# Elasticsearch

**URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1345

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 1346

---

## [Buidling Elastic Search queries dynamically using the Java API](https://discuss.elastic.co/t/buidling-elastic-search-queries-dynamically-using-the-java-api/175111)

<div class="topic-metadata">

**Author:** [@titulum](https://discuss.elastic.co/u/titulum)\
**Replies:** 0\
**Last updated:** [April 3, 2019, 7:06am UTC](https://discuss.elastic.co/t/buidling-elastic-search-queries-dynamically-using-the-java-api/175111 "2019-04-03T07:06:29Z")

</div>

Imagine the following documents: \[ { "name" : "deepgreen", "colors" : \[ { "color" : "green" }, { "color" : "black" } \] }, { "name" : "lightblue", "colors" : \[ { "color" : "blue" }, { "color" : …

---

## [I want to know the pros and cons](https://discuss.elastic.co/t/i-want-to-know-the-pros-and-cons/175026)

<div class="topic-metadata">

**Author:** [@EddyKim](https://discuss.elastic.co/u/EddyKim)\
**Replies:** 4\
**Last updated:** [April 3, 2019, 6:31am UTC](https://discuss.elastic.co/t/i-want-to-know-the-pros-and-cons/175026 "2019-04-03T06:31:30Z")

</div>

Hi, my name is Eddy Kim. I'm not good at English. Please look at this. We're going to build our own ElasticSearch infrastructure, and we're going to buy a server soon. Our systems are not big data, but indexing perfor…

---

## [Elasticsearch | Max\_Expansions and copy\_to field in Multi\_Match query](https://discuss.elastic.co/t/elasticsearch-max-expansions-and-copy-to-field-in-multi-match-query/174496)

<div class="topic-metadata">

**Author:** [@pranav24](https://discuss.elastic.co/u/pranav24)\
**Replies:** 2\
**Last updated:** [April 3, 2019, 6:08am UTC](https://discuss.elastic.co/t/elasticsearch-max-expansions-and-copy-to-field-in-multi-match-query/174496 "2019-04-03T06:08:46Z")

</div>

Hi, I am finding few issues with max\_expansions. Moreover there is limited information over this. I have created two indices. Both of them contains a Copy\_to field. The name given to both of it is same. I have over 100…

---

## [ES, MongoDB and performance](https://discuss.elastic.co/t/es-mongodb-and-performance/174935)

<div class="topic-metadata">

**Author:** [@mushishi](https://discuss.elastic.co/u/mushishi)\
**Replies:** 3\
**Last updated:** [April 3, 2019, 5:41am UTC](https://discuss.elastic.co/t/es-mongodb-and-performance/174935 "2019-04-03T05:41:45Z")

</div>

Hi, I have near 1 billion documents in MongoDB instance and they're nearly similar so I'm storing them in a single collection. I'm using mongo-connector to import this collection to ES. Each document has a name field (s…

---

## [Visualize button is missing on hostname](https://discuss.elastic.co/t/visualize-button-is-missing-on-hostname/174893)

<div class="topic-metadata">

**Author:** [@Lee\_Weng\_Sheng](https://discuss.elastic.co/u/Lee_Weng_Sheng)\
**Replies:** 4\
**Last updated:** [April 2, 2019, 5:31am UTC](https://discuss.elastic.co/t/visualize-button-is-missing-on-hostname/174893 "2019-04-02T05:31:36Z")

</div>

I'd like to see a list of servers that had x software installed, but can't find the visualize button, what's the best way to generate a report of list of servers that had x software installed?

---

## [\[http.publish\_host\] was printed as \[ip:port\] instead of \[hostname/ip:port\]](https://discuss.elastic.co/t/http-publish-host-was-printed-as-ip-port-instead-of-hostname-ip-port/170820)

<div class="topic-metadata">

**Author:** [@Alsheh](https://discuss.elastic.co/u/Alsheh)\
**Replies:** 7\
**Last updated:** [April 3, 2019, 1:22am UTC](https://discuss.elastic.co/t/http-publish-host-was-printed-as-ip-port-instead-of-hostname-ip-port/170820 "2019-04-03T01:22:04Z")

</div>

Hello, ES, periodically, emitting the following log: \[2019-03-05T04:17:38,592\]\[WARN \]\[o.e.d.h.HttpInfo \] \[es-node-01\] \[http.publish\_host\] was printed as \[ip:port\] instead of \[hostname/ip:port\]. This format is d…

---

## [How many master node will be active](https://discuss.elastic.co/t/how-many-master-node-will-be-active/174998)

<div class="topic-metadata">

**Author:** [@shivawww](https://discuss.elastic.co/u/shivawww)\
**Replies:** 2\
**Last updated:** [April 3, 2019, 1:05am UTC](https://discuss.elastic.co/t/how-many-master-node-will-be-active/174998 "2019-04-03T01:05:27Z")

</div>

Suppose I have a 3 master node in a cluster how many master node will be active. Let us say I have below 3 master node running in 9200 port on 3 different machine master-node01 master-node01 master-noode3 then will …

---

## [LDAP realm caching](https://discuss.elastic.co/t/ldap-realm-caching/174989)

<div class="topic-metadata">

**Author:** [@JamesNotJamez](https://discuss.elastic.co/u/JamesNotJamez)\
**Replies:** 1\
**Last updated:** [April 3, 2019, 12:47am UTC](https://discuss.elastic.co/t/ldap-realm-caching/174989 "2019-04-03T00:47:37Z")

</div>

Is the ldap realm setting cache.ttl for Authorization, Authentication or both? We are currently seeing Elasticsearch doing 15000 searches an hour to our Ldap server. We have not explicitly set the field value ourselves…

---

## [Search (autocomplete) suggestions on multi valued fields like tags with filters](https://discuss.elastic.co/t/search-autocomplete-suggestions-on-multi-valued-fields-like-tags-with-filters/174602)

<div class="topic-metadata">

**Author:** [@Srinivasan\_Ramaswamy](https://discuss.elastic.co/u/Srinivasan_Ramaswamy)\
**Replies:** 1\
**Last updated:** [April 3, 2019, 12:47am UTC](https://discuss.elastic.co/t/search-autocomplete-suggestions-on-multi-valued-fields-like-tags-with-filters/174602 "2019-04-03T00:47:33Z")

</div>

I have an use case where I have bunch of images and i have multiple tags associated with each image. I have few attributes that are associated with each image and I would like to filter the suggestions based on few of th…

---

## [How to use ESIntegTestCase in elasticsearch 6.6.1](https://discuss.elastic.co/t/how-to-use-esintegtestcase-in-elasticsearch-6-6-1/174646)

<div class="topic-metadata">

**Author:** [@EliuFlorez](https://discuss.elastic.co/u/EliuFlorez)\
**Replies:** 8\
**Last updated:** [April 3, 2019, 12:27am UTC](https://discuss.elastic.co/t/how-to-use-esintegtestcase-in-elasticsearch-6-6-1/174646 "2019-04-03T00:27:52Z")

</div>

Hi, When I run the source code: import org.elasticsearch.common.settings.Settings; import org.elasticsearch.plugins.Plugin; import org.elasticsearch.test.ESIntegTestCase; import org.elasticsearch.test.ESIntegTestCase.C…

---

## [ODBC connection to elastic](https://discuss.elastic.co/t/odbc-connection-to-elastic/174043)

<div class="topic-metadata">

**Author:** [@sverma](https://discuss.elastic.co/u/sverma)\
**Replies:** 14\
**Last updated:** [April 3, 2019, 12:27am UTC](https://discuss.elastic.co/t/odbc-connection-to-elastic/174043 "2019-04-03T00:27:25Z")

</div>

Hi, installed version details : logstash-6.6.1-1.noarch elasticsearch-6.7.0-1.noarch kibana-6.6.1-1.x86\_64 I am trying to configure a ODBC connection to my elastic node but I get error when setting up the connection…

---

## [EADDRINUSE error="Address already in use - bind(2) for \\"0.0.0.0\\" port 5044"](https://discuss.elastic.co/t/eaddrinuse-error-address-already-in-use-bind-2-for-0-0-0-0-port-5044/175059)

<div class="topic-metadata">

**Author:** [@Phillip\_Groven](https://discuss.elastic.co/u/Phillip_Groven)\
**Replies:** 3\
**Last updated:** [April 2, 2019, 11:28pm UTC](https://discuss.elastic.co/t/eaddrinuse-error-address-already-in-use-bind-2-for-0-0-0-0-port-5044/175059 "2019-04-02T23:28:43Z")

</div>

I am setting up an EFK cluster and filebeats are not being received I believe the error is due to the following EADDRINUSE error="Address already in use - bind(2) for "0.0.0.0" port 5044" when elasticserch and td-agent …

---

## [Upload tickets data from Zendesk to elasticsearch](https://discuss.elastic.co/t/upload-tickets-data-from-zendesk-to-elasticsearch/174975)

<div class="topic-metadata">

**Author:** [@yaharin\_ben\_ayon](https://discuss.elastic.co/u/yaharin_ben_ayon)\
**Replies:** 0\
**Last updated:** [April 2, 2019, 11:42am UTC](https://discuss.elastic.co/t/upload-tickets-data-from-zendesk-to-elasticsearch/174975 "2019-04-02T11:42:14Z")

</div>

Hey i was wondering if anyone ever tried to upload tickets data from zendesk to elasticsearch? Thank you.

---

## [Update / update\_by\_query using join types](https://discuss.elastic.co/t/update-update-by-query-using-join-types/175072)

<div class="topic-metadata">

**Author:** [@joropito](https://discuss.elastic.co/u/joropito)\
**Replies:** 0\
**Last updated:** [April 2, 2019, 9:01pm UTC](https://discuss.elastic.co/t/update-update-by-query-using-join-types/175072 "2019-04-02T21:01:41Z")

</div>

Hi everyone! I started working with join data types and I wonder if there's a way to do an update of all related documents. For example, update\_by\_query with a has\_child or has\_parent query I want to update every docum…

---

## [How to choose size parameter when using partitioning](https://discuss.elastic.co/t/how-to-choose-size-parameter-when-using-partitioning/175031)

<div class="topic-metadata">

**Author:** [@Anindya\_Roy](https://discuss.elastic.co/u/Anindya_Roy)\
**Replies:** 2\
**Last updated:** [April 2, 2019, 8:36pm UTC](https://discuss.elastic.co/t/how-to-choose-size-parameter-when-using-partitioning/175031 "2019-04-02T20:36:37Z")

</div>

Hello, How should I choose the size parameter when using partitioning query ? E.g Suppose the aggregation query result returns 60K hits and say I use num\_partitions = 20, then is it correct to expect the total result …

---

## [URI query not matching all fields](https://discuss.elastic.co/t/uri-query-not-matching-all-fields/174523)

<div class="topic-metadata">

**Author:** [@OrangeDog](https://discuss.elastic.co/u/OrangeDog)\
**Replies:** 5\
**Last updated:** [April 2, 2019, 6:29pm UTC](https://discuss.elastic.co/t/uri-query-not-matching-all-fields/174523 "2019-04-02T18:29:09Z")

</div>

This query is returning documents that don't match all the listed fields (they don't even have these fields). type.keyword:"rsyslog" AND severity.keyword:("alert" OR "err" OR "crit") AND @timestamp:\[now-10m TO now\] Enc…

---

## [Hardware requirement for Elastic Search Installation](https://discuss.elastic.co/t/hardware-requirement-for-elastic-search-installation/175041)

<div class="topic-metadata">

**Author:** [@syedsfayaz](https://discuss.elastic.co/u/syedsfayaz)\
**Replies:** 0\
**Last updated:** [April 2, 2019, 5:50pm UTC](https://discuss.elastic.co/t/hardware-requirement-for-elastic-search-installation/175041 "2019-04-02T17:50:07Z")

</div>

Hi I have installed Elastic Search/Kibana on a single medium sized server now for testing purposes. I have some roughly 100 Linux/Windows Server where am planning to install Metric and File beats which will send data t…

---

## [Get relevance score from aggs bucket](https://discuss.elastic.co/t/get-relevance-score-from-aggs-bucket/174870)

<div class="topic-metadata">

**Author:** [@richbai90](https://discuss.elastic.co/u/richbai90)\
**Replies:** 1\
**Last updated:** [April 2, 2019, 3:20pm UTC](https://discuss.elastic.co/t/get-relevance-score-from-aggs-bucket/174870 "2019-04-02T15:20:52Z")

</div>

Give a query like the one below, how can I get the max relevance score from each bucket? GET /omni\_filters/\_search/ { "aggs" : { "uniqueHits" : { "terms" : { "field" : "command" } …

---

## [Logstash Error: Retrying Failed Action With Response Code 403](https://discuss.elastic.co/t/logstash-error-retrying-failed-action-with-response-code-403/174864)

<div class="topic-metadata">

**Author:** [@DougR](https://discuss.elastic.co/u/DougR)\
**Replies:** 1\
**Last updated:** [April 1, 2019, 8:20pm UTC](https://discuss.elastic.co/t/logstash-error-retrying-failed-action-with-response-code-403/174864 "2019-04-01T20:20:47Z")

</div>

I'm receiving the following error in Logstash: \[2019-04-01T14:43:45,454\]\[INFO \]\[logstash.outputs.elasticsearch\] retrying failed action with response code: 403 ({"type"=\>"cluster\_block\_exception", "reason"=\>"blocked by: …

---

## [Passing null into After(afterKey) with Composite aggregation](https://discuss.elastic.co/t/passing-null-into-after-afterkey-with-composite-aggregation/175022)

<div class="topic-metadata">

**Author:** [@andrei-galkin](https://discuss.elastic.co/u/andrei-galkin)\
**Replies:** 0\
**Last updated:** [April 2, 2019, 2:46pm UTC](https://discuss.elastic.co/t/passing-null-into-after-afterkey-with-composite-aggregation/175022 "2019-04-02T14:46:01Z")

</div>

NEST 6.6 . Is the code equal var r = new AggregationContainerDescriptor\<DormantAccountEntry\>(); r.Composite(compositeName, co =\> co .Source…

---

## [WARN message (Elasticsearch)](https://discuss.elastic.co/t/warn-message-elasticsearch/173975)

<div class="topic-metadata">

**Author:** [@zolthar-z](https://discuss.elastic.co/u/zolthar-z)\
**Replies:** 3\
**Last updated:** [March 27, 2019, 2:46pm UTC](https://discuss.elastic.co/t/warn-message-elasticsearch/173975 "2019-03-27T14:46:06Z")

</div>

Hi Since three days ago I started to received some meesages in the elasticsearch.log file and sometimes my elastic platform freeze and don't load the data, the error Kibana is: "{"statusCode":500,"error":"Internal Serv…

---

## [Save storage with aggregation log](https://discuss.elastic.co/t/save-storage-with-aggregation-log/175019)

<div class="topic-metadata">

**Author:** [@elk2](https://discuss.elastic.co/u/elk2)\
**Replies:** 0\
**Last updated:** [April 2, 2019, 2:27pm UTC](https://discuss.elastic.co/t/save-storage-with-aggregation-log/175019 "2019-04-02T14:27:22Z")

</div>

I have many data stored into elasticsearch but I want only statistics values. Example: 64.242.88.10 - - \[07/Mar/2004:16:05:49 -0800\] "GET /twiki/bin/edit/Main/Double\_bounce\_sender?topicparent=Main.ConfigurationVariable…

---

## [Scroll ID is giving empty result for consequent requests](https://discuss.elastic.co/t/scroll-id-is-giving-empty-result-for-consequent-requests/175013)

<div class="topic-metadata">

**Author:** [@srirama](https://discuss.elastic.co/u/srirama)\
**Replies:** 0\
**Last updated:** [April 2, 2019, 1:54pm UTC](https://discuss.elastic.co/t/scroll-id-is-giving-empty-result-for-consequent-requests/175013 "2019-04-02T13:54:07Z")

</div>

In my local ELK server, I am searching the ELK using scrolls, the scroll Id is generated for the initial request. However whenever requested for the next set of records, using the scroll ID generated from the first requ…

---

## [Node won't start up due to dupliate alias/index names](https://discuss.elastic.co/t/node-wont-start-up-due-to-dupliate-alias-index-names/174548)

<div class="topic-metadata">

**Author:** [@Ant](https://discuss.elastic.co/u/Ant)\
**Replies:** 17\
**Last updated:** [April 2, 2019, 1:49pm UTC](https://discuss.elastic.co/t/node-wont-start-up-due-to-dupliate-alias-index-names/174548 "2019-04-02T13:49:55Z")

</div>

I have just added a white list to one of the nodes so I could pull over some data for a feature we have been working on in developement and want to run on the main cluster now but keep all the historic data we gathered f…

---

## [Reaggregate on nested aggregation results using Elasticsearch](https://discuss.elastic.co/t/reaggregate-on-nested-aggregation-results-using-elasticsearch/174842)

<div class="topic-metadata">

**Author:** [@mdeverdelhan](https://discuss.elastic.co/u/mdeverdelhan)\
**Replies:** 1\
**Last updated:** [April 2, 2019, 1:40pm UTC](https://discuss.elastic.co/t/reaggregate-on-nested-aggregation-results-using-elasticsearch/174842 "2019-04-02T13:40:26Z")

</div>

I want to compute some aggregations (using Elasticsearch 6.2) on products that have criteria. All the criteria are flattened and I want to reuse some aggregation results to reaggregate by a specific criterion. Here is m…

---

## [Retrieving all log events sorted by timestamp](https://discuss.elastic.co/t/retrieving-all-log-events-sorted-by-timestamp/173932)

<div class="topic-metadata">

**Author:** [@oskargranlund](https://discuss.elastic.co/u/oskargranlund)\
**Replies:** 5\
**Last updated:** [April 2, 2019, 12:20pm UTC](https://discuss.elastic.co/t/retrieving-all-log-events-sorted-by-timestamp/173932 "2019-04-02T12:20:27Z")

</div>

I'm trying to retrieve all log events from an index by using python elasticsearch interface. Currently I use this line of code in order to execute the query: scan(es, index="filebeat-2019.03.19", scroll="2m", query={"q…

---

## [ElasticSearch deployment is failing in Azure from Marketplace](https://discuss.elastic.co/t/elasticsearch-deployment-is-failing-in-azure-from-marketplace/174384)

<div class="topic-metadata">

**Author:** [@kyogesh91](https://discuss.elastic.co/u/kyogesh91)\
**Replies:** 14\
**Last updated:** [April 2, 2019, 12:13pm UTC](https://discuss.elastic.co/t/elasticsearch-deployment-is-failing-in-azure-from-marketplace/174384 "2019-04-02T12:13:04Z")

</div>

ElasticSearch deployment is failing in Microsoft Azure Marketplace. Snippet of the error. https://pastebin.com/uYpTce3T Below is the link to files shared by Microsoft Azure Support. https://support.microsoft.com/en-u…

---

## [All data from Elasticspark sql queries returns as null](https://discuss.elastic.co/t/all-data-from-elasticspark-sql-queries-returns-as-null/173560)

<div class="topic-metadata">

**Author:** [@bytemedwb](https://discuss.elastic.co/u/bytemedwb)\
**Replies:** 2\
**Last updated:** [April 2, 2019, 11:33am UTC](https://discuss.elastic.co/t/all-data-from-elasticspark-sql-queries-returns-as-null/173560 "2019-04-02T11:33:23Z")

</div>

So having gotten further by doing a build of the 8.0.0-SNAPSHOT from source, I now have a new issue. I am able to create data frames and print schemas. However, every query returns null for every field. Here is my co…

---

## [Is Hadoop the right solution for distributed computation with ES?](https://discuss.elastic.co/t/is-hadoop-the-right-solution-for-distributed-computation-with-es/174971)

<div class="topic-metadata">

**Author:** [@nicom](https://discuss.elastic.co/u/nicom)\
**Replies:** 0\
**Last updated:** [April 2, 2019, 11:22am UTC](https://discuss.elastic.co/t/is-hadoop-the-right-solution-for-distributed-computation-with-es/174971 "2019-04-02T11:22:40Z")

</div>

I have a elasticsearch cluster (300Go) with 2 nodes (I know.. 3 is min). We have a java program that use the java Rest API to fetch all the data from ES cluster and execute custom clustering algorithms. To avoid netwo…

---

## [How to find size of the document using scripting](https://discuss.elastic.co/t/how-to-find-size-of-the-document-using-scripting/174811)

<div class="topic-metadata">

**Author:** [@Riddhesh](https://discuss.elastic.co/u/Riddhesh)\
**Replies:** 2\
**Last updated:** [April 2, 2019, 11:04am UTC](https://discuss.elastic.co/t/how-to-find-size-of-the-document-using-scripting/174811 "2019-04-02T11:04:51Z")

</div>

I'm using ES 6.3, I want to find size of a document using script. I've tried: "script": "doc.toString().length()" But doc.toString() is classname org.elasticsearch.search.lookup.LeafDocLookup@57b1c349. I know I can e…

[Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1344)

[Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1346)
