# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1335 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1336 --- ## [Painless query for getting contains and substring in a field](https://discuss.elastic.co/t/painless-query-for-getting-contains-and-substring-in-a-field/176415)
**Author:** [@Jravella](https://discuss.elastic.co/u/Jravella)\ **Replies:** 0\ **Last updated:** [April 11, 2019, 1:56pm UTC](https://discuss.elastic.co/t/painless-query-for-getting-contains-and-substring-in-a-field/176415 "2019-04-11T13:56:17Z")
i have field api which has uri like /someapp/api/v4/bdq/rules/334882 requirement to retrieve only v4 from all uri --- ## [SMTP Error - Emailing from Watcher Service](https://discuss.elastic.co/t/smtp-error-emailing-from-watcher-service/174354)
**Author:** [@jreuth200](https://discuss.elastic.co/u/jreuth200)\ **Replies:** 8\ **Last updated:** [April 11, 2019, 1:26pm UTC](https://discuss.elastic.co/t/smtp-error-emailing-from-watcher-service/174354 "2019-04-11T13:26:58Z")
When attempting to send emails using the watcher service, an SMTP error is generated saying that the Client was not authenticated to send anonymous mail and fails. I am trying to send email from our relay service with no… --- ## [One of nodes fails with anonymous\_access\_denied error in audit log](https://discuss.elastic.co/t/one-of-nodes-fails-with-anonymous-access-denied-error-in-audit-log/176259)
**Author:** [@ethanfama](https://discuss.elastic.co/u/ethanfama)\ **Replies:** 2\ **Last updated:** [April 11, 2019, 1:22pm UTC](https://discuss.elastic.co/t/one-of-nodes-fails-with-anonymous-access-denied-error-in-audit-log/176259 "2019-04-11T13:22:04Z")
I have set up a 3-node cluster for Elasticsearch 6.7. When I start it up, two of the master-eligible nodes can communicate just fine, but the third complains with anonymous\_access\_denied events: One of the master nodes … --- ## [Warning: Falling back to java on path. This behavior is deprecated. Specify JAVA\_HOME](https://discuss.elastic.co/t/warning-falling-back-to-java-on-path-this-behavior-is-deprecated-specify-java-home/176001)
**Author:** [@sph18](https://discuss.elastic.co/u/sph18)\ **Replies:** 17\ **Last updated:** [April 11, 2019, 1:02pm UTC](https://discuss.elastic.co/t/warning-falling-back-to-java-on-path-this-behavior-is-deprecated-specify-java-home/176001 "2019-04-11T13:02:55Z")
Hi all ES version: 6.7.1 Host: 18.04 LTS openjdk version "1.8.0\_191" OpenJDK Runtime Environment (build 1.8.0\_191-8u191-b12-2ubuntu0.18.04.1-b12) OpenJDK 64-Bit Server VM (build 25.191-b12, mixed mode) I have thi… --- ## [Elasticsearch - Cannot allocate memory](https://discuss.elastic.co/t/elasticsearch-cannot-allocate-memory/176405)
**Author:** [@Satheesh\_P](https://discuss.elastic.co/u/Satheesh_P)\ **Replies:** 0\ **Last updated:** [April 11, 2019, 12:54pm UTC](https://discuss.elastic.co/t/elasticsearch-cannot-allocate-memory/176405 "2019-04-11T12:54:40Z")
Hi, We have installed elasticsearch as service in Ubuntu 16.0 64 bit (1 CPU, 6 GB RAM) and worked well with default configuration. after few days we felt the elasticsearch response was slow. so we were trying to change… --- ## [Phrase suggester - Don't edit to stopword](https://discuss.elastic.co/t/phrase-suggester-dont-edit-to-stopword/176404)
**Author:** [@bram](https://discuss.elastic.co/u/bram)\ **Replies:** 0\ **Last updated:** [April 11, 2019, 12:51pm UTC](https://discuss.elastic.co/t/phrase-suggester-dont-edit-to-stopword/176404 "2019-04-11T12:51:57Z")
Heya, Is it possible to stop elasticsearch from changing terms into a stopword when using the phrase suggester? I'm not using the stopword filter, because that would turn "a papper" into "papper". While I'm trying to h… --- ## [How to aggregate a deep nested document - built with recursion](https://discuss.elastic.co/t/how-to-aggregate-a-deep-nested-document-built-with-recursion/176286)
**Author:** [@mattb81](https://discuss.elastic.co/u/mattb81)\ **Replies:** 1\ **Last updated:** [April 11, 2019, 12:32pm UTC](https://discuss.elastic.co/t/how-to-aggregate-a-deep-nested-document-built-with-recursion/176286 "2019-04-11T12:32:54Z")
I have a document structure which looks something like { "orderNo": "123O", "tradeNo": "567T", "orderConsideration": 10, "children": \[{ "orderNo": "124O", "tradeNo": "566T", "orderConsideration": 15, "childr… --- ## [REST API for passing initial\_master\_nodes](https://discuss.elastic.co/t/rest-api-for-passing-initial-master-nodes/176395)
**Author:** [@Bukhtawar\_Khan](https://discuss.elastic.co/u/Bukhtawar_Khan)\ **Replies:** 1\ **Last updated:** [April 11, 2019, 12:25pm UTC](https://discuss.elastic.co/t/rest-api-for-passing-initial-master-nodes/176395 "2019-04-11T12:25:03Z")
There are cases where we wouldn't know the node IPs upfront or while launching instances we might just pass the same configuration to all the nodes without identifying which node represents which node id. As a result sho… --- ## [Primary shards not to be moved](https://discuss.elastic.co/t/primary-shards-not-to-be-moved/176397)
**Author:** [@Rodrigo\_Bernardo](https://discuss.elastic.co/u/Rodrigo_Bernardo)\ **Replies:** 1\ **Last updated:** [April 11, 2019, 12:11pm UTC](https://discuss.elastic.co/t/primary-shards-not-to-be-moved/176397 "2019-04-11T12:11:17Z")
A new node joins an existing cluster. automatic balancing kicks in. I would like primary shards to not be moved this new server. How would you do that? Thanks, Rodrigo. --- ## [Determine Node is safe to Terminate](https://discuss.elastic.co/t/determine-node-is-safe-to-terminate/176230)
**Author:** [@tebriel](https://discuss.elastic.co/u/tebriel)\ **Replies:** 4\ **Last updated:** [April 11, 2019, 12:01pm UTC](https://discuss.elastic.co/t/determine-node-is-safe-to-terminate/176230 "2019-04-11T12:01:45Z")
I'm trying to determine if a node is safe to be terminated after using a routing exclusion. Is the only way to do this to traverse the cluster state and be sure it doesn't have any shards left? I see that the Monitoring … --- ## [How to get last 90 minutes data in elasticsearch rest url](https://discuss.elastic.co/t/how-to-get-last-90-minutes-data-in-elasticsearch-rest-url/176203)
**Author:** [@Gnanendra](https://discuss.elastic.co/u/Gnanendra)\ **Replies:** 1\ **Last updated:** [April 11, 2019, 11:18am UTC](https://discuss.elastic.co/t/how-to-get-last-90-minutes-data-in-elasticsearch-rest-url/176203 "2019-04-11T11:18:43Z")
Hi, i am using sql rest url and query last 90 minutes data but it's not working. see below rest url: POST .monitoring-es-6-\*/\_search { "\_source": \["timestamp", "index\_stats.index", "index\_stats.primaries.indexing.i… --- ## [When XPACK Trial Period expires, What happens on security?](https://discuss.elastic.co/t/when-xpack-trial-period-expires-what-happens-on-security/176325)
**Author:** [@moni15moni](https://discuss.elastic.co/u/moni15moni)\ **Replies:** 1\ **Last updated:** [April 11, 2019, 10:33am UTC](https://discuss.elastic.co/t/when-xpack-trial-period-expires-what-happens-on-security/176325 "2019-04-11T10:33:01Z")
Hi I have installed the XPack trial license and started using security features for indexing data with authentication with username:password, Currently my trial expires after 30 days, With warning messages still i am a… --- ## [Duplicate in Dataset while reading from elasticsearch index with SPARK](https://discuss.elastic.co/t/duplicate-in-dataset-while-reading-from-elasticsearch-index-with-spark/176379)
**Author:** [@pverma0312](https://discuss.elastic.co/u/pverma0312)\ **Replies:** 0\ **Last updated:** [April 11, 2019, 10:32am UTC](https://discuss.elastic.co/t/duplicate-in-dataset-while-reading-from-elasticsearch-index-with-spark/176379 "2019-04-11T10:32:57Z")
Hi, I am trying to read an unstructured index from es and loading it to RDD of SPARK, sometimes in RDD the complete data is getting duplicated, did somebody faced the similar issue, any recommendation. Thanks, Prashan… --- ## [Question regarding \_flush/synced output](https://discuss.elastic.co/t/question-regarding-flush-synced-output/176378)
**Author:** [@raulk89](https://discuss.elastic.co/u/raulk89)\ **Replies:** 1\ **Last updated:** [April 11, 2019, 10:27am UTC](https://discuss.elastic.co/t/question-regarding-flush-synced-output/176378 "2019-04-11T10:27:54Z")
Hi Elastic 6.7.1 Centos7 At the moment, this command output is following: curl -sXPOST hostname':9200/\_flush/synced?pretty'\` { "\_shards" : { "total" : 144, "successful" : 144, "failed" : 0 }, ".monitoring-es-… --- ## [Query Terms = NULL or \[\]](https://discuss.elastic.co/t/query-terms-null-or/176302)
**Author:** [@EliuFlorez](https://discuss.elastic.co/u/EliuFlorez)\ **Replies:** 1\ **Last updated:** [April 11, 2019, 10:17am UTC](https://discuss.elastic.co/t/query-terms-null-or/176302 "2019-04-11T10:17:03Z")
Hi guys, you know I have a problem with a query in "Terms" where the query is: GET /user/\_search { "query": { "terms" : { "user" : \["user-1"\] } } } something so simple but it does not return anything… --- ## [CCR - Remove follow\_stats and License fetching problem](https://discuss.elastic.co/t/ccr-remove-follow-stats-and-license-fetching-problem/175389)
**Author:** [@kley](https://discuss.elastic.co/u/kley)\ **Replies:** 7\ **Last updated:** [April 11, 2019, 9:46am UTC](https://discuss.elastic.co/t/ccr-remove-follow-stats-and-license-fetching-problem/175389 "2019-04-11T09:46:54Z")
Hi! I'm playing around with the new cross cluster replication feature and ran into some issues. Firstly, it worked like a charm, data got replicated and everything was good. After that, I decided to put load on the lead… --- ## [Can't create an index when fields are with dots and names are similar](https://discuss.elastic.co/t/cant-create-an-index-when-fields-are-with-dots-and-names-are-similar/176345)
**Author:** [@nithael](https://discuss.elastic.co/u/nithael)\ **Replies:** 1\ **Last updated:** [April 11, 2019, 9:23am UTC](https://discuss.elastic.co/t/cant-create-an-index-when-fields-are-with-dots-and-names-are-similar/176345 "2019-04-11T09:23:10Z")
Hi team, I'm facing the below error while creating an index (Elastic 6.0.2). My two properties names are quite similar (one contains the other) and both contains dots. Looks like Elastic is doing some kind of splitting … --- ## [Elasticsearch sometime stopped](https://discuss.elastic.co/t/elasticsearch-sometime-stopped/176357)
**Author:** [@DavidPham](https://discuss.elastic.co/u/DavidPham)\ **Replies:** 2\ **Last updated:** [April 11, 2019, 9:11am UTC](https://discuss.elastic.co/t/elasticsearch-sometime-stopped/176357 "2019-04-11T09:11:54Z")
I run Elasticsearch on Centos 7 and java 1.8.0\_201-b09, but sometime ElasticSearch stopped. I don't know why although i spend time to google. I get error log like this: Apr 11 14:30:28 elasticsearch\[3938\]: \[2019-04-11… --- ## [Concurrent running jobs histogram query](https://discuss.elastic.co/t/concurrent-running-jobs-histogram-query/176362)
**Author:** [@photonstudio](https://discuss.elastic.co/u/photonstudio)\ **Replies:** 0\ **Last updated:** [April 11, 2019, 9:09am UTC](https://discuss.elastic.co/t/concurrent-running-jobs-histogram-query/176362 "2019-04-11T09:09:56Z")
Hi all, I have a data source a few million jobs. As attributes they have start\_time, end\_time and id. Jobs have random run times...some are still running. So a short example could be this: \[ {id: 1, start\_time: "… --- ## [What will be the best way to get the relative score of specific bool clauses on the hits?](https://discuss.elastic.co/t/what-will-be-the-best-way-to-get-the-relative-score-of-specific-bool-clauses-on-the-hits/176361)
**Author:** [@sy1992](https://discuss.elastic.co/u/sy1992)\ **Replies:** 0\ **Last updated:** [April 11, 2019, 9:08am UTC](https://discuss.elastic.co/t/what-will-be-the-best-way-to-get-the-relative-score-of-specific-bool-clauses-on-the-hits/176361 "2019-04-11T09:08:33Z")
Hi! I'm using Elasticsearch 6.2 and have a compound search query that is generated from list of user's items. To explain it short, the goal is to search for items that are similar to those of the specific user. Now I ha… --- ## [Elastic Common Schema - ECS records](https://discuss.elastic.co/t/elastic-common-schema-ecs-records/176289)
**Author:** [@mkesiraju](https://discuss.elastic.co/u/mkesiraju)\ **Replies:** 0\ **Last updated:** [April 10, 2019, 7:57pm UTC](https://discuss.elastic.co/t/elastic-common-schema-ecs-records/176289 "2019-04-10T19:57:43Z")
I am new to ElasticSearch. I will need to use Elastic Common Schema with multiple records. What is the quick way to load multiple records to ElasticSearch in ECS format? How do I use Logstash to load Elastic Search rec… --- ## [Lookup during query time](https://discuss.elastic.co/t/lookup-during-query-time/176190)
**Author:** [@ravitandur](https://discuss.elastic.co/u/ravitandur)\ **Replies:** 3\ **Last updated:** [April 10, 2019, 3:25pm UTC](https://discuss.elastic.co/t/lookup-during-query-time/176190 "2019-04-10T15:25:01Z")
In Splunk we can do the lookup during the query time Example: lookup sn\_instances ip AS ip, node AS port OUTPUTNEW name AS nodename Is it possible to something similar in elastic? I know Logstash filters \[csv, jdbc, … --- ## [Can elasticsearch do GROUP BY multi fields and ORDER BY count?](https://discuss.elastic.co/t/can-elasticsearch-do-group-by-multi-fields-and-order-by-count/176128)
**Author:** [@rookie1](https://discuss.elastic.co/u/rookie1)\ **Replies:** 2\ **Last updated:** [April 11, 2019, 7:16am UTC](https://discuss.elastic.co/t/can-elasticsearch-do-group-by-multi-fields-and-order-by-count/176128 "2019-04-11T07:16:40Z")
In SQL I would do it possibly like this: SELECT field1,field2, count(\*) as cnt FROM table GROUP BY field1,field2 ORDER BY cnt DESC; Is aggregate query like that possible with ES? --- ## [How to Query last 90 minutes records in elasticsearch sql query](https://discuss.elastic.co/t/how-to-query-last-90-minutes-records-in-elasticsearch-sql-query/176180)
**Author:** [@Gnanendra](https://discuss.elastic.co/u/Gnanendra)\ **Replies:** 1\ **Last updated:** [April 11, 2019, 7:03am UTC](https://discuss.elastic.co/t/how-to-query-last-90-minutes-records-in-elasticsearch-sql-query/176180 "2019-04-11T07:03:18Z")
Hi, how to query and get last 90 minutes data using elasticsearch sql query. now i am running below command please modified this one: select index\_stats.index, index\_stats.primaries.indexing.index\_total, index\_stats.p… --- ## [How to Capture STDOUT for esrally?](https://discuss.elastic.co/t/how-to-capture-stdout-for-esrally/175942)
**Author:** [@rocksnslopes](https://discuss.elastic.co/u/rocksnslopes)\ **Replies:** 3\ **Last updated:** [April 11, 2019, 6:16am UTC](https://discuss.elastic.co/t/how-to-capture-stdout-for-esrally/175942 "2019-04-11T06:16:17Z")
Attempting to run esrally commands as a Jenkins job using a docker container. I simply want to see the output printed out in the Jenkins console. For simple commands like "esrally --version" or "esrally --help" this wo… --- ## [Elasticsearch Query Monitoring](https://discuss.elastic.co/t/elasticsearch-query-monitoring/175584)
**Author:** [@Vikash\_Kumar1](https://discuss.elastic.co/u/Vikash_Kumar1)\ **Replies:** 3\ **Last updated:** [April 11, 2019, 6:10am UTC](https://discuss.elastic.co/t/elasticsearch-query-monitoring/175584 "2019-04-11T06:10:54Z")
Hi All, I am using elasticsearch and looking for a way to get all the queries which are getting executed in the elasticsearch. Basically I want to log all the queries. I read that one way is that we can decrease the th… --- ## [Elasticsearch 6.7 not working](https://discuss.elastic.co/t/elasticsearch-6-7-not-working/175583)
**Author:** [@Vikash\_Singh1](https://discuss.elastic.co/u/Vikash_Singh1)\ **Replies:** 5\ **Last updated:** [April 11, 2019, 5:48am UTC](https://discuss.elastic.co/t/elasticsearch-6-7-not-working/175583 "2019-04-11T05:48:32Z")
I've installed elasticsearch 6.7 on centos 7, but it wasn't working. I was getting error saying couldn't file startup file. --- ## [Pick latest child records of each parent and aggregate data](https://discuss.elastic.co/t/pick-latest-child-records-of-each-parent-and-aggregate-data/172227)
**Author:** [@r.singh](https://discuss.elastic.co/u/r.singh)\ **Replies:** 6\ **Last updated:** [April 11, 2019, 5:32am UTC](https://discuss.elastic.co/t/pick-latest-child-records-of-each-parent-and-aggregate-data/172227 "2019-04-11T05:32:01Z")
Hi , I have the following problem Lets say I have a parent called parent-1 which has childs child-1(version:1,action:NOACTION),child-2(version:2,action:REVOKED) and child-3(version:3,action:CERTIFIED). Child 3 is the l… --- ## [Perfect way to sync mongodb to elasticsearch in realtime](https://discuss.elastic.co/t/perfect-way-to-sync-mongodb-to-elasticsearch-in-realtime/176317)
**Author:** [@Sathish\_Velmurugan](https://discuss.elastic.co/u/Sathish_Velmurugan)\ **Replies:** 0\ **Last updated:** [April 11, 2019, 5:11am UTC](https://discuss.elastic.co/t/perfect-way-to-sync-mongodb-to-elasticsearch-in-realtime/176317 "2019-04-11T05:11:51Z")
Hello, We have using mongodb as a primary database for our application. For full text search mongo db is not good compared to elasticsearch. So we are using eleasticsearch for full text search with the help of mongo-con… --- ## [Curator timestring](https://discuss.elastic.co/t/curator-timestring/176131)
**Author:** [@iQIYI](https://discuss.elastic.co/u/iQIYI)\ **Replies:** 4\ **Last updated:** [April 11, 2019, 1:23am UTC](https://discuss.elastic.co/t/curator-timestring/176131 "2019-04-11T01:23:05Z")
Hi, I create a curator action file with 2 actions, and each of actions will execute for a long time. The first action create snapshot and 2nd actrion allocate the specified indices to the warm nodes. If the 1st action … [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1334) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1336)