# Elasticsearch

**URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1329

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 1330

---

## [How to fix setting "indices.recovery.max\_bytes\_per\_sec" in splitted cluster?](https://discuss.elastic.co/t/how-to-fix-setting-indices-recovery-max-bytes-per-sec-in-splitted-cluster/176455)

<div class="topic-metadata">

**Author:** [@rmsys](https://discuss.elastic.co/u/rmsys)\
**Replies:** 3\
**Last updated:** [April 17, 2019, 1:45am UTC](https://discuss.elastic.co/t/how-to-fix-setting-indices-recovery-max-bytes-per-sec-in-splitted-cluster/176455 "2019-04-17T01:45:40Z")

</div>

Hi guys! I have a cluster (v5.6.4) with nodes in most default settings, and this settings works in cluster 9 nodes \[all master eligible, ingest: (default=true), client: (default=true) and data: (default=true) \] and w…

---

## [How to copy data of one specific shard (indices A) to another indices (indices B)?](https://discuss.elastic.co/t/how-to-copy-data-of-one-specific-shard-indices-a-to-another-indices-indices-b/177170)

<div class="topic-metadata">

**Author:** [@mario12](https://discuss.elastic.co/u/mario12)\
**Replies:** 7\
**Last updated:** [April 17, 2019, 12:24am UTC](https://discuss.elastic.co/t/how-to-copy-data-of-one-specific-shard-indices-a-to-another-indices-indices-b/177170 "2019-04-17T00:24:09Z")

</div>

I have to copy data of one specific shard (indices A) to another indices (indices B). How can this be done?

---

## [Migrating from Elastic Search 5.x to 6.x broke this query and I would like to understand why](https://discuss.elastic.co/t/migrating-from-elastic-search-5-x-to-6-x-broke-this-query-and-i-would-like-to-understand-why/177168)

<div class="topic-metadata">

**Author:** [@dcemgs](https://discuss.elastic.co/u/dcemgs)\
**Replies:** 0\
**Last updated:** [April 16, 2019, 11:27pm UTC](https://discuss.elastic.co/t/migrating-from-elastic-search-5-x-to-6-x-broke-this-query-and-i-would-like-to-understand-why/177168 "2019-04-16T23:27:39Z")

</div>

Hello, Assume an index with a "person" type with firstName, lastName and homePhone, workPhone, address, etc. fields. We have this query running on Elastic Search 5.x { "query": { "bool": { "must": \[ …

---

## [DSL query with multiple wildcard and timestamp range - syntax check](https://discuss.elastic.co/t/dsl-query-with-multiple-wildcard-and-timestamp-range-syntax-check/173054)

<div class="topic-metadata">

**Author:** [@shankarps](https://discuss.elastic.co/u/shankarps)\
**Replies:** 2\
**Last updated:** [April 16, 2019, 9:06pm UTC](https://discuss.elastic.co/t/dsl-query-with-multiple-wildcard-and-timestamp-range-syntax-check/173054 "2019-04-16T21:06:27Z")

</div>

I am trying to create a DSL query to search for a text with wild cards. I have the following working API call. http://localhost:9200/\_search?q="Error creating" AND @timestamp:\["2019-03-18T17:01:49Z" TO "2019-03-18T18:00…

---

## [Shard allocation is not happening as expected after adding two more nodes to our ES cluster](https://discuss.elastic.co/t/shard-allocation-is-not-happening-as-expected-after-adding-two-more-nodes-to-our-es-cluster/176919)

<div class="topic-metadata">

**Author:** [@Arunlal\_A](https://discuss.elastic.co/u/Arunlal_A)\
**Replies:** 9\
**Last updated:** [April 16, 2019, 6:43pm UTC](https://discuss.elastic.co/t/shard-allocation-is-not-happening-as-expected-after-adding-two-more-nodes-to-our-es-cluster/176919 "2019-04-16T18:43:00Z")

</div>

Hi, We are facing some issues with shard allocation (both primary and replica) after upgrading the ES cluster size. We had a three node elasticsearch cluster and we recently added two more nodes into this cluster. The …

---

## [ElasticSearch number of shards queried](https://discuss.elastic.co/t/elasticsearch-number-of-shards-queried/177011)

<div class="topic-metadata">

**Author:** [@arvinds94](https://discuss.elastic.co/u/arvinds94)\
**Replies:** 13\
**Last updated:** [April 16, 2019, 6:27pm UTC](https://discuss.elastic.co/t/elasticsearch-number-of-shards-queried/177011 "2019-04-16T18:27:19Z")

</div>

I have 2 different indices within an ElasticSearch cluster with 6 nodes. One index (index A) has 2 primary shards and 2 replicas per giving us 6 total shards. The other index (index B) has 5 primary shards and 1 replic…

---

## [Shards not allocating based on disk space](https://discuss.elastic.co/t/shards-not-allocating-based-on-disk-space/177125)

<div class="topic-metadata">

**Author:** [@Peterson](https://discuss.elastic.co/u/Peterson)\
**Replies:** 5\
**Last updated:** [April 16, 2019, 5:20pm UTC](https://discuss.elastic.co/t/shards-not-allocating-based-on-disk-space/177125 "2019-04-16T17:20:07Z")

</div>

I have a cluster with 9 nodes, all the same size. The shards are allocating evenly in regards to the number of shards per node, but not in regards to the disk space. In reading the documentation, "Elasticsearch considers…

---

## [Searching using a column of type number doesn't work](https://discuss.elastic.co/t/searching-using-a-column-of-type-number-doesnt-work/177128)

<div class="topic-metadata">

**Author:** [@Guilian](https://discuss.elastic.co/u/Guilian)\
**Replies:** 0\
**Last updated:** [April 16, 2019, 4:51pm UTC](https://discuss.elastic.co/t/searching-using-a-column-of-type-number-doesnt-work/177128 "2019-04-16T16:51:39Z")

</div>

Hello, there is a search field in my website that is used to search objects from type Program. The Program class contains a Property called ProgramNumber from type integer which is entered by the user to start the sear…

---

## [Insert into index, Update in index and Delete from index don't work](https://discuss.elastic.co/t/insert-into-index-update-in-index-and-delete-from-index-dont-work/175544)

<div class="topic-metadata">

**Author:** [@Guilian](https://discuss.elastic.co/u/Guilian)\
**Replies:** 6\
**Last updated:** [April 16, 2019, 4:36pm UTC](https://discuss.elastic.co/t/insert-into-index-update-in-index-and-delete-from-index-dont-work/175544 "2019-04-16T16:36:02Z")

</div>

Hello, I implemented four methods for my web app: Search(): searchs datasets by name (works) InsertIntoIndex(): adds a newly created dataset into the index (doesn't work) UpdateInIndex(): updates to values of an edite…

---

## [Date math and rounding is not work when the format is not specified](https://discuss.elastic.co/t/date-math-and-rounding-is-not-work-when-the-format-is-not-specified/176993)

<div class="topic-metadata">

**Author:** [@JeffreyQ](https://discuss.elastic.co/u/JeffreyQ)\
**Replies:** 1\
**Last updated:** [April 16, 2019, 4:32pm UTC](https://discuss.elastic.co/t/date-math-and-rounding-is-not-work-when-the-format-is-not-specified/176993 "2019-04-16T16:32:32Z")

</div>

We use ES 2.4.1. When the date datatype field does not specify the 'format', we use the rounded date and specify the format in the query, the query result is incorrect. mapping: { "rd": { "type": "dat…

---

## [Creating Log](https://discuss.elastic.co/t/creating-log/177064)

<div class="topic-metadata">

**Author:** [@Raghunadhan](https://discuss.elastic.co/u/Raghunadhan)\
**Replies:** 1\
**Last updated:** [April 16, 2019, 4:29pm UTC](https://discuss.elastic.co/t/creating-log/177064 "2019-04-16T16:29:12Z")

</div>

Hi All, I am from relational database back end .I need to know whether we can do every thing in Elasticsearch that we do in relational database.Then need to know can we create a log of a data from relational database …

---

## [Return the value of aggs in match query](https://discuss.elastic.co/t/return-the-value-of-aggs-in-match-query/176360)

<div class="topic-metadata">

**Author:** [@bhushan](https://discuss.elastic.co/u/bhushan)\
**Replies:** 14\
**Last updated:** [April 16, 2019, 4:24pm UTC](https://discuss.elastic.co/t/return-the-value-of-aggs-in-match-query/176360 "2019-04-16T16:24:33Z")

</div>

Hi, I want to return the value of aggs max in Match query. for eg. { "aggs" : { "max\_id" : { "max" : { "field" : "id" } } } } Value of above needs to be return in { "query": {"match": {"id": \<max\_id\>}} } Or i…

---

## [User management audit events in Elasticsearch](https://discuss.elastic.co/t/user-management-audit-events-in-elasticsearch/177114)

<div class="topic-metadata">

**Author:** [@landoncarlson85](https://discuss.elastic.co/u/landoncarlson85)\
**Replies:** 3\
**Last updated:** [April 16, 2019, 3:57pm UTC](https://discuss.elastic.co/t/user-management-audit-events-in-elasticsearch/177114 "2019-04-16T15:57:11Z")

</div>

I can see in the audit logs on my linux box (/var/log...... ) when I create a user in Kibana or change a user. However this same log file does not show when I delete a user in Kibana. Does that event get logged to anothe…

---

## [Run tests from intellij idea](https://discuss.elastic.co/t/run-tests-from-intellij-idea/177100)

<div class="topic-metadata">

**Author:** [@754b65d236a544450766](https://discuss.elastic.co/u/754b65d236a544450766)\
**Replies:** 2\
**Last updated:** [April 16, 2019, 2:22pm UTC](https://discuss.elastic.co/t/run-tests-from-intellij-idea/177100 "2019-04-16T14:22:22Z")

</div>

Good afternoon. I'm trying to run test from intellij idea. I have executed all the advices from CONTRIBUTING.md ( in the "Configuring IDEs And Running Tests" chapter): Unfortunately I have the same error for all the…

---

## [Ignore docs longer than 512 bytes on reindex](https://discuss.elastic.co/t/ignore-docs-longer-than-512-bytes-on-reindex/177093)

<div class="topic-metadata">

**Author:** [@magorbe](https://discuss.elastic.co/u/magorbe)\
**Replies:** 0\
**Last updated:** [April 16, 2019, 1:00pm UTC](https://discuss.elastic.co/t/ignore-docs-longer-than-512-bytes-on-reindex/177093 "2019-04-16T13:00:40Z")

</div>

Hello, I have the typical problem {"error":{"root\_cause":\[{"type":"action\_request\_validation\_exception","reason":"Validation Failed: 1: id is too long, must be no longer than 512 bytes but was: 522;"}\], when I do reindex…

---

## [Syntax error message in elasticsearch.yml](https://discuss.elastic.co/t/syntax-error-message-in-elasticsearch-yml/177052)

<div class="topic-metadata">

**Author:** [@yasin](https://discuss.elastic.co/u/yasin)\
**Replies:** 12\
**Last updated:** [April 16, 2019, 12:29pm UTC](https://discuss.elastic.co/t/syntax-error-message-in-elasticsearch-yml/177052 "2019-04-16T12:29:24Z")

</div>

Dear Team, I'm trying to configure the slack notification but i'm always getting the following error message: The YAML settings are invalid, please check your syntax This error message is created after adding the mess…

---

## [Elasticsearch Index Analyzers and Memory Management](https://discuss.elastic.co/t/elasticsearch-index-analyzers-and-memory-management/177077)

<div class="topic-metadata">

**Author:** [@debayan\_samanta](https://discuss.elastic.co/u/debayan_samanta)\
**Replies:** 0\
**Last updated:** [April 16, 2019, 11:41am UTC](https://discuss.elastic.co/t/elasticsearch-index-analyzers-and-memory-management/177077 "2019-04-16T11:41:07Z")

</div>

Hi Team, I have 2 indexes one of them is created using logstash and doesnt have any specific analyzer/normalizer applied to it and that index has more than 1M records but taking only 1GB memory space in each node. On th…

---

## [Return a personalized message in \_update](https://discuss.elastic.co/t/return-a-personalized-message-in-update/177074)

<div class="topic-metadata">

**Author:** [@Anurag\_Mankar](https://discuss.elastic.co/u/Anurag_Mankar)\
**Replies:** 0\
**Last updated:** [April 16, 2019, 11:20am UTC](https://discuss.elastic.co/t/return-a-personalized-message-in-update/177074 "2019-04-16T11:20:34Z")

</div>

I want to return some message from a scripted update query using lang painless.

---

## [Create multiple indexes problem](https://discuss.elastic.co/t/create-multiple-indexes-problem/176326)

<div class="topic-metadata">

**Author:** [@Kolitha\_Perera](https://discuss.elastic.co/u/Kolitha_Perera)\
**Replies:** 1\
**Last updated:** [April 11, 2019, 7:08am UTC](https://discuss.elastic.co/t/create-multiple-indexes-problem/176326 "2019-04-11T07:08:37Z")

</div>

Im using node elasticsearch npm package and I'm creating multiple indexes may be 1000 at once. my connection string is as follows this.elasticsearchClient = new elasticsearch.Client({ host: \`${config.ca…

---

## [Ignore above](https://discuss.elastic.co/t/ignore-above/177062)

<div class="topic-metadata">

**Author:** [@Deepak2](https://discuss.elastic.co/u/Deepak2)\
**Replies:** 0\
**Last updated:** [April 16, 2019, 10:38am UTC](https://discuss.elastic.co/t/ignore-above/177062 "2019-04-16T10:38:55Z")

</div>

I have a field whose ignore above is less. Please tell me the syntax to update it in kibana console "Querry\_Message": { "type": "text", "fields": { "keyword": { "type": "keyword", "ignore\_above": 256 } } }

---

## [I have a field which is storing epoch time i just want to find if that epoch time is falling in current month ? please suggest me how to do that with example](https://discuss.elastic.co/t/i-have-a-field-which-is-storing-epoch-time-i-just-want-to-find-if-that-epoch-time-is-falling-in-current-month-please-suggest-me-how-to-do-that-with-example/177059)

<div class="topic-metadata">

**Author:** [@Nitin\_Kumar](https://discuss.elastic.co/u/Nitin_Kumar)\
**Replies:** 0\
**Last updated:** [April 16, 2019, 10:25am UTC](https://discuss.elastic.co/t/i-have-a-field-which-is-storing-epoch-time-i-just-want-to-find-if-that-epoch-time-is-falling-in-current-month-please-suggest-me-how-to-do-that-with-example/177059 "2019-04-16T10:25:35Z")

</div>

mapping is as follows "contractDateTime": { "type": "long" }

---

## [Watcher: The triggered\_time is 2 hours behind the current time](https://discuss.elastic.co/t/watcher-the-triggered-time-is-2-hours-behind-the-current-time/177046)

<div class="topic-metadata">

**Author:** [@michael.spaltenstein](https://discuss.elastic.co/u/michael.spaltenstein)\
**Replies:** 1\
**Last updated:** [April 16, 2019, 10:01am UTC](https://discuss.elastic.co/t/watcher-the-triggered-time-is-2-hours-behind-the-current-time/177046 "2019-04-16T10:01:51Z")

</div>

For Example: Execution Output: { "watch\_id": "49b060ac-cf03-413d-b1d1-bc6b6d2ac2b7", "node": "Ukh-HUj2Ts28O82RcpmdiQ", "state": "execution\_not\_needed", "user": "user-1", "status": { "state": { "…

---

## [Search for documents with 50% exactly matched phrases in string using Elasticsearch](https://discuss.elastic.co/t/search-for-documents-with-50-exactly-matched-phrases-in-string-using-elasticsearch/177047)

<div class="topic-metadata">

**Author:** [@Paddy\_Mahadeva](https://discuss.elastic.co/u/Paddy_Mahadeva)\
**Replies:** 0\
**Last updated:** [April 16, 2019, 9:45am UTC](https://discuss.elastic.co/t/search-for-documents-with-50-exactly-matched-phrases-in-string-using-elasticsearch/177047 "2019-04-16T09:45:41Z")

</div>

Hi, I have a use case where I need to find all documents with a 100% phrase match of at least 50% of my input phrases Eg: my text situation is under control now, system pledges to rebuild Sentences am trying to match s…

---

## [Insert Shapefile or large Geojson file in elasticsearch](https://discuss.elastic.co/t/insert-shapefile-or-large-geojson-file-in-elasticsearch/175977)

<div class="topic-metadata">

**Author:** [@Rahul\_Tandon](https://discuss.elastic.co/u/Rahul_Tandon)\
**Replies:** 12\
**Last updated:** [April 16, 2019, 9:30am UTC](https://discuss.elastic.co/t/insert-shapefile-or-large-geojson-file-in-elasticsearch/175977 "2019-04-16T09:30:40Z")

</div>

I have a shapefile with 50 geometries that i want to insert into elasticsearch index to view it on kibana.I tried to converted it into geojson and try to insert because geomeries are 50 and number of points in each geom…

---

## [\_forcemerge increase actual doc count, is any chance to duplicate](https://discuss.elastic.co/t/forcemerge-increase-actual-doc-count-is-any-chance-to-duplicate/176826)

<div class="topic-metadata">

**Author:** [@Dilip\_Kumar](https://discuss.elastic.co/u/Dilip_Kumar)\
**Replies:** 2\
**Last updated:** [April 16, 2019, 9:22am UTC](https://discuss.elastic.co/t/forcemerge-increase-actual-doc-count-is-any-chance-to-duplicate/176826 "2019-04-16T09:22:01Z")

</div>

green open myindex ehZT7XVTTRt-aQq5dDukignw 5 1 117766002 2793806 25.7gb 12.8gb I have 2 nodes cluster with default shards(5) I have deleted/updated document that taking extra size on disk, (Count : 2793806) wh…

---

## [QueryStringQueryBuilder.lowercaseExpandedTerms() deprecated in elastic search v5.6](https://discuss.elastic.co/t/querystringquerybuilder-lowercaseexpandedterms-deprecated-in-elastic-search-v5-6/176892)

<div class="topic-metadata">

**Author:** [@utkarsh](https://discuss.elastic.co/u/utkarsh)\
**Replies:** 1\
**Last updated:** [April 16, 2019, 9:13am UTC](https://discuss.elastic.co/t/querystringquerybuilder-lowercaseexpandedterms-deprecated-in-elastic-search-v5-6/176892 "2019-04-16T09:13:02Z")

</div>

I am upgrading the elastic search from v2.3.3 to v5.6.2. I am facing the error: Cannot resolve symbol: lowercaseExpanedTerms(boolean). Below is the line of code where the error occurs: queryStringQueryBuilder = valueTy…

---

## [High Level Java Rest Client. Index ( ILS) management](https://discuss.elastic.co/t/high-level-java-rest-client-index-ils-management/177028)

<div class="topic-metadata">

**Author:** [@suikast42](https://discuss.elastic.co/u/suikast42)\
**Replies:** 0\
**Last updated:** [April 16, 2019, 8:37am UTC](https://discuss.elastic.co/t/high-level-java-rest-client-index-ils-management/177028 "2019-04-16T08:37:18Z")

</div>

Hi, is that possilbe to let the rest client calculate the concrete index name based on the index pattern with ILS enabled and disabled option ? IndexRequest indexRequest = new IndexRequest("awesomeidx") -\>shoul…

---

## [Expunge deleted documents / reindex to same index name](https://discuss.elastic.co/t/expunge-deleted-documents-reindex-to-same-index-name/177027)

<div class="topic-metadata">

**Author:** [@AndreKR](https://discuss.elastic.co/u/AndreKR)\
**Replies:** 0\
**Last updated:** [April 16, 2019, 8:33am UTC](https://discuss.elastic.co/t/expunge-deleted-documents-reindex-to-same-index-name/177027 "2019-04-16T08:33:56Z")

</div>

I have a bunch of time-series indices (one per week) with a lot of deleted documents (because older data gets aggregated): According to this I should not force-merge them when I expect there to be writes (more aggrega…

---

## [Elasticsearch 7 cluster setup with 3 nodes ---](https://discuss.elastic.co/t/elasticsearch-7-cluster-setup-with-3-nodes/177016)

<div class="topic-metadata">

**Author:** [@hari.v](https://discuss.elastic.co/u/hari.v)\
**Replies:** 5\
**Last updated:** [April 16, 2019, 8:28am UTC](https://discuss.elastic.co/t/elasticsearch-7-cluster-setup-with-3-nodes/177016 "2019-04-16T08:28:55Z")

</div>

hi, i tried to setup elasticsearch 7 setup with 3 nodes in rhel7. my config files: node1 cluster.name: master-node node.name: elk-tst1 node.master: true node.data: false path.data: /var/lib/elasticsearch path.lo…

---

## [Shrink, Reindex with wildcard? Replumbing the lot!](https://discuss.elastic.co/t/shrink-reindex-with-wildcard-replumbing-the-lot/175607)

<div class="topic-metadata">

**Author:** [@gavin.mcmenemy](https://discuss.elastic.co/u/gavin.mcmenemy)\
**Replies:** 2\
**Last updated:** [April 16, 2019, 8:27am UTC](https://discuss.elastic.co/t/shrink-reindex-with-wildcard-replumbing-the-lot/175607 "2019-04-16T08:27:36Z")

</div>

Hi All, Need a bit of advice. We've been testing ElasticSearch as a tool for aggregating and analysing Windows logs. Nothing controversial about that. We have a single node implementation in our Dev environment. I'm go…

[Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1328)

[Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1330)
