# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1254 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1255 --- ## [Last 12 hours indexing size elasticsearch](https://discuss.elastic.co/t/last-12-hours-indexing-size-elasticsearch/186994)
**Author:** [@RamyaGowda](https://discuss.elastic.co/u/RamyaGowda)\ **Replies:** 7\ **Last updated:** [June 23, 2019, 2:34pm UTC](https://discuss.elastic.co/t/last-12-hours-indexing-size-elasticsearch/186994 "2019-06-23T14:34:06Z")
Hi, How do i get the total size of data received at my elasticsearch cluster for last 12 hours? \_stats API give total size of the cluster, but i need to filter out for only last 12 hours data received by elasticsearch … --- ## [Opendistro security plugin and kubernetes readiness probe](https://discuss.elastic.co/t/opendistro-security-plugin-and-kubernetes-readiness-probe/187005)
**Author:** [@Tom\_Klinorain](https://discuss.elastic.co/u/Tom_Klinorain)\ **Replies:** 1\ **Last updated:** [June 23, 2019, 12:37pm UTC](https://discuss.elastic.co/t/opendistro-security-plugin-and-kubernetes-readiness-probe/187005 "2019-06-23T12:37:38Z")
Hi guys, I'm trying to setup elasticsearch with opendistro security plugin. Since my elasticsearch setup is a kubernetes statefulset, this introduced the following problem: elastic has began responding to all http cal… --- ## [Sharing data into multiple physical drives](https://discuss.elastic.co/t/sharing-data-into-multiple-physical-drives/186862)
**Author:** [@Srini12](https://discuss.elastic.co/u/Srini12)\ **Replies:** 1\ **Last updated:** [June 23, 2019, 11:08am UTC](https://discuss.elastic.co/t/sharing-data-into-multiple-physical-drives/186862 "2019-06-23T11:08:50Z")
Good day, We have a following situation. We started storing elastic data in 1 TB drive, and now it is full. We added one more disc with another 1 TB in size and configured two use both the drives, but unfortunately th… --- ## [Elastechsearch](https://discuss.elastic.co/t/elastechsearch/187001)
**Author:** [@Romdhana](https://discuss.elastic.co/u/Romdhana)\ **Replies:** 1\ **Last updated:** [June 23, 2019, 10:32am UTC](https://discuss.elastic.co/t/elastechsearch/187001 "2019-06-23T10:32:32Z")
what's the soulution about this problem : Jun 23 02:35:28 ubuntu elasticsearch\[6902\]: warning: Falling back to java on pat --- ## [Index split on imbalance user data](https://discuss.elastic.co/t/index-split-on-imbalance-user-data/186945)
**Author:** [@Wesley\_Hsiung](https://discuss.elastic.co/u/Wesley_Hsiung)\ **Replies:** 5\ **Last updated:** [June 23, 2019, 9:27am UTC](https://discuss.elastic.co/t/index-split-on-imbalance-user-data/186945 "2019-06-23T09:27:35Z")
our 1 million customers produce 1 billion transactional data every year, but top 50 customers account for more than half data (500 million docs), and I cann't know these top customers in advance, b/z every year may have… --- ## [Hot nodes running high on heap upon start and cluster timing out](https://discuss.elastic.co/t/hot-nodes-running-high-on-heap-upon-start-and-cluster-timing-out/186976)
**Author:** [@dwilches](https://discuss.elastic.co/u/dwilches)\ **Replies:** 1\ **Last updated:** [June 23, 2019, 6:41am UTC](https://discuss.elastic.co/t/hot-nodes-running-high-on-heap-upon-start-and-cluster-timing-out/186976 "2019-06-23T06:41:07Z")
We have a cluster with 30 hot nodes (12TB of data, 1051 shards). This morning some of the hot nodes stopped responding to the master and the cluster froze. We have seen this before, when a hot node's heap goes too high… --- ## [Connecting to TLS/SSL secured elastic cluster through transport client](https://discuss.elastic.co/t/connecting-to-tls-ssl-secured-elastic-cluster-through-transport-client/184803)
**Author:** [@Meet](https://discuss.elastic.co/u/Meet)\ **Replies:** 10\ **Last updated:** [June 23, 2019, 2:46am UTC](https://discuss.elastic.co/t/connecting-to-tls-ssl-secured-elastic-cluster-through-transport-client/184803 "2019-06-23T02:46:22Z")
Hi, I configured each node in the cluster to identify itself using its signed certificate and enable TLS on the transport layer. Set up passwords for Elastic Stack. I was able to successfully, connect to cluster throu… --- ## [How to install watcher on elasticsearch 7.1.1](https://discuss.elastic.co/t/how-to-install-watcher-on-elasticsearch-7-1-1/186965)
**Author:** [@proxx](https://discuss.elastic.co/u/proxx)\ **Replies:** 2\ **Last updated:** [June 22, 2019, 7:18pm UTC](https://discuss.elastic.co/t/how-to-install-watcher-on-elasticsearch-7-1-1/186965 "2019-06-22T19:18:52Z")
Guys i need help here, i have elasticseach,kibana and logstash setup And i need to setup my alerting and reporting plugin, so i came across watcher but i'm getting this error when installing --- ## [Inconsistent results with range query](https://discuss.elastic.co/t/inconsistent-results-with-range-query/185723)
**Author:** [@Oscar\_Sanchez\_Sanche](https://discuss.elastic.co/u/Oscar_Sanchez_Sanche)\ **Replies:** 2\ **Last updated:** [June 22, 2019, 7:07pm UTC](https://discuss.elastic.co/t/inconsistent-results-with-range-query/185723 "2019-06-22T19:07:33Z")
Hi there, i have noticed the range query sometimes returns correct results and sometimes it doesn't. For example, if i run this query: { "query": { "range" : { "meta.\_price.value" : { "gte" : 0,… --- ## [Defining the Order of Fields Returned in REST API JSON](https://discuss.elastic.co/t/defining-the-order-of-fields-returned-in-rest-api-json/186967)
**Author:** [@thegrif](https://discuss.elastic.co/u/thegrif)\ **Replies:** 0\ **Last updated:** [June 22, 2019, 6:46pm UTC](https://discuss.elastic.co/t/defining-the-order-of-fields-returned-in-rest-api-json/186967 "2019-06-22T18:46:55Z")
I'm working on a prototype of a search application and the guys reviewing it are getting a little bent out over the fields in the returned json. I've explained to them that the json spec specifically states there is no e… --- ## [Propose keywords in suggesters](https://discuss.elastic.co/t/propose-keywords-in-suggesters/186960)
**Author:** [@yan014](https://discuss.elastic.co/u/yan014)\ **Replies:** 0\ **Last updated:** [June 22, 2019, 2:43pm UTC](https://discuss.elastic.co/t/propose-keywords-in-suggesters/186960 "2019-06-22T14:43:48Z")
Hello, Is it possible with Elasticsearch to propose keywords based on one text field ? For example, I have the following texts: " Civil law is a branch of the law. In common law legal systems such asEngland and Wales,… --- ## [Doc count match](https://discuss.elastic.co/t/doc-count-match/186838)
**Author:** [@Animesh\_singh](https://discuss.elastic.co/u/Animesh_singh)\ **Replies:** 3\ **Last updated:** [June 22, 2019, 1:15pm UTC](https://discuss.elastic.co/t/doc-count-match/186838 "2019-06-22T13:15:56Z")
Hey , Can anynone tell me why there is difference between result of doc count API for match all and document count displayed in cat/indices result for a particular index . Or these doc counts are totally different beca… --- ## [Downgrade from 6.8 to 6.7](https://discuss.elastic.co/t/downgrade-from-6-8-to-6-7/186817)
**Author:** [@Denis\_Lamanov](https://discuss.elastic.co/u/Denis_Lamanov)\ **Replies:** 2\ **Last updated:** [June 22, 2019, 8:35am UTC](https://discuss.elastic.co/t/downgrade-from-6-8-to-6-7/186817 "2019-06-22T08:35:10Z")
Hi guys, After we upgraded to 6.8 we see performance issue with significantly high processor load. Is it possible downgrade from 6.8 to 6.7? As I correctly understand you are going to prevent downgrade in future Than… --- ## [Search After is returning documents previously seen in earlier page](https://discuss.elastic.co/t/search-after-is-returning-documents-previously-seen-in-earlier-page/186899)
**Author:** [@Jim\_Ford](https://discuss.elastic.co/u/Jim_Ford)\ **Replies:** 1\ **Last updated:** [June 22, 2019, 7:24am UTC](https://discuss.elastic.co/t/search-after-is-returning-documents-previously-seen-in-earlier-page/186899 "2019-06-22T07:24:01Z")
I am having very similar issue as the following post: Search After API - index state and updated documents given the following initial query: { "size": 3, "query": { "query\_string": { "query": "apple" … --- ## [Localhost:9200: nodename nor servname provided, or not known](https://discuss.elastic.co/t/localhost-nodename-nor-servname-provided-or-not-known/186173)
**Author:** [@sneup](https://discuss.elastic.co/u/sneup)\ **Replies:** 15\ **Last updated:** [June 22, 2019, 2:56am UTC](https://discuss.elastic.co/t/localhost-nodename-nor-servname-provided-or-not-known/186173 "2019-06-22T02:56:36Z")
I am running elastic search version 6.4 locally and my dependency for the spring boot application is implementation 'org.elasticsearch.client:elasticsearch-rest-high-level-client:6.4.0' . I am getting java.io.IOException… --- ## [Elasticsearch Index Mapping Exceeded](https://discuss.elastic.co/t/elasticsearch-index-mapping-exceeded/186537)
**Author:** [@motts](https://discuss.elastic.co/u/motts)\ **Replies:** 24\ **Last updated:** [June 22, 2019, 2:53am UTC](https://discuss.elastic.co/t/elasticsearch-index-mapping-exceeded/186537 "2019-06-22T02:53:07Z")
Hello there, As the title suggests, our index mapping has exceeded 1,000. What happens to the logs that introduce new fields? Are they not recorded or are the 1,001+ fields just not usable at this time? It's looking li… --- ## [Snapshot and date](https://discuss.elastic.co/t/snapshot-and-date/186911)
**Author:** [@He\_Pamela](https://discuss.elastic.co/u/He_Pamela)\ **Replies:** 3\ **Last updated:** [June 22, 2019, 2:51am UTC](https://discuss.elastic.co/t/snapshot-and-date/186911 "2019-06-22T02:51:53Z")
Hi, Can I make a Snapshot with a specific date? In my case I just want a snapshot with the last year data. Is it possible? Thanks. --- ## [Question About Lucene TokenStream DAGs](https://discuss.elastic.co/t/question-about-lucene-tokenstream-dags/186936)
**Author:** [@dvisz-inf](https://discuss.elastic.co/u/dvisz-inf)\ **Replies:** 0\ **Last updated:** [June 21, 2019, 9:51pm UTC](https://discuss.elastic.co/t/question-about-lucene-tokenstream-dags/186936 "2019-06-21T21:51:21Z")
Just came across this article: Does anyone happen to know if this remains relevant today? Thanks! --- ## [Backup and Restore in Private Clouds](https://discuss.elastic.co/t/backup-and-restore-in-private-clouds/186935)
**Author:** [@cool\_guy99](https://discuss.elastic.co/u/cool_guy99)\ **Replies:** 1\ **Last updated:** [June 21, 2019, 9:50pm UTC](https://discuss.elastic.co/t/backup-and-restore-in-private-clouds/186935 "2019-06-21T21:50:08Z")
I am looking for some options that are available to take a backup and restore in private clouds as well. I am aware of the azure, gcp, hdfs and s3 cloud plugins. Has anyone done any effort in writing a plugin/ or is thin… --- ## [How Elastic common schema names are define for the log fields](https://discuss.elastic.co/t/how-elastic-common-schema-names-are-define-for-the-log-fields/186725)
**Author:** [@Mani2451](https://discuss.elastic.co/u/Mani2451)\ **Replies:** 1\ **Last updated:** [June 20, 2019, 6:55pm UTC](https://discuss.elastic.co/t/how-elastic-common-schema-names-are-define-for-the-log-fields/186725 "2019-06-20T18:55:47Z")
Hi Elastic Team, I have certain fields which we use in Linux logs and can you please let me know what would be the Elastic common schema(ECS) name for those fields and how you define the ECS name for those fields ?? Fi… --- ## [Where is bootstrap password stored?](https://discuss.elastic.co/t/where-is-bootstrap-password-stored/185323)
**Author:** [@Meet](https://discuss.elastic.co/u/Meet)\ **Replies:** 4\ **Last updated:** [June 21, 2019, 6:47pm UTC](https://discuss.elastic.co/t/where-is-bootstrap-password-stored/185323 "2019-06-21T18:47:35Z")
Is there any way I can change it except for using bin/elasticsearch-setup or curl command? --- ## [Should I escape or validate query terms before using the es client?](https://discuss.elastic.co/t/should-i-escape-or-validate-query-terms-before-using-the-es-client/182969)
**Author:** [@Fernando\_Cesar](https://discuss.elastic.co/u/Fernando_Cesar)\ **Replies:** 5\ **Last updated:** [June 21, 2019, 6:41pm UTC](https://discuss.elastic.co/t/should-i-escape-or-validate-query-terms-before-using-the-es-client/182969 "2019-06-21T18:41:17Z")
Hy, I'm trying out ES with a simple project. A web page with a search box (i.e., like Google) and a backend ES client sending the query terms to the search engine. So I receive "XPTO" from the web form, and I use the E… --- ## [Advanced Search query](https://discuss.elastic.co/t/advanced-search-query/185739)
**Author:** [@jjarthur](https://discuss.elastic.co/u/jjarthur)\ **Replies:** 3\ **Last updated:** [June 21, 2019, 5:27pm UTC](https://discuss.elastic.co/t/advanced-search-query/185739 "2019-06-21T17:27:32Z")
I'm just starting with Elasticsearch but am required to create an 'advanced search' query. One of those searches where you select the drop-down boxes of your field, search accuracy, input value, and boolean condition. e… --- ## [Elasticsearch SQL ODBC Driver with MicroStrategy](https://discuss.elastic.co/t/elasticsearch-sql-odbc-driver-with-microstrategy/181139)
**Author:** [@shrikantgulia](https://discuss.elastic.co/u/shrikantgulia)\ **Replies:** 7\ **Last updated:** [June 21, 2019, 4:16pm UTC](https://discuss.elastic.co/t/elasticsearch-sql-odbc-driver-with-microstrategy/181139 "2019-06-21T16:16:52Z")
Hi All, I am trying to use Elasticsearch SQL ODBC Driver to push data from Elasticsearch to MicroStrategy on Windows 10. I've created a system DSN in Windows and a Database Instance in MicroStrategy Developer Tool for t… --- ## [Percentile calculation using two fields and condition](https://discuss.elastic.co/t/percentile-calculation-using-two-fields-and-condition/186053)
**Author:** [@pkshara](https://discuss.elastic.co/u/pkshara)\ **Replies:** 1\ **Last updated:** [June 21, 2019, 2:26pm UTC](https://discuss.elastic.co/t/percentile-calculation-using-two-fields-and-condition/186053 "2019-06-21T14:26:30Z")
Hi All, I am trying to calculate the percentile of success rate, using 2 fields count on one condition. Expl : I have 1000 hits Fields are time difference, flag, name I need to calculate in the below format, Pleas… --- ## [Aggregating Source IP and Destination IP pairs on Firewall logs](https://discuss.elastic.co/t/aggregating-source-ip-and-destination-ip-pairs-on-firewall-logs/186007)
**Author:** [@dushank](https://discuss.elastic.co/u/dushank)\ **Replies:** 1\ **Last updated:** [June 21, 2019, 2:21pm UTC](https://discuss.elastic.co/t/aggregating-source-ip-and-destination-ip-pairs-on-firewall-logs/186007 "2019-06-21T14:21:06Z")
Our SIEM collects logs from many firewall and stores in a Elasticsearch 5.6 repository. We want to retrieve data for Source and destination IP communication on certain ports. The idea is to find the top communicators and… --- ## [Export ERROR LOGS](https://discuss.elastic.co/t/export-error-logs/185620)
**Author:** [@Rajesh\_Sai](https://discuss.elastic.co/u/Rajesh_Sai)\ **Replies:** 1\ **Last updated:** [June 21, 2019, 12:36pm UTC](https://discuss.elastic.co/t/export-error-logs/185620 "2019-06-21T12:36:49Z")
I want to export the only error logs from Elasticsreach to Email.How Can I do it? --- ## [Export model](https://discuss.elastic.co/t/export-model/186690)
**Author:** [@Bharath\_Kumar\_R](https://discuss.elastic.co/u/Bharath_Kumar_R)\ **Replies:** 5\ **Last updated:** [June 21, 2019, 12:36pm UTC](https://discuss.elastic.co/t/export-model/186690 "2019-06-21T12:36:01Z")
Assume the following scenario I have the resources to collect only 60 days of data My job has been running for more than 200 days Today I found out we captured an anomaly and we wanted to remove this through the follo… --- ## [Watcher applying aggregations on all the documents, Need to apply aggregrations only from Now -2m to Now](https://discuss.elastic.co/t/watcher-applying-aggregations-on-all-the-documents-need-to-apply-aggregrations-only-from-now-2m-to-now/186698)
**Author:** [@vsalunkhe](https://discuss.elastic.co/u/vsalunkhe)\ **Replies:** 1\ **Last updated:** [June 21, 2019, 12:14pm UTC](https://discuss.elastic.co/t/watcher-applying-aggregations-on-all-the-documents-need-to-apply-aggregrations-only-from-now-2m-to-now/186698 "2019-06-21T12:14:52Z")
Hi, I am trying to implement watcher to monitor the the elastic stack components: 3 elasticsearch servers 2 logstash servers 1 kibana server I need to aggregate the Filesystem Use Percent for each of the components … --- ## [How does master node works?](https://discuss.elastic.co/t/how-does-master-node-works/186721)
**Author:** [@anon17386273](https://discuss.elastic.co/u/anon17386273)\ **Replies:** 1\ **Last updated:** [June 21, 2019, 11:52am UTC](https://discuss.elastic.co/t/how-does-master-node-works/186721 "2019-06-21T11:52:44Z")
I am planning to setup a large elasticsearch cluster (eg. 100 machines) Each machine having a few ES jvm instances running. Out of all these instances, 3 will be dedicated master instances. Others will be dedicated data… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1253) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1255)