# Elasticsearch

**URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1285

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 1286

---

## [Elasticstart can't start on Deepin 15.3, java.lang.NoClassDefFoundError jackson/dataformat/yaml/snakeyaml/error/YAMLException](https://discuss.elastic.co/t/elasticstart-cant-start-on-deepin-15-3-java-lang-noclassdeffounderror-jackson-dataformat-yaml-snakeyaml-error-yamlexception/182768)

<div class="topic-metadata">

**Author:** [@febrifahmi](https://discuss.elastic.co/u/febrifahmi)\
**Replies:** 5\
**Last updated:** [May 27, 2019, 10:18am UTC](https://discuss.elastic.co/t/elasticstart-cant-start-on-deepin-15-3-java-lang-noclassdeffounderror-jackson-dataformat-yaml-snakeyaml-error-yamlexception/182768 "2019-05-27T10:18:28Z")

</div>

Hi, I'm trying to run elasticsearch (fresh install) on Deepin 15.3 but it seems it stuck. Here is the error log: Exception in thread "main" java.lang.NoClassDefFoundError: org/elasticsearch/common/jackson/dataformat/ya…

---

## [Sorting breaks aggregation](https://discuss.elastic.co/t/sorting-breaks-aggregation/182867)

<div class="topic-metadata">

**Author:** [@Junker](https://discuss.elastic.co/u/Junker)\
**Replies:** 1\
**Last updated:** [May 27, 2019, 9:55am UTC](https://discuss.elastic.co/t/sorting-breaks-aggregation/182867 "2019-05-27T09:55:43Z")

</div>

I use this query to get search hits and the count of search hits across multiple indices: /index1,index2/\_search { "query":{ "query\_string":{ "query":"\*" } }, "aggs":{ "group\_by\_index":{ "t…

---

## [Get storage usage based of query](https://discuss.elastic.co/t/get-storage-usage-based-of-query/182878)

<div class="topic-metadata">

**Author:** [@nadavrs](https://discuss.elastic.co/u/nadavrs)\
**Replies:** 0\
**Last updated:** [May 27, 2019, 9:53am UTC](https://discuss.elastic.co/t/get-storage-usage-based-of-query/182878 "2019-05-27T09:53:31Z")

</div>

Hi, Can I get the total amount of storage that documents take based on a query of certain field? I looked at the API documentation and only found it to be possible on the Cluster/Index level. Thanks in advance!

---

## [Elastic search fails when node.lock file is not empty](https://discuss.elastic.co/t/elastic-search-fails-when-node-lock-file-is-not-empty/182875)

<div class="topic-metadata">

**Author:** [@HPVRNP](https://discuss.elastic.co/u/HPVRNP)\
**Replies:** 0\
**Last updated:** [May 27, 2019, 9:44am UTC](https://discuss.elastic.co/t/elastic-search-fails-when-node-lock-file-is-not-empty/182875 "2019-05-27T09:44:34Z")

</div>

Hi, Environment: OS : Windows 64-bit ElasticSearch : 6.6.2 Java: 1.8.151 Cluster: Single Node cluster Index strategy: Indices are created daily and programmatically Shard: Single shard per index and no replication …

---

## [Error with indexing nested object (Elasticsearch 5.6)](https://discuss.elastic.co/t/error-with-indexing-nested-object-elasticsearch-5-6/182869)

<div class="topic-metadata">

**Author:** [@sabdoul](https://discuss.elastic.co/u/sabdoul)\
**Replies:** 0\
**Last updated:** [May 27, 2019, 9:08am UTC](https://discuss.elastic.co/t/error-with-indexing-nested-object-elasticsearch-5-6/182869 "2019-05-27T09:08:23Z")

</div>

Hello, I get an error (logstash error"=\>{"type"=\>"illegal\_argument\_exception", "reason"=\>"object mapping \[sender\_mail\] can't be changed from nested to non-nested) when I index a nested object field with logstash in Elas…

---

## [Resolving synonyms and document frequency for autocomplete querying in elasticsearch](https://discuss.elastic.co/t/resolving-synonyms-and-document-frequency-for-autocomplete-querying-in-elasticsearch/182868)

<div class="topic-metadata">

**Author:** [@User\_User](https://discuss.elastic.co/u/User_User)\
**Replies:** 0\
**Last updated:** [May 27, 2019, 9:08am UTC](https://discuss.elastic.co/t/resolving-synonyms-and-document-frequency-for-autocomplete-querying-in-elasticsearch/182868 "2019-05-27T09:08:06Z")

</div>

I am trying to build an ElasticSearch index which will have documents with product names, for instance of laptops - { "name" : "Laptop Blue I7"} Then I want to use it for autocomplete suggestion by querying the ES inde…

---

## [Getting error while configuring mcqueen as a S3 alternative for storing snapshots for elasticsearch](https://discuss.elastic.co/t/getting-error-while-configuring-mcqueen-as-a-s3-alternative-for-storing-snapshots-for-elasticsearch/181790)

<div class="topic-metadata">

**Author:** [@Ronnie16](https://discuss.elastic.co/u/Ronnie16)\
**Replies:** 8\
**Last updated:** [May 27, 2019, 8:52am UTC](https://discuss.elastic.co/t/getting-error-while-configuring-mcqueen-as-a-s3-alternative-for-storing-snapshots-for-elasticsearch/181790 "2019-05-27T08:52:08Z")

</div>

I'm trying to configure mcqueen for storing elasticsearch snapshots. I have created a bucket ./s3curl.pl --id=test --createBucket -- http://store-test.blobstore.xxx.com/snapshots But when I'm trying to create a reposit…

---

## [Difference between \_version and \[\_seq\_no, \_primary\_term\]](https://discuss.elastic.co/t/difference-between-version-and-seq-no-primary-term/182859)

<div class="topic-metadata">

**Author:** [@shayantabrizi](https://discuss.elastic.co/u/shayantabrizi)\
**Replies:** 1\
**Last updated:** [May 27, 2019, 8:21am UTC](https://discuss.elastic.co/t/difference-between-version-and-seq-no-primary-term/182859 "2019-05-27T08:21:24Z")

</div>

It seems to me that both versioning (\_version; See here) and \[\_seq\_no, \_primary\_term\] (See here) are used for optimistic concurrency control (e.g., to determine the version of a document we want to update). What's the di…

---

## [I would like to send data from spring boot app to elasticsearch](https://discuss.elastic.co/t/i-would-like-to-send-data-from-spring-boot-app-to-elasticsearch/182836)

<div class="topic-metadata">

**Author:** [@xodn0812](https://discuss.elastic.co/u/xodn0812)\
**Replies:** 3\
**Last updated:** [May 27, 2019, 8:15am UTC](https://discuss.elastic.co/t/i-would-like-to-send-data-from-spring-boot-app-to-elasticsearch/182836 "2019-05-27T08:15:02Z")

</div>

I would like to send data from spring boot app to elasticsearch. Which way is better? What use case is there? and, i am using fluentD.

---

## [Index rollover with date and a counter](https://discuss.elastic.co/t/index-rollover-with-date-and-a-counter/182855)

<div class="topic-metadata">

**Author:** [@sadiesh](https://discuss.elastic.co/u/sadiesh)\
**Replies:** 2\
**Last updated:** [May 27, 2019, 8:10am UTC](https://discuss.elastic.co/t/index-rollover-with-date-and-a-counter/182855 "2019-05-27T08:10:51Z")

</div>

Hi, I have a index which is more than 500GB per day(index-2019.05.27) . I want to make a rollover for every 4 hr so it will a create a new index index-2019.05.27-000001 index-2019.05.27-000002 index-2019.05.27-000003 …

---

## [How to upgrade elasticsearch version 5.6.2 to 6.8 without use of X-PACK?](https://discuss.elastic.co/t/how-to-upgrade-elasticsearch-version-5-6-2-to-6-8-without-use-of-x-pack/182847)

<div class="topic-metadata">

**Author:** [@savan\_karathiya](https://discuss.elastic.co/u/savan_karathiya)\
**Replies:** 8\
**Last updated:** [May 27, 2019, 7:54am UTC](https://discuss.elastic.co/t/how-to-upgrade-elasticsearch-version-5-6-2-to-6-8-without-use-of-x-pack/182847 "2019-05-27T07:54:33Z")

</div>

I want to upgrade my elasticsearch from version 5.6.2 to 6.8, but I don't want to use X-PACK. So how I can migrate all indices version 5.6.2 to 6.8?

---

## [Multiple index issue when querying same document](https://discuss.elastic.co/t/multiple-index-issue-when-querying-same-document/182577)

<div class="topic-metadata">

**Author:** [@isarib](https://discuss.elastic.co/u/isarib)\
**Replies:** 2\
**Last updated:** [May 27, 2019, 7:53am UTC](https://discuss.elastic.co/t/multiple-index-issue-when-querying-same-document/182577 "2019-05-27T07:53:45Z")

</div>

Is there a way I can ensure the results from multiple indexes are mapped/displayed correctly? What seems to happen at the moment with the below results, in separate indexes, is the later does not overwrite the document …

---

## [Elasticsearch SSL/TLS verification mode full](https://discuss.elastic.co/t/elasticsearch-ssl-tls-verification-mode-full/182633)

<div class="topic-metadata">

**Author:** [@safderali5](https://discuss.elastic.co/u/safderali5)\
**Replies:** 2\
**Last updated:** [May 27, 2019, 7:45am UTC](https://discuss.elastic.co/t/elasticsearch-ssl-tls-verification-mode-full/182633 "2019-05-27T07:45:42Z")

</div>

I enabled TLS on elasticsearch using self signed certificates. The certificate include DNS entries containing host names of all elasticsearch nodes. When I start elasticsearch I get exception: No subject alternative na…

---

## [Migrate out of OSS images](https://discuss.elastic.co/t/migrate-out-of-oss-images/182774)

<div class="topic-metadata">

**Author:** [@LucasSh](https://discuss.elastic.co/u/LucasSh)\
**Replies:** 1\
**Last updated:** [May 27, 2019, 7:34am UTC](https://discuss.elastic.co/t/migrate-out-of-oss-images/182774 "2019-05-27T07:34:21Z")

</div>

We naively took a dependency in the 6.4.2 oss docker images and want to move over to the standard image. Since we're already running in prod I'd really like to avoid a wipe and redploy. Is there any way we can migrate …

---

## [Completion Suggester CRUD with Java API](https://discuss.elastic.co/t/completion-suggester-crud-with-java-api/182816)

<div class="topic-metadata">

**Author:** [@rogito\_manda](https://discuss.elastic.co/u/rogito_manda)\
**Replies:** 0\
**Last updated:** [May 26, 2019, 10:28pm UTC](https://discuss.elastic.co/t/completion-suggester-crud-with-java-api/182816 "2019-05-26T22:28:50Z")

</div>

Hi, i´ve been trying for 2 days to figure out how can i perform CRUD operation in Elasticsearch (version 6.5) for Completion Suggester with the Java API. (RestHighLevelClient). I already checked the whole documentation…

---

## [If I send the data directly from spring boot app to elasticsearch using curl, is there a problem?](https://discuss.elastic.co/t/if-i-send-the-data-directly-from-spring-boot-app-to-elasticsearch-using-curl-is-there-a-problem/182844)

<div class="topic-metadata">

**Author:** [@xodn0812](https://discuss.elastic.co/u/xodn0812)\
**Replies:** 1\
**Last updated:** [May 27, 2019, 6:01am UTC](https://discuss.elastic.co/t/if-i-send-the-data-directly-from-spring-boot-app-to-elasticsearch-using-curl-is-there-a-problem/182844 "2019-05-27T06:01:50Z")

</div>

If I send the data directly from spring boot app to elasticsearch using curl, is there a problem?

---

## [Why kernel parameter was changed when I installed ElasticSearch 7.X via 'yum install'](https://discuss.elastic.co/t/why-kernel-parameter-was-changed-when-i-installed-elasticsearch-7-x-via-yum-install/182839)

<div class="topic-metadata">

**Author:** [@homi.e](https://discuss.elastic.co/u/homi.e)\
**Replies:** 0\
**Last updated:** [May 27, 2019, 5:45am UTC](https://discuss.elastic.co/t/why-kernel-parameter-was-changed-when-i-installed-elasticsearch-7-x-via-yum-install/182839 "2019-05-27T05:45:39Z")

</div>

In my project, some servers used kernel parameter(net.ipv4.conf.all.rp\_filter=0) for network architecture. When I installed ElasticSearch 7.X via 'yum install elasticsearch', That kernel parameter was also changed 0 =\> …

---

## [TransportClient](https://discuss.elastic.co/t/transportclient/182827)

<div class="topic-metadata">

**Author:** [@hyhong](https://discuss.elastic.co/u/hyhong)\
**Replies:** 2\
**Last updated:** [May 27, 2019, 5:03am UTC](https://discuss.elastic.co/t/transportclient/182827 "2019-05-27T05:03:35Z")

</div>

TransportClient is thread-safe?

---

## [Index.refresh\_interval=-1 will stop updating index forever](https://discuss.elastic.co/t/index-refresh-interval-1-will-stop-updating-index-forever/182831)

<div class="topic-metadata">

**Author:** [@Jehutywong](https://discuss.elastic.co/u/Jehutywong)\
**Replies:** 0\
**Last updated:** [May 27, 2019, 4:10am UTC](https://discuss.elastic.co/t/index-refresh-interval-1-will-stop-updating-index-forever/182831 "2019-05-27T04:10:39Z")

</div>

In my environment, i have an index template set to index.refresh\_interval: "-1". After i upgraded to ES 7.0, indexes associated with this template will return 0 hit on querying, even if those indexes have been created fo…

---

## [Creating grroup in Elasticsearch](https://discuss.elastic.co/t/creating-grroup-in-elasticsearch/182693)

<div class="topic-metadata">

**Author:** [@RamyaGowda](https://discuss.elastic.co/u/RamyaGowda)\
**Replies:** 7\
**Last updated:** [May 27, 2019, 4:09am UTC](https://discuss.elastic.co/t/creating-grroup-in-elasticsearch/182693 "2019-05-27T04:09:02Z")

</div>

Hi Anybody could help me describing how to group multiple users in Elastic I have an xpack enabled elasticsearch,and created multiple user. i have group users who all belongs to one group.How could i achieve this plea…

---

## [How can I save a data with type Array\[String\] to Es with painless script](https://discuss.elastic.co/t/how-can-i-save-a-data-with-type-array-string-to-es-with-painless-script/182584)

<div class="topic-metadata">

**Author:** [@huolongguo007](https://discuss.elastic.co/u/huolongguo007)\
**Replies:** 1\
**Last updated:** [May 27, 2019, 3:36am UTC](https://discuss.elastic.co/t/how-can-i-save-a-data-with-type-array-string-to-es-with-painless-script/182584 "2019-05-27T03:36:24Z")

</div>

In my project, i tried to save the data from spark-stream to ES, to be exact, it is to update a struct table. I don't known is there any better way to update data in ES? Well, I used the painless script to update, like …

---

## [Password protect elasticsearch 7 cluster](https://discuss.elastic.co/t/password-protect-elasticsearch-7-cluster/182822)

<div class="topic-metadata">

**Author:** [@Hooman\_Bahreini](https://discuss.elastic.co/u/Hooman_Bahreini)\
**Replies:** 1\
**Last updated:** [May 27, 2019, 3:02am UTC](https://discuss.elastic.co/t/password-protect-elasticsearch-7-cluster/182822 "2019-05-27T03:02:10Z")

</div>

I have installed elasticsearch 7 on Ubuntu. I have a basic licence. Now I want to password protect the cluster. I set xpack.security.enabled: true in elasticsearch.yml and run elasticsearch. And I get the following messa…

---

## [Liblog4cxx.so.10 change to liblog4cxx.so.10.gz after started a time](https://discuss.elastic.co/t/liblog4cxx-so-10-change-to-liblog4cxx-so-10-gz-after-started-a-time/182169)

<div class="topic-metadata">

**Author:** [@chenchuangc](https://discuss.elastic.co/u/chenchuangc)\
**Replies:** 6\
**Last updated:** [May 27, 2019, 2:47am UTC](https://discuss.elastic.co/t/liblog4cxx-so-10-change-to-liblog4cxx-so-10-gz-after-started-a-time/182169 "2019-05-27T02:47:09Z")

</div>

Elasticsearch version bin/elasticsearch --version 7.0.0 Plugins installed bin/elasticsearch-plugin list analysis-ik JVM version java -version java version "1.8.0\_91" Java(TM) SE Runtime Environment (build 1.8.0\_91-…

---

## [Making filter for the last data set in Kibana discover](https://discuss.elastic.co/t/making-filter-for-the-last-data-set-in-kibana-discover/182553)

<div class="topic-metadata">

**Author:** [@JIYOUNG](https://discuss.elastic.co/u/JIYOUNG)\
**Replies:** 5\
**Last updated:** [May 27, 2019, 2:42am UTC](https://discuss.elastic.co/t/making-filter-for-the-last-data-set-in-kibana-discover/182553 "2019-05-27T02:42:28Z")

</div>

Hello. When using Kibana, I meet some problem. Kibana is tool using time-based. But I need to see the last data set. In Kibana Discover, I want to make Filter to see the last data. If using SQL, like the below: SELE…

---

## [Does Elastic support pipe operator (|) like splunk](https://discuss.elastic.co/t/does-elastic-support-pipe-operator-like-splunk/182613)

<div class="topic-metadata">

**Author:** [@hopcq](https://discuss.elastic.co/u/hopcq)\
**Replies:** 1\
**Last updated:** [May 27, 2019, 2:40am UTC](https://discuss.elastic.co/t/does-elastic-support-pipe-operator-like-splunk/182613 "2019-05-27T02:40:19Z")

</div>

Dear all, In my case off Monitor Alarm from Network Device. One Alarm have two event: Raise Alarm: when a problem of system occur Clear Alarm: when system go normal (alarm clear) sample: May 1 02:47:50 :cisco: %C7…

---

## [Curator snapshot stuck in INIT](https://discuss.elastic.co/t/curator-snapshot-stuck-in-init/182796)

<div class="topic-metadata">

**Author:** [@Tim\_Curtin1](https://discuss.elastic.co/u/Tim_Curtin1)\
**Replies:** 5\
**Last updated:** [May 26, 2019, 11:46pm UTC](https://discuss.elastic.co/t/curator-snapshot-stuck-in-init/182796 "2019-05-26T23:46:12Z")

</div>

I've done a fair bit of searching and I can't come up with a fix here A curator snapshot in our cluster has become stuck (around 7TB of data). About the cluster ES 2.4.6 Running on AWS with the cloud plugin Here's w…

---

## [In memory HTTP Request parsing](https://discuss.elastic.co/t/in-memory-http-request-parsing/182812)

<div class="topic-metadata">

**Author:** [@Simone\_Scarduzio](https://discuss.elastic.co/u/Simone_Scarduzio)\
**Replies:** 0\
**Last updated:** [May 26, 2019, 9:24pm UTC](https://discuss.elastic.co/t/in-memory-http-request-parsing/182812 "2019-05-26T21:24:08Z")

</div>

I want to write an offline raw HTTP log enricher tool such that: input series of HTTP request objects like: { "id": "\<uniqueID\>", "timestamp": "\<someTimestmp\>", "method": "GET", "uri": "/\_cat/indices?pretty" "headers":…

---

## [Watcher Email](https://discuss.elastic.co/t/watcher-email/182544)

<div class="topic-metadata">

**Author:** [@hyhong](https://discuss.elastic.co/u/hyhong)\
**Replies:** 4\
**Last updated:** [May 26, 2019, 9:18pm UTC](https://discuss.elastic.co/t/watcher-email/182544 "2019-05-26T21:18:10Z")

</div>

The watcher email action send error,as follows: "error": { "root\_cause": \[ { "type": "messaging\_exception", "reason": "failed to send email with subject \[xxx\] via account \[smtp\_account\]" } \], "type": "messaging\_e…

---

## [Remove a Field using a wildcard on reindex](https://discuss.elastic.co/t/remove-a-field-using-a-wildcard-on-reindex/182448)

<div class="topic-metadata">

**Author:** [@hogbinj](https://discuss.elastic.co/u/hogbinj)\
**Replies:** 3\
**Last updated:** [May 26, 2019, 6:37pm UTC](https://discuss.elastic.co/t/remove-a-field-using-a-wildcard-on-reindex/182448 "2019-05-26T18:37:53Z")

</div>

I've done a foolish thing and created a large number of fields in the format "fingerprint.attachment\_5C6C2D4E000092B707F41EF1" : "Attachment 5C6C2D4E000092B707F41EF1.gif is an IMAGE and therfore NOT processed" I used …

---

## [Need help in improving search speed (about 20s) (elastic 6.3)](https://discuss.elastic.co/t/need-help-in-improving-search-speed-about-20s-elastic-6-3/182739)

<div class="topic-metadata">

**Author:** [@Convergence](https://discuss.elastic.co/u/Convergence)\
**Replies:** 7\
**Last updated:** [May 26, 2019, 4:13pm UTC](https://discuss.elastic.co/t/need-help-in-improving-search-speed-about-20s-elastic-6-3/182739 "2019-05-26T16:13:10Z")

</div>

Hello community, I have an elastic search cluster split around 2 nodes (and given 4gb ram to elastic on each). There I have an index containing about 80 million docs. I have split this across 10 shards. There are many a…

[Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1284)

[Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1286)
