_Roth](https://discuss.elastic.co/u/Bo_Roth)\ **Replies:** 1\ **Last updated:** [July 1, 2019, 9:56am UTC](https://discuss.elastic.co/t/function-score-gauss-on-multiple-indexes-unknown-field-error/187910 "2019-07-01T09:56:23Z")
On ElasticSearch 5.6 I'm running a multi-index query that uses the gauss function to score the resulting documents. The problem is that my indexes have different structures, so the geo\_points are in slightly different f… --- ## [Has\_parent query returns no hits in elasticsearch 6.5.4](https://discuss.elastic.co/t/has-parent-query-returns-no-hits-in-elasticsearch-6-5-4/187950)
**Author:** [@luise](https://discuss.elastic.co/u/luise)\ **Replies:** 1\ **Last updated:** [July 1, 2019, 9:54am UTC](https://discuss.elastic.co/t/has-parent-query-returns-no-hits-in-elasticsearch-6-5-4/187950 "2019-07-01T09:54:51Z")
I'm currently trying to find all children of parents that match certain query using the following has\_parent query: GET my\_index\*/\_search { "query": { "has\_parent": { "parent\_type": "threat", "query": … --- ## [Replace all method is not working](https://discuss.elastic.co/t/replace-all-method-is-not-working/188001)
**Author:** [@saranjeet](https://discuss.elastic.co/u/saranjeet)\ **Replies:** 1\ **Last updated:** [July 1, 2019, 9:53am UTC](https://discuss.elastic.co/t/replace-all-method-is-not-working/188001 "2019-07-01T09:53:18Z")
"sort": \[ { "\_script": { "script": { "source": "def varRating = 0; if(doc\['symbol'\].value == 'fac') varRating=1;else if(doc\['name'\].value == 'fac') varRating=2;else if(doc\['name'\].value.indexOf('fac') == 0) varRatin… --- ## [Fielddata size is always different in one of the nodes](https://discuss.elastic.co/t/fielddata-size-is-always-different-in-one-of-the-nodes/188009)
**Author:** [@vurus](https://discuss.elastic.co/u/vurus)\ **Replies:** 1\ **Last updated:** [July 1, 2019, 9:40am UTC](https://discuss.elastic.co/t/fielddata-size-is-always-different-in-one-of-the-nodes/188009 "2019-07-01T09:40:39Z")
Hi, We have a cluster of 6 nodes on 3 servers, all mdi, using ~32 gb heap memory with G1GC, with version 6.4.2 and the fielddata limits are the same (60%) on all nodes. We have been consistently and periodically confro… --- ## [Elasticsearch running on multi node docker containers - networking](https://discuss.elastic.co/t/elasticsearch-running-on-multi-node-docker-containers-networking/188269)
**Author:** [@pastechecker](https://discuss.elastic.co/u/pastechecker)\ **Replies:** 0\ **Last updated:** [July 1, 2019, 9:20am UTC](https://discuss.elastic.co/t/elasticsearch-running-on-multi-node-docker-containers-networking/188269 "2019-07-01T09:20:28Z")
Hello. I am looking for the best way to connect Docker running multiple elasticsearch instances running on two servers connected directly by fiber optic cable not using the Swarm mode (as this is not supported by Elasti… --- ## [Curator no indices found](https://discuss.elastic.co/t/curator-no-indices-found/187576)
**Author:** [@wToad](https://discuss.elastic.co/u/wToad)\ **Replies:** 13\ **Last updated:** [July 1, 2019, 9:16am UTC](https://discuss.elastic.co/t/curator-no-indices-found/187576 "2019-07-01T09:16:25Z")
Hello, I'm using ElasticSearch v6.3.2 and Curator v5.7.6 to delete indices. Unfortunately it seems that my configuration doesn't find any indices even though there are many. My commands: $ curator\_cli --host elasticsea… --- ## [Best way to export Index data(10 million) from elastic search to custom json format](https://discuss.elastic.co/t/best-way-to-export-index-data-10-million-from-elastic-search-to-custom-json-format/188265)
**Author:** [@SudevPK](https://discuss.elastic.co/u/SudevPK)\ **Replies:** 2\ **Last updated:** [July 1, 2019, 9:14am UTC](https://discuss.elastic.co/t/best-way-to-export-index-data-10-million-from-elastic-search-to-custom-json-format/188265 "2019-07-01T09:14:01Z")
Sample index data { "\_index" : "sampleindex", "\_type" : "\_doc", "\_id" : "196575730", "\_version" : 2, "\_seq\_no" : 2230396, "\_primary\_term" : 1, "found" : true, "\_source" : { "id" : 19657, "name" : "wer\_1212", … --- ## [Multi match nested query with filter not working](https://discuss.elastic.co/t/multi-match-nested-query-with-filter-not-working/188228)
**Author:** [@Pushpak\_R\_Chavan](https://discuss.elastic.co/u/Pushpak_R_Chavan)\ **Replies:** 1\ **Last updated:** [July 1, 2019, 9:10am UTC](https://discuss.elastic.co/t/multi-match-nested-query-with-filter-not-working/188228 "2019-07-01T09:10:58Z")
Hi, Below is the sample data i have in my cluster, "\_source" : { "@timestamp" : "2019-06-28T15:20:24.178Z", "@version" : "1", "case" : { "peerid" : "365768", "isconfidential" : "true", "category\_keyword" : "Clien… --- ## [Can't form a cluster with more than one node ".deb" debian 9 : elasticsearch 7.2](https://discuss.elastic.co/t/cant-form-a-cluster-with-more-than-one-node-deb-debian-9-elasticsearch-7-2/188080)
**Author:** [@mbelaloui](https://discuss.elastic.co/u/mbelaloui)\ **Replies:** 3\ **Last updated:** [July 1, 2019, 9:10am UTC](https://discuss.elastic.co/t/cant-form-a-cluster-with-more-than-one-node-deb-debian-9-elasticsearch-7-2/188080 "2019-07-01T09:10:14Z")
Hello everyone, I want to form a cluster with 3 nodes, but i have some errors. Here's my configuration: so i have 3 debian vm, connected in Bridged mode \ my /etc/hosts file node-1 127.0.0.1 local… --- ## [Problem with TimeZone formatter (DateMathExpressionResolver)](https://discuss.elastic.co/t/problem-with-timezone-formatter-datemathexpressionresolver/187630)
**Author:** [@Thales\_Valias](https://discuss.elastic.co/u/Thales_Valias)\ **Replies:** 6\ **Last updated:** [July 1, 2019, 9:07am UTC](https://discuss.elastic.co/t/problem-with-timezone-formatter-datemathexpressionresolver/187630 "2019-07-01T09:07:27Z")
Hi Everybody. I'm running my tests on elasticsearch and facing one problem about DateFormatter/Resolver. Basically when we start the ES 'Node' for the tests, it has some Resolvers e.g: IndexNameExpressionResolver and i… --- ## [Upgrade from 7.0 to 7.2](https://discuss.elastic.co/t/upgrade-from-7-0-to-7-2/188261)
**Author:** [@kmohd](https://discuss.elastic.co/u/kmohd)\ **Replies:** 1\ **Last updated:** [July 1, 2019, 9:01am UTC](https://discuss.elastic.co/t/upgrade-from-7-0-to-7-2/188261 "2019-07-01T09:01:09Z")
Hello everyone, is it possible to upgrade my ELK to 7.2 without having to re install everything? the upgrade assistant only works for major versions like 8.0. I'm on Windows OS --- ## [ElasticSearch index is not updating correctly](https://discuss.elastic.co/t/elasticsearch-index-is-not-updating-correctly/188222)
**Author:** [@avinash9999](https://discuss.elastic.co/u/avinash9999)\ **Replies:** 2\ **Last updated:** [July 1, 2019, 8:22am UTC](https://discuss.elastic.co/t/elasticsearch-index-is-not-updating-correctly/188222 "2019-07-01T08:22:03Z")
I have a logstash code for updating elasticsearch index in every 5 minutes from my SQL server. I am using action update to do this. action =\> 'update' There is a problem that my index is not updating with every recor… --- ## [How to select records with "-" ina text field( price ) in elastic search](https://discuss.elastic.co/t/how-to-select-records-with-ina-text-field-price-in-elastic-search/188007)
**Author:** [@SudevPK](https://discuss.elastic.co/u/SudevPK)\ **Replies:** 4\ **Last updated:** [July 1, 2019, 8:16am UTC](https://discuss.elastic.co/t/how-to-select-records-with-ina-text-field-price-in-elastic-search/188007 "2019-07-01T08:16:41Z")
Sample records need to be selected { "\_index" : "sample", "\_type" : "\_doc", "\_id" : "1213", "\_version" : 2, "\_seq\_no" : 2227876, "\_primary\_term" : 1, "found" : true, "\_source" : { "id" : 1213, "price" : "-7284… --- ## [0's after decimal places are absent in elastic search](https://discuss.elastic.co/t/0s-after-decimal-places-are-absent-in-elastic-search/187808)
**Author:** [@Gaurav\_Narang](https://discuss.elastic.co/u/Gaurav_Narang)\ **Replies:** 4\ **Last updated:** [July 1, 2019, 7:22am UTC](https://discuss.elastic.co/t/0s-after-decimal-places-are-absent-in-elastic-search/187808 "2019-07-01T07:22:59Z")
I have taken the type of a field in elastic search as double and while ingesting any value which has some 0's after decimal place then the 0's after decimal place is not shown. For example: for value 23.0 is converted to… --- ## ["One-way Replication", is it possible?](https://discuss.elastic.co/t/one-way-replication-is-it-possible/188244)
**Author:** [@111169](https://discuss.elastic.co/u/111169)\ **Replies:** 1\ **Last updated:** [July 1, 2019, 7:10am UTC](https://discuss.elastic.co/t/one-way-replication-is-it-possible/188244 "2019-07-01T07:10:59Z")
Hi all! Is it possible to organize "one-way" replication inside cluster? My idea is to speed-up search by dividing my data to "fast" group (for example in that group all document will be cleaned up after one day by tim… --- ## [Advice on transform in watcher Slack action, please](https://discuss.elastic.co/t/advice-on-transform-in-watcher-slack-action-please/187436)
**Author:** [@do.ac](https://discuss.elastic.co/u/do.ac)\ **Replies:** 1\ **Last updated:** [July 1, 2019, 7:01am UTC](https://discuss.elastic.co/t/advice-on-transform-in-watcher-slack-action-please/187436 "2019-07-01T07:01:11Z")
New to this, and would appreciate some advice (and links to documentation, if I've missed any that could have answered my question). I am trying to create dynamic attachments for a Slack watcher action, which I've cobbl… --- ## [Add values of one key of all objects only where other keys have the required values and group by another value](https://discuss.elastic.co/t/add-values-of-one-key-of-all-objects-only-where-other-keys-have-the-required-values-and-group-by-another-value/188235)
**Author:** [@ShashankAC](https://discuss.elastic.co/u/ShashankAC)\ **Replies:** 0\ **Last updated:** [July 1, 2019, 5:56am UTC](https://discuss.elastic.co/t/add-values-of-one-key-of-all-objects-only-where-other-keys-have-the-required-values-and-group-by-another-value/188235 "2019-07-01T05:56:30Z")
I have about 5 key-value pairs in elasticsearch data per object, I want to add the values of certain keys(audio\_calls) of those objects where some other keys have the values I want(network\_type, weather). I want the resu… --- ## [Coordinating Node Question](https://discuss.elastic.co/t/coordinating-node-question/188207)
**Author:** [@Joe\_Kingston](https://discuss.elastic.co/u/Joe_Kingston)\ **Replies:** 1\ **Last updated:** [July 1, 2019, 6:19am UTC](https://discuss.elastic.co/t/coordinating-node-question/188207 "2019-07-01T06:19:29Z")
Do I add the coordinating node IP to discovery seed hosts and cluster initial master nodes? --- ## [Elasticsearch plugin develop](https://discuss.elastic.co/t/elasticsearch-plugin-develop/187346)
**Author:** [@shiwenhao](https://discuss.elastic.co/u/shiwenhao)\ **Replies:** 1\ **Last updated:** [July 1, 2019, 6:16am UTC](https://discuss.elastic.co/t/elasticsearch-plugin-develop/187346 "2019-07-01T06:16:55Z")
I want to develop es plugin like the official website example ：https://github.com/elastic/elasticsearch/blob/master/plugins/examples/script-expert-scoring/src/main/java/org/elasticsearch/example/expertscript/ExpertScript… --- ## [\[security\_exception\] action \[indices:data/read/search\]](https://discuss.elastic.co/t/security-exception-action-indices-data-read-search/187845)
**Author:** [@Balamurugan\_Sethuram](https://discuss.elastic.co/u/Balamurugan_Sethuram)\ **Replies:** 1\ **Last updated:** [July 1, 2019, 6:01am UTC](https://discuss.elastic.co/t/security-exception-action-indices-data-read-search/187845 "2019-07-01T06:01:37Z")
Hi, I am using elasticsearch 6.8.0. Configured with AD group and getting below error {"message":"action \[indices:data/read/search\] is unauthorized for user \[xxxxxx\]: \[security\_exception\] action \[indices:data/read/sear… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1243) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1245)