# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1320 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1321 --- ## [Forecast limit](https://discuss.elastic.co/t/forecast-limit/137215)
**Author:** [@chrillebile](https://discuss.elastic.co/u/chrillebile)\ **Replies:** 2\ **Last updated:** [April 25, 2019, 4:19pm UTC](https://discuss.elastic.co/t/forecast-limit/137215 "2019-04-25T16:19:40Z")
Hey! Are you able to change the forecast limit from 8 weeks to something else? --- ## [AD auth doesn't work after upgrading from 6.7 to 7.0](https://discuss.elastic.co/t/ad-auth-doesnt-work-after-upgrading-from-6-7-to-7-0/178298)
**Author:** [@Kult](https://discuss.elastic.co/u/Kult)\ **Replies:** 8\ **Last updated:** [April 25, 2019, 4:01pm UTC](https://discuss.elastic.co/t/ad-auth-doesnt-work-after-upgrading-from-6-7-to-7-0/178298 "2019-04-25T16:01:54Z")
Hi, This is the xpack config that I had in 6.7, which worked perfectly fine for AD authentication: xpack: security: enabled: true transport: ssl: enabled: true authc: realms: a… --- ## [\[Rollup Job\] NumberFormatException](https://discuss.elastic.co/t/rollup-job-numberformatexception/178195)
**Author:** [@DustyMeg](https://discuss.elastic.co/u/DustyMeg)\ **Replies:** 4\ **Last updated:** [April 25, 2019, 3:52pm UTC](https://discuss.elastic.co/t/rollup-job-numberformatexception/178195 "2019-04-25T15:52:36Z")
Whenever a new rollup job is created the first 1000 documents are found but all subsequent calls throws the following error in the Elasticsearch logs. shard \[\[DUPkSOQVQAeFTiEJ9DYBgQ\]\[metricbeat-7.0.0-2019-04-21\]\[0\]\], r… --- ## [Multi-index overhead](https://discuss.elastic.co/t/multi-index-overhead/178489)
**Author:** [@Pradyumna\_Achar](https://discuss.elastic.co/u/Pradyumna_Achar)\ **Replies:** 1\ **Last updated:** [April 25, 2019, 3:46pm UTC](https://discuss.elastic.co/t/multi-index-overhead/178489 "2019-04-25T15:46:07Z")
Hello, If I have a situation wherein there are a large number of aliases all pointing to a few concrete indices. For example, 10,000 aliases, with each of them pointing to one or more of just 5 concrete indices. In th… --- ## [Endless Loop es 6.6.2](https://discuss.elastic.co/t/endless-loop-es-6-6-2/178291)
**Author:** [@fuhong](https://discuss.elastic.co/u/fuhong)\ **Replies:** 10\ **Last updated:** [April 25, 2019, 3:44pm UTC](https://discuss.elastic.co/t/endless-loop-es-6-6-2/178291 "2019-04-25T15:44:53Z")
Can you help me??? \ \org.elasticsearch.client\ \elasticsearch-rest-high-level-client\ \6.6.2\ \ \ **Author:** [@jbenner](https://discuss.elastic.co/u/jbenner)\ **Replies:** 16\ **Last updated:** [April 25, 2019, 3:18pm UTC](https://discuss.elastic.co/t/elasticsearch-cluster-issues/178319 "2019-04-25T15:18:03Z") Hello, I am trying to build an elasticsearch cluster and keep running into an issue. I have the following: 5 physical nodes, centos 7 installed and trying to run dedicated master/data nodes. ElasticSearch 6.6.2 I hav… --- ## [Support for user provided boolean expressions/UI](https://discuss.elastic.co/t/support-for-user-provided-boolean-expressions-ui/178333)
**Author:** [@hacker\_21](https://discuss.elastic.co/u/hacker_21)\ **Replies:** 1\ **Last updated:** [April 25, 2019, 3:11pm UTC](https://discuss.elastic.co/t/support-for-user-provided-boolean-expressions-ui/178333 "2019-04-25T15:11:13Z")
Hi there, I'm trying to add support in my application for boolean expressions from the user. I'd like to allow the user to enter multiple keywords such as "Real Estate AND Agent" or a phrase such as "Tech News OR Tech… --- ## [Cluster state update task](https://discuss.elastic.co/t/cluster-state-update-task/175372)
**Author:** [@yahuu](https://discuss.elastic.co/u/yahuu)\ **Replies:** 19\ **Last updated:** [April 25, 2019, 3:07pm UTC](https://discuss.elastic.co/t/cluster-state-update-task/175372 "2019-04-25T15:07:03Z")
Hello everyone, when i start up my docker containers for my ELK-Stack my Elasticsearch does take some time for some cluster state update tasks. What are these tasks doing? I only have one node and no cluster. Are they… --- ## [Template analyzer whitespace](https://discuss.elastic.co/t/template-analyzer-whitespace/178254)
**Author:** [@Babak](https://discuss.elastic.co/u/Babak)\ **Replies:** 3\ **Last updated:** [April 25, 2019, 2:50pm UTC](https://discuss.elastic.co/t/template-analyzer-whitespace/178254 "2019-04-25T14:50:55Z")
Hi, With this tempalte: PUT \_template/test-analyzer { "index\_patterns" : \[ "test-analyzer" \], "settings" : { "index" : { "refresh\_interval" : "5s", "number\_of\_shards" : "1", … --- ## [Pipeline aggregations on millions unique terms](https://discuss.elastic.co/t/pipeline-aggregations-on-millions-unique-terms/178430)
**Author:** [@Yonatan\_Omer](https://discuss.elastic.co/u/Yonatan_Omer)\ **Replies:** 1\ **Last updated:** [April 25, 2019, 2:29pm UTC](https://discuss.elastic.co/t/pipeline-aggregations-on-millions-unique-terms/178430 "2019-04-25T14:29:36Z")
Our index holds log events from 100000 clients, mixed in a flat timeline, each doc looks like: { "@timestamp": "...", "eventId": "Failed to start process foo.exe", "clientId": "f68830d5-b1bf-45d6-b54b-abbf2438b709", … --- ## [Missing documents in index in elasticsearch on docker](https://discuss.elastic.co/t/missing-documents-in-index-in-elasticsearch-on-docker/178482)
**Author:** [@korada](https://discuss.elastic.co/u/korada)\ **Replies:** 0\ **Last updated:** [April 25, 2019, 2:27pm UTC](https://discuss.elastic.co/t/missing-documents-in-index-in-elasticsearch-on-docker/178482 "2019-04-25T14:27:49Z")
Hi, I am running elasticsearch on docker and we are using it along with kibana as a reporting tool. We are using Nest API (.NET) to add/updates documents directly on indexes. When there is high throughput from our serv… --- ## [\[7.0 Error\] CANNOT start after changing IP in 7.0 (code=exited, status=78)](https://discuss.elastic.co/t/7-0-error-cannot-start-after-changing-ip-in-7-0-code-exited-status-78/178455)
**Author:** [@cosloli](https://discuss.elastic.co/u/cosloli)\ **Replies:** 2\ **Last updated:** [April 25, 2019, 2:14pm UTC](https://discuss.elastic.co/t/7-0-error-cannot-start-after-changing-ip-in-7-0-code-exited-status-78/178455 "2019-04-25T14:14:52Z")
At first I used the default setting, and everything works fine. But when I change the host IP in elasticsearch.yml, it just can't launch: The config I changed: I can launch ES succesfully in 1.7.3 version with cha… --- ## [ES 7 number of shards and replicas for 1.7TB daily index](https://discuss.elastic.co/t/es-7-number-of-shards-and-replicas-for-1-7tb-daily-index/178477)
**Author:** [@o1o1o11o1](https://discuss.elastic.co/u/o1o1o11o1)\ **Replies:** 0\ **Last updated:** [April 25, 2019, 1:54pm UTC](https://discuss.elastic.co/t/es-7-number-of-shards-and-replicas-for-1-7tb-daily-index/178477 "2019-04-25T13:54:07Z")
Hello, I've been running a 50 data node ES cluster with 1.7TB of daily indices for quite some time now. I've just deploy a new 50 node ES 7.0 cluster and was wondering, given the daily index size of 1.7TB with 30 day re… --- ## [Bucket script aggregation in kibana visualization](https://discuss.elastic.co/t/bucket-script-aggregation-in-kibana-visualization/178336)
**Author:** [@Josip\_Cagalj](https://discuss.elastic.co/u/Josip_Cagalj)\ **Replies:** 0\ **Last updated:** [April 24, 2019, 10:14pm UTC](https://discuss.elastic.co/t/bucket-script-aggregation-in-kibana-visualization/178336 "2019-04-24T22:14:34Z")
Hi, in my index I'm holding transaction data and I'm storing (among other stuff) fields transactionType and amount. I'm interested in Transaction types 1 (withdraw) and 2 (deposit). I'm trying to visualize the following … --- ## [Transport client frequent "node disconnected" messages](https://discuss.elastic.co/t/transport-client-frequent-node-disconnected-messages/178281)
**Author:** [@Chris\_Gatihi](https://discuss.elastic.co/u/Chris_Gatihi)\ **Replies:** 5\ **Last updated:** [April 25, 2019, 1:47pm UTC](https://discuss.elastic.co/t/transport-client-frequent-node-disconnected-messages/178281 "2019-04-25T13:47:14Z")
Hi, We are on ES 5.5 and use the Transport Client with sniff set to true to connect our services to our ES cluster via a load balancer. We only need the load balancer to discover the nodes (they change dynamically) but… --- ## [Strange logs after update to ES7](https://discuss.elastic.co/t/strange-logs-after-update-to-es7/178474)
**Author:** [@andiroot](https://discuss.elastic.co/u/andiroot)\ **Replies:** 0\ **Last updated:** [April 25, 2019, 1:37pm UTC](https://discuss.elastic.co/t/strange-logs-after-update-to-es7/178474 "2019-04-25T13:37:19Z")
Hello. Need help ! After update to Elasticsearch version 7 get warnings like: \[2019-04-25T16:25:14,411\]\[WARN \]\[o.e.c.InternalClusterInfoService\] \[esb\_es\_node\] Failed to update shard information for ClusterInfoUpdateJob… --- ## [Difference in shard size of primary and replica](https://discuss.elastic.co/t/difference-in-shard-size-of-primary-and-replica/178446)
**Author:** [@pokaleshrey](https://discuss.elastic.co/u/pokaleshrey)\ **Replies:** 2\ **Last updated:** [April 25, 2019, 12:48pm UTC](https://discuss.elastic.co/t/difference-in-shard-size-of-primary-and-replica/178446 "2019-04-25T12:48:36Z")
Hi, I have one replica. In all 2 data nodes. Off late i have observed that the size of primary is not in sync with it replica. Though the number of documents are same. /\_cat/shards is giving below results \*yindex 1 … --- ## [License problem elasticsearch](https://discuss.elastic.co/t/license-problem-elasticsearch/178457)
**Author:** [@Anis](https://discuss.elastic.co/u/Anis)\ **Replies:** 0\ **Last updated:** [April 25, 2019, 12:37pm UTC](https://discuss.elastic.co/t/license-problem-elasticsearch/178457 "2019-04-25T12:37:13Z")
Hello, I have created a cluster ELK for my company on centos 7 using last version ELK 7 (1 logstash, 1 elasticsearch master, 1 elasticsearch indexer, and 1 kibana). The purpose is to make ELK cluster up and to start XP… --- ## [Abount compress algorithms](https://discuss.elastic.co/t/abount-compress-algorithms/178345)
**Author:** [@Arizon](https://discuss.elastic.co/u/Arizon)\ **Replies:** 3\ **Last updated:** [April 25, 2019, 12:37pm UTC](https://discuss.elastic.co/t/abount-compress-algorithms/178345 "2019-04-25T12:37:12Z")
Hello， as i know, elasticsearch provide two compression algorithms, lz4 and deflate. The former focused on compression and decompression speed. And the latter means more space saving. Recently, I have done a test. I re… --- ## [Primary and Replica shards are giving different results for same query](https://discuss.elastic.co/t/primary-and-replica-shards-are-giving-different-results-for-same-query/178431)
**Author:** [@sangam0707](https://discuss.elastic.co/u/sangam0707)\ **Replies:** 0\ **Last updated:** [April 25, 2019, 10:39am UTC](https://discuss.elastic.co/t/primary-and-replica-shards-are-giving-different-results-for-same-query/178431 "2019-04-25T10:39:43Z")
I am getting inconsistent results for some queries. For same query , primary and replica shards are giving different number of documents. I have 8 primary shards and 8 replica shards on 2 datanodes. I am using routing… --- ## [How to Get a specific field in query elasticsearch, and write it somewhere](https://discuss.elastic.co/t/how-to-get-a-specific-field-in-query-elasticsearch-and-write-it-somewhere/178451)
**Author:** [@matheusribeirogarcia](https://discuss.elastic.co/u/matheusribeirogarcia)\ **Replies:** 0\ **Last updated:** [April 25, 2019, 12:06pm UTC](https://discuss.elastic.co/t/how-to-get-a-specific-field-in-query-elasticsearch-and-write-it-somewhere/178451 "2019-04-25T12:06:47Z")
Basically I have an elasticsearch index that contains logs from postfix, i've made an query that gets all documents that contains the value I want, like this: GET postfix-logs/\_search { "query": { "match\_phra… --- ## [Unable to start Elasticsearch - java.lang.IllegalStateException: Duplicate key org.elasticsearch.plugins.PluginsService$Bundle@e3623fe](https://discuss.elastic.co/t/unable-to-start-elasticsearch-java-lang-illegalstateexception-duplicate-key-org-elasticsearch-plugins-pluginsservice-bundle-e3623fe/170847)
**Author:** [@subhas](https://discuss.elastic.co/u/subhas)\ **Replies:** 30\ **Last updated:** [April 25, 2019, 12:11pm UTC](https://discuss.elastic.co/t/unable-to-start-elasticsearch-java-lang-illegalstateexception-duplicate-key-org-elasticsearch-plugins-pluginsservice-bundle-e3623fe/170847 "2019-04-25T12:11:24Z")
After server reboot, elasticsearch fails to restart. I use only 2 plugins namely ingest-geoip and ingest-user-agent. Same issue is coming when i try to uninstall and install them again. Below is the error log - \[2019-03… --- ## [Index.priority setting not working for replicas](https://discuss.elastic.co/t/index-priority-setting-not-working-for-replicas/178048)
**Author:** [@Andy\_Wick](https://discuss.elastic.co/u/Andy_Wick)\ **Replies:** 16\ **Last updated:** [April 25, 2019, 11:35am UTC](https://discuss.elastic.co/t/index-priority-setting-not-working-for-replicas/178048 "2019-04-25T11:35:41Z")
Using 6.7.0 and when my cluster recovers, replicas with NO index.priority setting are recovered before replicas with an index.priority set. Is this a known issue? Should I just set a priority on all indices? This is … --- ## [Weighted percentile aggregation](https://discuss.elastic.co/t/weighted-percentile-aggregation/178248)
**Author:** [@romainneutron](https://discuss.elastic.co/u/romainneutron)\ **Replies:** 1\ **Last updated:** [April 25, 2019, 8:39am UTC](https://discuss.elastic.co/t/weighted-percentile-aggregation/178248 "2019-04-25T08:39:48Z")
Hello, I would like to compute a weighted percentile aggregation and I don't find a way to achieve this combining the existing aggregation. My use case is I have documents that have an "age" property with a weight. Thi… --- ## [Bool query should in bool must](https://discuss.elastic.co/t/bool-query-should-in-bool-must/178384)
**Author:** [@nayun\_oh](https://discuss.elastic.co/u/nayun_oh)\ **Replies:** 2\ **Last updated:** [April 25, 2019, 7:40am UTC](https://discuss.elastic.co/t/bool-query-should-in-bool-must/178384 "2019-04-25T07:40:12Z")
I use bool should in bool must query like below. { "query":{ "bool":{ "must":\[ { "bool": { "should":\[ { "match":{ "securityType":"ACCESS" } } \] } }, { "match": { "secuirtyEvent":"Read" } } \] } } } … --- ## [Is Cross-Cluster Searching Available in Free (Open Source / Basic) License?](https://discuss.elastic.co/t/is-cross-cluster-searching-available-in-free-open-source-basic-license/178341)
**Author:** [@Michael\_Sander](https://discuss.elastic.co/u/Michael_Sander)\ **Replies:** 2\ **Last updated:** [April 25, 2019, 7:36am UTC](https://discuss.elastic.co/t/is-cross-cluster-searching-available-in-free-open-source-basic-license/178341 "2019-04-25T07:36:58Z")
Do you need a paid x-pack license to run cross cluster search? Or is it possible to use this feature on the free license? The Elasticsearch documentation on cross cluster search and security indicates that to do cross c… --- ## [Validation problem after moving from 5.6 to 6.7](https://discuss.elastic.co/t/validation-problem-after-moving-from-5-6-to-6-7/178382)
**Author:** [@toka](https://discuss.elastic.co/u/toka)\ **Replies:** 0\ **Last updated:** [April 25, 2019, 7:15am UTC](https://discuss.elastic.co/t/validation-problem-after-moving-from-5-6-to-6-7/178382 "2019-04-25T07:15:43Z")
Hi there! I upgraded my cluster from 5.6.0 to 6.7.1, and after that, I realized that documents that were created in version 5.6.0 fail when I try a partial update. The error, in particular, is as follow: { "error": {… --- ## [How to make an aggregation for 1st character at the right way](https://discuss.elastic.co/t/how-to-make-an-aggregation-for-1st-character-at-the-right-way/177711)
**Author:** [@bachqv](https://discuss.elastic.co/u/bachqv)\ **Replies:** 4\ **Last updated:** [April 25, 2019, 7:18am UTC](https://discuss.elastic.co/t/how-to-make-an-aggregation-for-1st-character-at-the-right-way/177711 "2019-04-25T07:18:14Z")
Hi all, Could you please share with me the right solution for making the aggregation in query for the first character at the most efficient way? I saw some idea from the StackOverflow the below code but still not recom… --- ## [Elastic Search set up in Cluster Environment](https://discuss.elastic.co/t/elastic-search-set-up-in-cluster-environment/178380)
**Author:** [@rahulka](https://discuss.elastic.co/u/rahulka)\ **Replies:** 0\ **Last updated:** [April 25, 2019, 7:02am UTC](https://discuss.elastic.co/t/elastic-search-set-up-in-cluster-environment/178380 "2019-04-25T07:02:15Z")
Hi Team, We have 3 different node is in our production env. Two working as Master-data and one as master. All three are connected to load balancer. Right now we are having 3 instance of Kibana connecting to one or othe… --- ## [Index Settings for Optimizing Indexing Throughput](https://discuss.elastic.co/t/index-settings-for-optimizing-indexing-throughput/178323)
**Author:** [@dawiro](https://discuss.elastic.co/u/dawiro)\ **Replies:** 1\ **Last updated:** [April 25, 2019, 6:17am UTC](https://discuss.elastic.co/t/index-settings-for-optimizing-indexing-throughput/178323 "2019-04-25T06:17:48Z")
Hi, In our logging clusters we're indexing at around 40k msg/sec and 500gb per index per day. The storage backend is ceph and sometimes it struggles as load increases over time etc. Consequently, I'm toying wondering w… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1319) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1321)