# Elasticsearch

**URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=13

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 14

---

## [Issue Upgrading from Elasticsearch 8.19.4 to 9.1.4 – Indices Not Read-Only Despite Settings](https://discuss.elastic.co/t/issue-upgrading-from-elasticsearch-8-19-4-to-9-1-4-indices-not-read-only-despite-settings/382398)

<div class="topic-metadata">

**Author:** [@RuiCosta78](https://discuss.elastic.co/u/RuiCosta78)\
**Replies:** 11\
**Last updated:** [November 21, 2025, 8:50am UTC](https://discuss.elastic.co/t/issue-upgrading-from-elasticsearch-8-19-4-to-9-1-4-indices-not-read-only-despite-settings/382398 "2025-11-21T08:50:39Z")

</div>

Hi everyone, We're in the process of upgrading our Elasticsearch cluster from version 8.12.0 to 9.1.4, following the recommended upgrade path. Here's what we've done so far: Upgraded from 8.12.0 → 8.19.4 (latest 8.x …

---

## [Issues with upgrade from 8.18.1 to 9.0.1](https://discuss.elastic.co/t/issues-with-upgrade-from-8-18-1-to-9-0-1/378753)

<div class="topic-metadata">

**Author:** [@dominbdg](https://discuss.elastic.co/u/dominbdg)\
**Replies:** 29\
**Last updated:** [November 21, 2025, 8:31am UTC](https://discuss.elastic.co/t/issues-with-upgrade-from-8-18-1-to-9-0-1/378753 "2025-11-21T08:31:43Z")

</div>

Hello, I'm trying to upgrade current 8.18.1 to 9.0.1 but facing a lot of issues, Most of them have compatibility issues preventing upgrade. For example everytime I'm receiving something like below: "error.stack\_trac…

---

## [Persistent Reindex Failure from Source-Only Snapshot: unexpected docvalues type NONE for field '\_ignored' error](https://discuss.elastic.co/t/persistent-reindex-failure-from-source-only-snapshot-unexpected-docvalues-type-none-for-field-ignored-error/383178)

<div class="topic-metadata">

**Author:** [@Rizaldi\_Sanjaya](https://discuss.elastic.co/u/Rizaldi_Sanjaya)\
**Replies:** 2\
**Last updated:** [November 21, 2025, 4:14am UTC](https://discuss.elastic.co/t/persistent-reindex-failure-from-source-only-snapshot-unexpected-docvalues-type-none-for-field-ignored-error/383178 "2025-11-21T04:14:38Z")

</div>

Hello, I am attempting to restore a data stream from a source-only snapshot and then reindex it into a new, functional data stream, as required by the source-only documentation. The restore operation completes successf…

---

## [Elasticsearch 8.12.2 Startup Failure: SIGILL Crash](https://discuss.elastic.co/t/elasticsearch-8-12-2-startup-failure-sigill-crash/383554)

<div class="topic-metadata">

**Author:** [@Pabendi](https://discuss.elastic.co/u/Pabendi)\
**Replies:** 3\
**Last updated:** [November 20, 2025, 7:14pm UTC](https://discuss.elastic.co/t/elasticsearch-8-12-2-startup-failure-sigill-crash/383554 "2025-11-20T19:14:52Z")

</div>

Hello everyone, thank you so much for taking the time to read this. I have a small problem with my Elastic server: My Elasticsearch 8.12.2 was running without issues for several months on multiple nodes in a Red Hat En…

---

## [How to display case and single products together in search results](https://discuss.elastic.co/t/how-to-display-case-and-single-products-together-in-search-results/383549)

<div class="topic-metadata">

**Author:** [@Elastic04](https://discuss.elastic.co/u/Elastic04)\
**Replies:** 11\
**Last updated:** [November 20, 2025, 2:26pm UTC](https://discuss.elastic.co/t/how-to-display-case-and-single-products-together-in-search-results/383549 "2025-11-20T14:26:13Z")

</div>

We have a usecase to display case and single products next to each other in search results. How can I achieve this?

---

## [Splitting an Elastic Enterprise License Across Multiple Clusters](https://discuss.elastic.co/t/splitting-an-elastic-enterprise-license-across-multiple-clusters/383543)

<div class="topic-metadata">

**Author:** [@gueguet57](https://discuss.elastic.co/u/gueguet57)\
**Replies:** 1\
**Last updated:** [November 20, 2025, 1:45am UTC](https://discuss.elastic.co/t/splitting-an-elastic-enterprise-license-across-multiple-clusters/383543 "2025-11-20T01:45:51Z")

</div>

Hello, I would like to know if it's possible to split an Enterprise license across multiple Elastic clusters. For example, my PROD cluster is consuming only 40 GB out of a 64 GB license. Is it possible to use the remai…

---

## [Using the frozen tier with Elastic Cloud and ILM policies](https://discuss.elastic.co/t/using-the-frozen-tier-with-elastic-cloud-and-ilm-policies/383342)

<div class="topic-metadata">

**Author:** [@javierE](https://discuss.elastic.co/u/javierE)\
**Replies:** 4\
**Last updated:** [November 19, 2025, 4:25pm UTC](https://discuss.elastic.co/t/using-the-frozen-tier-with-elastic-cloud-and-ilm-policies/383342 "2025-11-19T16:25:41Z")

</div>

Hi all, I’m evaluating the frozen tier functionality in Elastic Cloud deployment, aiming to keep around ten years of historical data available for occasional analysis and compliance purposes. Given that we plan to ret…

---

## [Metricbeat system.process.memory.rss.bytes is inflated](https://discuss.elastic.co/t/metricbeat-system-process-memory-rss-bytes-is-inflated/383523)

<div class="topic-metadata">

**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\
**Replies:** 2\
**Last updated:** [November 18, 2025, 10:27pm UTC](https://discuss.elastic.co/t/metricbeat-system-process-memory-rss-bytes-is-inflated/383523 "2025-11-18T22:27:42Z")

</div>

Metricbeat 8.5.3 is reporting rss.bytes almost three time of system installed memory. why is that? is there explanation about it? for example exactly at same time - system.memory.total = 540,665,892,864 and system.…

---

## [Slow cluster recovery after node system updates](https://discuss.elastic.co/t/slow-cluster-recovery-after-node-system-updates/383462)

<div class="topic-metadata">

**Author:** [@ecology5913](https://discuss.elastic.co/u/ecology5913)\
**Replies:** 9\
**Last updated:** [November 18, 2025, 6:34pm UTC](https://discuss.elastic.co/t/slow-cluster-recovery-after-node-system-updates/383462 "2025-11-18T18:34:20Z")

</div>

I’ve been doing lifecycle management for ES clusters recently, from clusters with indices without replicas to clusters with 1TB shards. While the problems with those examples are obvious, I recently got more ‘normal‘ cl…

---

## [ILMs in cluster not performing rollover when conditions are met](https://discuss.elastic.co/t/ilms-in-cluster-not-performing-rollover-when-conditions-are-met/383369)

<div class="topic-metadata">

**Author:** [@Natalia\_Mellino](https://discuss.elastic.co/u/Natalia_Mellino)\
**Replies:** 9\
**Last updated:** [November 18, 2025, 6:30pm UTC](https://discuss.elastic.co/t/ilms-in-cluster-not-performing-rollover-when-conditions-are-met/383369 "2025-11-18T18:30:29Z")

</div>

Hello! We have an Elasticsearch cluster running 8.19.3 version (master, hot, cold and coordinating nodes) and we’re seeing some issues regarding our ILM policies. We are using data streams so we’ve configured several IL…

---

## [Can I Safely Use Aliases if My Application Requires a Single Fixed Index Name for All Operations?](https://discuss.elastic.co/t/can-i-safely-use-aliases-if-my-application-requires-a-single-fixed-index-name-for-all-operations/383496)

<div class="topic-metadata">

**Author:** [@mike\_wills](https://discuss.elastic.co/u/mike_wills)\
**Replies:** 4\
**Last updated:** [November 17, 2025, 9:05pm UTC](https://discuss.elastic.co/t/can-i-safely-use-aliases-if-my-application-requires-a-single-fixed-index-name-for-all-operations/383496 "2025-11-17T21:05:31Z")

</div>

Hello everyone, I’m looking for some guidance on an aliasing challenge I’m running into. We’re using an in-house Java-based application as the frontend to our Elasticsearch cluster. I’ve been exploring index aliases t…

---

## [Where is fleet-server CA?](https://discuss.elastic.co/t/where-is-fleet-server-ca/383491)

<div class="topic-metadata">

**Author:** [@Blason](https://discuss.elastic.co/u/Blason)\
**Replies:** 1\
**Last updated:** [November 17, 2025, 5:55pm UTC](https://discuss.elastic.co/t/where-is-fleet-server-ca/383491 "2025-11-17T17:55:42Z")

</div>

Hello, I am bit confused about fleet-server ca file? where is that stored? I mean I installed the elasticstack and then installed the fleet server on same server. Generated certificate using instances.yml instances: …

---

## [Migrate data to a new cluster with minimal interruption](https://discuss.elastic.co/t/migrate-data-to-a-new-cluster-with-minimal-interruption/383294)

<div class="topic-metadata">

**Author:** [@Ror](https://discuss.elastic.co/u/Ror)\
**Replies:** 7\
**Last updated:** [November 17, 2025, 11:04am UTC](https://discuss.elastic.co/t/migrate-data-to-a-new-cluster-with-minimal-interruption/383294 "2025-11-17T11:04:55Z")

</div>

Hi, I need to migrate multiple TB of data to a new cluster. Since this is production data, I’d like to avoid interruption as much as possible which can be tricky based on the volume of data. I have a simple infrastructu…

---

## [We do not use Scroll Query or PIT, What caused our ElasticSearch Cluster big OpenContexts Spike](https://discuss.elastic.co/t/we-do-not-use-scroll-query-or-pit-what-caused-our-elasticsearch-cluster-big-opencontexts-spike/383467)

<div class="topic-metadata">

**Author:** [@Thomas59](https://discuss.elastic.co/u/Thomas59)\
**Replies:** 4\
**Last updated:** [November 16, 2025, 5:35pm UTC](https://discuss.elastic.co/t/we-do-not-use-scroll-query-or-pit-what-caused-our-elasticsearch-cluster-big-opencontexts-spike/383467 "2025-11-16T17:35:10Z")

</div>

We experienced OpenContexts spikes in our Elasticsearch 6.8 environment. Since we’re not using Scroll Queries or Point in Time (PIT), I’d like to understand: What could be causing these OpenContexts spikes? Note: We h…

---

## [Edit Distance \> 2 - Is It Really Unconfigurable?](https://discuss.elastic.co/t/edit-distance-2-is-it-really-unconfigurable/383458)

<div class="topic-metadata">

**Author:** [@Ilia](https://discuss.elastic.co/u/Ilia)\
**Replies:** 3\
**Last updated:** [November 16, 2025, 9:11am UTC](https://discuss.elastic.co/t/edit-distance-2-is-it-really-unconfigurable/383458 "2025-11-16T09:11:08Z")

</div>

I'm facing the same problem mentioned in this thread - I need to use an edit distance greater than 2 for fuzzy searches, but Elasticsearch doesn't seem to support this. I understand the performance concerns with higher …

---

## [Rechearch project: integration the llm in elasticsearch for semantic search](https://discuss.elastic.co/t/rechearch-project-integration-the-llm-in-elasticsearch-for-semantic-search/383387)

<div class="topic-metadata">

**Author:** [@Yemboaro](https://discuss.elastic.co/u/Yemboaro)\
**Replies:** 1\
**Last updated:** [November 16, 2025, 5:17am UTC](https://discuss.elastic.co/t/rechearch-project-integration-the-llm-in-elasticsearch-for-semantic-search/383387 "2025-11-16T05:17:23Z")

</div>

Hello, I have a Master's 2 academic research project. I would like to research the integration of LLMs into Elasticsearch for semantic search. My question is, I wanted to ask you for guidelines on the research project …

---

## [Not able to delete indices which are in closed state using ILM](https://discuss.elastic.co/t/not-able-to-delete-indices-which-are-in-closed-state-using-ilm/383443)

<div class="topic-metadata">

**Author:** [@Elastic04](https://discuss.elastic.co/u/Elastic04)\
**Replies:** 7\
**Last updated:** [November 14, 2025, 3:51pm UTC](https://discuss.elastic.co/t/not-able-to-delete-indices-which-are-in-closed-state-using-ilm/383443 "2025-11-14T15:51:02Z")

</div>

I am not able to delete indices which are in closed state using ILM. Is there any other way to do it?

---

## [Upgrading (Critical Deprecations...)](https://discuss.elastic.co/t/upgrading-critical-deprecations/383424)

<div class="topic-metadata">

**Author:** [@Hannah\_J\_Swystun](https://discuss.elastic.co/u/Hannah_J_Swystun)\
**Replies:** 6\
**Last updated:** [November 14, 2025, 1:27pm UTC](https://discuss.elastic.co/t/upgrading-critical-deprecations/383424 "2025-11-14T13:27:13Z")

</div>

Hello everybody, I would like to upgrade from v.8.17.0 to 8.19.4 do this criticals deprecation issues will block my upgrade please ?

---

## [ELK SAAS Cluster turns red or yellow sometimes .. need to know the reason](https://discuss.elastic.co/t/elk-saas-cluster-turns-red-or-yellow-sometimes-need-to-know-the-reason/376916)

<div class="topic-metadata">

**Author:** [@AKAM14](https://discuss.elastic.co/u/AKAM14)\
**Replies:** 6\
**Last updated:** [November 14, 2025, 9:05am UTC](https://discuss.elastic.co/t/elk-saas-cluster-turns-red-or-yellow-sometimes-need-to-know-the-reason/376916 "2025-11-14T09:05:12Z")

</div>

My SAAS Cluster goes to red or yellow every often. After sometime it becomes ok. sometimes i get a message for Replica shards is missing . where can i get the error for cluster going to red or yellow. and how to solve i…

---

## [Suggested approach for avoiding stale access token with ApiProxyConnector?](https://discuss.elastic.co/t/suggested-approach-for-avoiding-stale-access-token-with-apiproxyconnector/383392)

<div class="topic-metadata">

**Author:** [@mansn](https://discuss.elastic.co/u/mansn)\
**Replies:** 0\
**Last updated:** [November 12, 2025, 12:36pm UTC](https://discuss.elastic.co/t/suggested-approach-for-avoiding-stale-access-token-with-apiproxyconnector/383392 "2025-11-12T12:36:49Z")

</div>

Hi, I’m using @elastic/search-ui-elasticsearch-connector/api-proxy to create a connector for my backend (and the backend implements the ElasticsearchAPIConnector). My backend endpoints requires an Bearer token to be pas…

---

## [Cluster.routing.allocation.balance.write\_load on free license](https://discuss.elastic.co/t/cluster-routing-allocation-balance-write-load-on-free-license/383390)

<div class="topic-metadata">

**Author:** [@Hieu\_Pham](https://discuss.elastic.co/u/Hieu_Pham)\
**Replies:** 1\
**Last updated:** [November 12, 2025, 12:31pm UTC](https://discuss.elastic.co/t/cluster-routing-allocation-balance-write-load-on-free-license/383390 "2025-11-12T12:31:40Z")

</div>

Hi team! Does cluster.routing.allocation.balance.write\_load take any effect on free x-pack license? According to this page: Subscriptions | Elastic Stack Products & Support | Elastic, only Advanced Cluster Balancing has…

---

## [Elasticsearch-rest5-client isn't deployed to maven central repository](https://discuss.elastic.co/t/elasticsearch-rest5-client-isnt-deployed-to-maven-central-repository/383384)

<div class="topic-metadata">

**Author:** [@Ahmed\_Ashour](https://discuss.elastic.co/u/Ahmed_Ashour)\
**Replies:** 1\
**Last updated:** [November 12, 2025, 10:07am UTC](https://discuss.elastic.co/t/elasticsearch-rest5-client-isnt-deployed-to-maven-central-repository/383384 "2025-11-12T10:07:29Z")

</div>

It seems that elasticsearch-rest5-client 9.2.1 isn’t deployed to the maven central repository, although it is referenced by elasticsearch-java 9.2.1. Thanks.

---

## [Unable to extract the elasticsearch install tar file](https://discuss.elastic.co/t/unable-to-extract-the-elasticsearch-install-tar-file/383376)

<div class="topic-metadata">

**Author:** [@vikramaddagulla](https://discuss.elastic.co/u/vikramaddagulla)\
**Replies:** 3\
**Last updated:** [November 12, 2025, 6:14am UTC](https://discuss.elastic.co/t/unable-to-extract-the-elasticsearch-install-tar-file/383376 "2025-11-12T06:14:45Z")

</div>

Hello I downloaded the elasticsearch installer file from the location : wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-9.2.1-linux-x86\_64.tar.gz When I try to extract this on my unix machine, I…

---

## [Preventing date\_time\_parse\_exception in ingest pipeline](https://discuss.elastic.co/t/preventing-date-time-parse-exception-in-ingest-pipeline/382707)

<div class="topic-metadata">

**Author:** [@marekott](https://discuss.elastic.co/u/marekott)\
**Replies:** 6\
**Last updated:** [November 11, 2025, 9:05pm UTC](https://discuss.elastic.co/t/preventing-date-time-parse-exception-in-ingest-pipeline/382707 "2025-11-11T21:05:00Z")

</div>

Hi, I have encountered date parsing related problem in my ingest pipeline. Full details can be found here: \[Ingest pipeline\] Occasionally ends with \`date\_time\_parse\_exception\` when pipeline is trying to store time withou…

---

## [EntitlementBootstrap failure preventing startup: AttachNotSupportedException: Unable to open socket file](https://discuss.elastic.co/t/entitlementbootstrap-failure-preventing-startup-attachnotsupportedexception-unable-to-open-socket-file/382452)

<div class="topic-metadata">

**Author:** [@buitcj](https://discuss.elastic.co/u/buitcj)\
**Replies:** 58\
**Last updated:** [November 11, 2025, 8:46am UTC](https://discuss.elastic.co/t/entitlementbootstrap-failure-preventing-startup-attachnotsupportedexception-unable-to-open-socket-file/382452 "2025-11-11T08:46:41Z")

</div>

Several of our customer instances are hitting the following issue. Any idea what this is? It’s only happening in particular environments. I am currently trying to narrow down what is special about the environments and ho…

---

## [How to update fields that are not opened in the source document without affecting them](https://discuss.elastic.co/t/how-to-update-fields-that-are-not-opened-in-the-source-document-without-affecting-them/383175)

<div class="topic-metadata">

**Author:** [@S-Dragon0302](https://discuss.elastic.co/u/S-Dragon0302)\
**Replies:** 14\
**Last updated:** [November 11, 2025, 1:48am UTC](https://discuss.elastic.co/t/how-to-update-fields-that-are-not-opened-in-the-source-document-without-affecting-them/383175 "2025-11-11T01:48:32Z")

</div>

My template { "mappings":{"dynamic": "false","\_source":{"includes":\["a","b"\]},"properties":{"a":{"type": "keyword"},"b":{"type": "keyword"},"c":{"type": "keyword"}}}} PUT /your\_index\_name/\_doc/1 {"a": "value\_a","b": "…

---

## [Does querystring supports spannotquery?](https://discuss.elastic.co/t/does-querystring-supports-spannotquery/383328)

<div class="topic-metadata">

**Author:** [@vsop\_479](https://discuss.elastic.co/u/vsop_479)\
**Replies:** 0\
**Last updated:** [November 10, 2025, 7:32am UTC](https://discuss.elastic.co/t/does-querystring-supports-spannotquery/383328 "2025-11-10T07:32:02Z")

</div>

Does querystring supports spannotquery? Does querystring like below supported by ES? spanNot(title:united, title:states, 1, true)

---

## [In ElasticSearch version 7.14.2, the following query causes the estimated\_size of the request circuit breaker to keep increasing and will not decrease even after 1-2 days](https://discuss.elastic.co/t/in-elasticsearch-version-7-14-2-the-following-query-causes-the-estimated-size-of-the-request-circuit-breaker-to-keep-increasing-and-will-not-decrease-even-after-1-2-days/383288)

<div class="topic-metadata">

**Author:** [@dackh](https://discuss.elastic.co/u/dackh)\
**Replies:** 7\
**Last updated:** [November 10, 2025, 6:23am UTC](https://discuss.elastic.co/t/in-elasticsearch-version-7-14-2-the-following-query-causes-the-estimated-size-of-the-request-circuit-breaker-to-keep-increasing-and-will-not-decrease-even-after-1-2-days/383288 "2025-11-10T06:23:52Z")

</div>

This index has 2 million documents, each with approximately 300 fields. The query syntax is as follows: GET /option\_indicator/\_search { "profile": true, "\_source": true, "track\_total\_hits": true, "size": 0,…

---

## [Private connection to elastic cloud deployment](https://discuss.elastic.co/t/private-connection-to-elastic-cloud-deployment/383303)

<div class="topic-metadata">

**Author:** [@searchwithme](https://discuss.elastic.co/u/searchwithme)\
**Replies:** 3\
**Last updated:** [November 9, 2025, 1:38pm UTC](https://discuss.elastic.co/t/private-connection-to-elastic-cloud-deployment/383303 "2025-11-09T13:38:21Z")

</div>

Hi! We are evlauting elastic cloud but only if this is possible : set up private connectivity between onprem (or laptop) to elastic cloud deployment . From docs, I see private connection is posisble just with private li…

---

## [How to Configure Trust/Entitlements for Datadog APM Java Agent on Elasticsearch 9.X](https://discuss.elastic.co/t/how-to-configure-trust-entitlements-for-datadog-apm-java-agent-on-elasticsearch-9-x/383119)

<div class="topic-metadata">

**Author:** [@flyxp11](https://discuss.elastic.co/u/flyxp11)\
**Replies:** 6\
**Last updated:** [November 9, 2025, 11:42am UTC](https://discuss.elastic.co/t/how-to-configure-trust-entitlements-for-datadog-apm-java-agent-on-elasticsearch-9-x/383119 "2025-11-09T11:42:23Z")

</div>

1. Is the Datadog APM Java Agent officially supported for use with Elasticsearch 9.x? 2. What are the specifuc Entitlements(security permissions) required for the dd-java-agent.jar to run as a Java Agent on an Elasticse…

[Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=12)

[Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=14)
