# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1252 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1253 --- ## [SQL group by does not work correctly on year / month function](https://discuss.elastic.co/t/sql-group-by-does-not-work-correctly-on-year-month-function/186576)
**Author:** [@Yuan\_Hong](https://discuss.elastic.co/u/Yuan_Hong)\ **Replies:** 4\ **Last updated:** [June 25, 2019, 3:59am UTC](https://discuss.elastic.co/t/sql-group-by-does-not-work-correctly-on-year-month-function/186576 "2019-06-25T03:59:08Z")
Hi, I am trying to find out the number of orders by year and month that satisfy certain conditions. The raw data looks like: POST \_xpack/sql?format=txt { "query": "select orderId, year(startTime), month(startTime) fr… --- ## [Bool query with empty body](https://discuss.elastic.co/t/bool-query-with-empty-body/187215)
**Author:** [@shekharshan](https://discuss.elastic.co/u/shekharshan)\ **Replies:** 1\ **Last updated:** [June 25, 2019, 3:47am UTC](https://discuss.elastic.co/t/bool-query-with-empty-body/187215 "2019-06-25T03:47:50Z")
I have inherited some code I am trying to understand. The query uses bool query with empty body within aggregations as shown below: "aggs": { "aggregate\_name": { "filter": { "bool": {} … --- ## [Role based authorization(with PKI auth)](https://discuss.elastic.co/t/role-based-authorization-with-pki-auth/186777)
**Author:** [@P\_Gong](https://discuss.elastic.co/u/P_Gong)\ **Replies:** 8\ **Last updated:** [June 25, 2019, 1:48am UTC](https://discuss.elastic.co/t/role-based-authorization-with-pki-auth/186777 "2019-06-25T01:48:15Z")
I'm trying to enable role based authorization with PKI auth. I created a test user: curl -k -u elastic:changeme "https://localhost:9200/\_xpack/security/user/testuser" {"elasticsearch.kibana.social.ea.com":{"username":… --- ## [Cumulative Sum Regardless of Time Interval - ES](https://discuss.elastic.co/t/cumulative-sum-regardless-of-time-interval-es/100237)
**Author:** [@Chris\_Stone](https://discuss.elastic.co/u/Chris_Stone)\ **Replies:** 4\ **Last updated:** [June 24, 2019, 11:33pm UTC](https://discuss.elastic.co/t/cumulative-sum-regardless-of-time-interval-es/100237 "2019-06-24T23:33:45Z")
Hi, I posted the following in the Kibana category, and it was suggest that it might belong here in Elasticsearch: --- ## [Log analysis finding what files didn't get processed](https://discuss.elastic.co/t/log-analysis-finding-what-files-didnt-get-processed/187052)
**Author:** [@raco](https://discuss.elastic.co/u/raco)\ **Replies:** 0\ **Last updated:** [June 24, 2019, 6:09am UTC](https://discuss.elastic.co/t/log-analysis-finding-what-files-didnt-get-processed/187052 "2019-06-24T06:09:29Z")
Hi, This is my first time posting here, I tried looking for a similar question around but haven't been able to find a solution. I'm using ElasticSearch and Kibana for my logs. Some process grabs one or more files and t… --- ## [How to get all the results from the nested datatype query in Elasticsearch?](https://discuss.elastic.co/t/how-to-get-all-the-results-from-the-nested-datatype-query-in-elasticsearch/187199)
**Author:** [@AmoghM](https://discuss.elastic.co/u/AmoghM)\ **Replies:** 0\ **Last updated:** [June 24, 2019, 10:27pm UTC](https://discuss.elastic.co/t/how-to-get-all-the-results-from-the-nested-datatype-query-in-elasticsearch/187199 "2019-06-24T22:27:07Z")
I am trying to fetch all matching sentences from a blob of text using nested datatype of Elasticsearch. In the query mentioned below, I try to filter all the sentence which have "the" and "of" mentioned in the same sente… --- ## [Can't start Elasticsearch 7 service on Windows](https://discuss.elastic.co/t/cant-start-elasticsearch-7-service-on-windows/177358)
**Author:** [@dandago](https://discuss.elastic.co/u/dandago)\ **Replies:** 10\ **Last updated:** [June 24, 2019, 8:54pm UTC](https://discuss.elastic.co/t/cant-start-elasticsearch-7-service-on-windows/177358 "2019-06-24T20:54:06Z")
Hi, I'm trying to set up Elasticsearch on my Windows machine. I've done it before, but now I'm doing it again with version 7.0.0. I set JAVA\_HOME and can run Elasticsearch successfully with elasticsearch.bat (I can con… --- ## [Change elasticsearch certification file path. for tls](https://discuss.elastic.co/t/change-elasticsearch-certification-file-path-for-tls/187030)
**Author:** [@xodn0812](https://discuss.elastic.co/u/xodn0812)\ **Replies:** 1\ **Last updated:** [June 24, 2019, 7:32pm UTC](https://discuss.elastic.co/t/change-elasticsearch-certification-file-path-for-tls/187030 "2019-06-24T19:32:53Z")
I use elasticsearch in kubernetes. Use the certificate generated by kubernetes in pem format. The problem is that this certificate path is out of elasticsearch/config. For example, I have a ca.crt file in /var/tls/ca.… --- ## [Deprecation Log Full Of Same Warning](https://discuss.elastic.co/t/deprecation-log-full-of-same-warning/186774)
**Author:** [@wwalker](https://discuss.elastic.co/u/wwalker)\ **Replies:** 3\ **Last updated:** [June 24, 2019, 7:22pm UTC](https://discuss.elastic.co/t/deprecation-log-full-of-same-warning/186774 "2019-06-24T19:22:16Z")
My deprecation log is about 300MB of the following line: {"type": "deprecation", "timestamp": "2019-06-20T17:20:46,105-0500", "level": "WARN", "component": "o.e.d.x.m.r.a.RestMonitoringBulkAction", "cluster.name": "Elas… --- ## [What cluster privilege is needed to create search templates?](https://discuss.elastic.co/t/what-cluster-privilege-is-needed-to-create-search-templates/187189)
**Author:** [@aaronloesattv](https://discuss.elastic.co/u/aaronloesattv)\ **Replies:** 0\ **Last updated:** [June 24, 2019, 7:18pm UTC](https://discuss.elastic.co/t/what-cluster-privilege-is-needed-to-create-search-templates/187189 "2019-06-24T19:18:04Z")
Title says it all. I've looked for the answer multiple times in the documentation and have found nothing. If i remember correctly, it may only be the "manage" privilege? If so, this is too much allowance of privilege for… --- ## [Snapshot into one data node in cluster](https://discuss.elastic.co/t/snapshot-into-one-data-node-in-cluster/187080)
**Author:** [@jasony](https://discuss.elastic.co/u/jasony)\ **Replies:** 2\ **Last updated:** [June 24, 2019, 12:00pm UTC](https://discuss.elastic.co/t/snapshot-into-one-data-node-in-cluster/187080 "2019-06-24T12:00:51Z")
hello, i am working on snapshot some of my indices, and found Microsoft Windows UNC paths setting but not really clear how to set this up. is it possible to set up a snapshot to back up indices into one data node in c… --- ## [Combining MLT search with a boolean filter or boosting scheme](https://discuss.elastic.co/t/combining-mlt-search-with-a-boolean-filter-or-boosting-scheme/187183)
**Author:** [@Alain\_Desilets](https://discuss.elastic.co/u/Alain_Desilets)\ **Replies:** 0\ **Last updated:** [June 24, 2019, 6:11pm UTC](https://discuss.elastic.co/t/combining-mlt-search-with-a-boolean-filter-or-boosting-scheme/187183 "2019-06-24T18:11:04Z")
I am using ES 5.6.2 to compare pargraphs of two very similar documents ORIG and CLONE (where CLONE was cloned from the document ORIG, heavily modified). My solution has been as follows: put the paragraphs of both doc… --- ## [Data node fails while creating replicas](https://discuss.elastic.co/t/data-node-fails-while-creating-replicas/187093)
**Author:** [@Barak](https://discuss.elastic.co/u/Barak)\ **Replies:** 2\ **Last updated:** [June 24, 2019, 5:47pm UTC](https://discuss.elastic.co/t/data-node-fails-while-creating-replicas/187093 "2019-06-24T17:47:53Z")
Hi, Cluster info 5 master nodes - 16 GB RAM, 4 CPU 4 data nodes - 30.5 GB RAM, 4 CPU 1 Coordinator node - 16 GB RAM, 8 CPU 50% of RAM allocated to heap on all nodes Use case Restored a snapshot from S3 repo. Index… --- ## [Securing Elasticsearch: Unknown Settings](https://discuss.elastic.co/t/securing-elasticsearch-unknown-settings/187181)
**Author:** [@wwalker](https://discuss.elastic.co/u/wwalker)\ **Replies:** 0\ **Last updated:** [June 24, 2019, 5:46pm UTC](https://discuss.elastic.co/t/securing-elasticsearch-unknown-settings/187181 "2019-06-24T17:46:39Z")
Having trouble finding the proper key for multiple settings on Elasticsearch 7.1.1. The documentation seems to be trying too hard to not be repetitive or assume a certain level of knowledge that I don't have. xpack.sec… --- ## [Timestamp range not querying properly](https://discuss.elastic.co/t/timestamp-range-not-querying-properly/186782)
**Author:** [@ryh](https://discuss.elastic.co/u/ryh)\ **Replies:** 5\ **Last updated:** [June 24, 2019, 3:59pm UTC](https://discuss.elastic.co/t/timestamp-range-not-querying-properly/186782 "2019-06-24T15:59:10Z")
Hi, I'm using elasticsearch 7.X and I'm having difficulties querying a time range. My code res = es.search(index='\*', body={ 'query': { 'range': { 'app\_timestamp':{ 'gte': '2019-06-20T12:00:00', … --- ## [Appending to an indexed JSON file](https://discuss.elastic.co/t/appending-to-an-indexed-json-file/187167)
**Author:** [@hosey123](https://discuss.elastic.co/u/hosey123)\ **Replies:** 0\ **Last updated:** [June 24, 2019, 3:34pm UTC](https://discuss.elastic.co/t/appending-to-an-indexed-json-file/187167 "2019-06-24T15:34:43Z")
Hi there, I'm attempting to use Elasticsearch to index JSON files that are comprised of multiple "test" fields ("test1", "test2", etc.), where each file represents a series of tests done on a single device. As I run late… --- ## [Query regarding http.max\_content\_length](https://discuss.elastic.co/t/query-regarding-http-max-content-length/185422)
**Author:** [@akhisar](https://discuss.elastic.co/u/akhisar)\ **Replies:** 5\ **Last updated:** [June 24, 2019, 3:26pm UTC](https://discuss.elastic.co/t/query-regarding-http-max-content-length/185422 "2019-06-24T15:26:11Z")
Hello Experts, I would like to know on what all nodes(client/master/data) should I enable the settings for http.max\_content\_length on elasticsearch.yml file. --- ## [Using Curator vs basic linux script + cron job to delete /var/log/elasticsearch files](https://discuss.elastic.co/t/using-curator-vs-basic-linux-script-cron-job-to-delete-var-log-elasticsearch-files/187162)
**Author:** [@Ryan\_Downey](https://discuss.elastic.co/u/Ryan_Downey)\ **Replies:** 2\ **Last updated:** [June 24, 2019, 3:15pm UTC](https://discuss.elastic.co/t/using-curator-vs-basic-linux-script-cron-job-to-delete-var-log-elasticsearch-files/187162 "2019-06-24T15:15:20Z")
I've setup Curator to delete metricbeat indices older than 14 days within our cluster. After reading through the Curator documentation is there any real need to use Curator to delete /var/log/elasticsearch logs or is a … --- ## [Precision issue with Elasticsearch 6.8](https://discuss.elastic.co/t/precision-issue-with-elasticsearch-6-8/186407)
**Author:** [@avinash\_07](https://discuss.elastic.co/u/avinash_07)\ **Replies:** 8\ **Last updated:** [June 24, 2019, 2:41pm UTC](https://discuss.elastic.co/t/precision-issue-with-elasticsearch-6-8/186407 "2019-06-24T14:41:13Z")
Per the solution provided in this comment, we have upgraded our elasticsearch version to 6.8. However, the precision issue still exists. We also tried deleting the index and ingested the data in a new index . It didn't w… --- ## [Can I reindex old indexes to a new schema so as not to lose any information?](https://discuss.elastic.co/t/can-i-reindex-old-indexes-to-a-new-schema-so-as-not-to-lose-any-information/187152)
**Author:** [@byoungman](https://discuss.elastic.co/u/byoungman)\ **Replies:** 1\ **Last updated:** [June 24, 2019, 2:18pm UTC](https://discuss.elastic.co/t/can-i-reindex-old-indexes-to-a-new-schema-so-as-not-to-lose-any-information/187152 "2019-06-24T14:18:52Z")
I just found out from our development group that they are going to be changing the schema of our Elasticsearch indexes specifically changing property names to better align with what they are doing. They'll be keeping th… --- ## [How to connect ElasticSearch from other machine or same machine using IP address instead of localhost](https://discuss.elastic.co/t/how-to-connect-elasticsearch-from-other-machine-or-same-machine-using-ip-address-instead-of-localhost/187148)
**Author:** [@NAHA](https://discuss.elastic.co/u/NAHA)\ **Replies:** 2\ **Last updated:** [June 24, 2019, 2:09pm UTC](https://discuss.elastic.co/t/how-to-connect-elasticsearch-from-other-machine-or-same-machine-using-ip-address-instead-of-localhost/187148 "2019-06-24T14:09:31Z")
Hi , I am using ElasticSearch version 6.7.0 and it works fine when I call http://localhost:9200/ { "name" : "ea31Cfe", "cluster\_name" : "elasticsearch", "cluster\_uuid" : "K1KpeRbhSYKa0UFEaqVKrg", "version" : { … --- ## [Force replica initialization of specific indices](https://discuss.elastic.co/t/force-replica-initialization-of-specific-indices/187146)
**Author:** [@davidbugeja](https://discuss.elastic.co/u/davidbugeja)\ **Replies:** 0\ **Last updated:** [June 24, 2019, 1:49pm UTC](https://discuss.elastic.co/t/force-replica-initialization-of-specific-indices/187146 "2019-06-24T13:49:31Z")
Current running version: 5.6 We have a cluster with over a thousand indices which takes considerable time to initialize all replica shards after a crash. Is there the possibility of sending a command to Elastic to force… --- ## [Why ElasticSearch allows "Term Clause" within query context and "Query\_String" clause within filter Context](https://discuss.elastic.co/t/why-elasticsearch-allows-term-clause-within-query-context-and-query-string-clause-within-filter-context/187145)
**Author:** [@shekharshan](https://discuss.elastic.co/u/shekharshan)\ **Replies:** 0\ **Last updated:** [June 24, 2019, 1:45pm UTC](https://discuss.elastic.co/t/why-elasticsearch-allows-term-clause-within-query-context-and-query-string-clause-within-filter-context/187145 "2019-06-24T13:45:51Z")
Suppose you have a mapping for a field that stores first and last names as follows: "firstAndLastName": { "type": "keyword" } I want to query for the exact name such as "John Doe". I see there are two ways I can do… --- ## [elasticsearch.exceptions.RequestError \[illegal\_argument\_exception\]](https://discuss.elastic.co/t/elasticsearch-exceptions-requesterror-illegal-argument-exception/186927)
**Author:** [@HenryJackson](https://discuss.elastic.co/u/HenryJackson)\ **Replies:** 4\ **Last updated:** [June 24, 2019, 1:42pm UTC](https://discuss.elastic.co/t/elasticsearch-exceptions-requesterror-illegal-argument-exception/186927 "2019-06-24T13:42:39Z")
I am getting this exception after a while when i try to append JSON document under same ID in the Elasticsearch index How my data is getting appended. Index\_name id : 1234 JSON{} JSON{} . . JSON{} My code snippe… --- ## [Change elasticsearch certification file path (for tls)](https://discuss.elastic.co/t/change-elasticsearch-certification-file-path-for-tls/186975)
**Author:** [@xodn0812](https://discuss.elastic.co/u/xodn0812)\ **Replies:** 1\ **Last updated:** [June 24, 2019, 1:18pm UTC](https://discuss.elastic.co/t/change-elasticsearch-certification-file-path-for-tls/186975 "2019-06-24T13:18:08Z")
I use elasticsearch in kubernetes. Use the certificate generated by kubernetes in pem format. The problem is that this certificate path is out of elasticsearch/config. For example, I have a ca.crt file in /var/tls/ca… --- ## [Create a request with variable field(column) elasticsearch\_DSL](https://discuss.elastic.co/t/create-a-request-with-variable-field-column-elasticsearch-dsl/187132)
**Author:** [@Aymen\_Ayadi](https://discuss.elastic.co/u/Aymen_Ayadi)\ **Replies:** 0\ **Last updated:** [June 24, 2019, 12:58pm UTC](https://discuss.elastic.co/t/create-a-request-with-variable-field-column-elasticsearch-dsl/187132 "2019-06-24T12:58:01Z")
hello, i'm using elasticsearch\_DSL for python and i tried to create a customized query using variable fields : lista =\[ \] filter = {'name': 'amx', 'type':'ofs'} for key,value in filter.items(): lista.append(Q… --- ## [Securing Elasticsearch Could not resolve placeholder](https://discuss.elastic.co/t/securing-elasticsearch-could-not-resolve-placeholder/187040)
**Author:** [@wwalker](https://discuss.elastic.co/u/wwalker)\ **Replies:** 1\ **Last updated:** [June 24, 2019, 12:40pm UTC](https://discuss.elastic.co/t/securing-elasticsearch-could-not-resolve-placeholder/187040 "2019-06-24T12:40:17Z")
Testing TLS integration in a single node Elastic Stack setup. Ive run the following: ./bin/elasticsearch-keystore create ./bin/elasticsearch-keystore add certkey Then added the following lines to elasticsearch.yml xp… --- ## [TransportClient stuck until disconnecting from node](https://discuss.elastic.co/t/transportclient-stuck-until-disconnecting-from-node/187121)
**Author:** [@Alex\_Davidovich](https://discuss.elastic.co/u/Alex_Davidovich)\ **Replies:** 0\ **Last updated:** [June 24, 2019, 12:27pm UTC](https://discuss.elastic.co/t/transportclient-stuck-until-disconnecting-from-node/187121 "2019-06-24T12:27:20Z")
I am working with elastic 5.4.3 and indexing events via transport client. I have a cluster of 3 nodes with 1 primary shard and 2 replicas. During a test, node-2 was shutdown. For a very specific time, when indexing a … --- ## [Multi host elasticsearch cluster using docker](https://discuss.elastic.co/t/multi-host-elasticsearch-cluster-using-docker/186561)
**Author:** [@nila](https://discuss.elastic.co/u/nila)\ **Replies:** 1\ **Last updated:** [June 24, 2019, 12:24pm UTC](https://discuss.elastic.co/t/multi-host-elasticsearch-cluster-using-docker/186561 "2019-06-24T12:24:28Z")
Hello everyone, I am trying to configure elasticsearch cluster on docker with 3 different hosts which are identical. Any one of these should be master/data nodes. I have the following docker-compose.yml file. I am getti… --- ## [low\_Sum and low\_count](https://discuss.elastic.co/t/low-sum-and-low-count/187016)
**Author:** [@Bharath\_Kumar\_R](https://discuss.elastic.co/u/Bharath_Kumar_R)\ **Replies:** 1\ **Last updated:** [June 24, 2019, 12:19pm UTC](https://discuss.elastic.co/t/low-sum-and-low-count/187016 "2019-06-24T12:19:01Z")
Hey, Im trying to create a job where anomalies are to be detected if the amount of data in an index falls to very low values. If low\_count function is used, I can detect anomalies if the count of documents falls to very … [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1251) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1253)