# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1355 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1356 --- ## [Single field with multiple values](https://discuss.elastic.co/t/single-field-with-multiple-values/172967)
**Author:** [@santharam](https://discuss.elastic.co/u/santharam)\ **Replies:** 9\ **Last updated:** [March 25, 2019, 10:20am UTC](https://discuss.elastic.co/t/single-field-with-multiple-values/172967 "2019-03-25T10:20:43Z")
Hi all How to write single field with multiple value in nested query. example : node.name \["a","b"\] "nested" : { "query" : { "bool" : { "must" : \[ { "match" : { "services.code" : { "query" : "bbbbbbbb", "opera… --- ## [Add inner field and update documents](https://discuss.elastic.co/t/add-inner-field-and-update-documents/173712)
**Author:** [@Piechut](https://discuss.elastic.co/u/Piechut)\ **Replies:** 0\ **Last updated:** [March 25, 2019, 9:51am UTC](https://discuss.elastic.co/t/add-inner-field-and-update-documents/173712 "2019-03-25T09:51:25Z")
Hello everyone! I changed mapping by adding 'string' inner field of 'text' type to already existing 'amount' field of a 'double' type: "amount": { "type": "double", "fields": { "string": { "type": "text" - new inne… --- ## [Firewall port](https://discuss.elastic.co/t/firewall-port/172702)
**Author:** [@junhyuk](https://discuss.elastic.co/u/junhyuk)\ **Replies:** 14\ **Last updated:** [March 25, 2019, 9:41am UTC](https://discuss.elastic.co/t/firewall-port/172702 "2019-03-25T09:41:40Z")
Hi there, I have a question, It is about firewall. I have to open port firewall to test elasticsearch on my server. To open port need some roles, It is starting IP/port , destination IP/port So I think both starting … --- ## [Docker-compose with multi-node setup does not detect the second node](https://discuss.elastic.co/t/docker-compose-with-multi-node-setup-does-not-detect-the-second-node/173685)
**Author:** [@blueren](https://discuss.elastic.co/u/blueren)\ **Replies:** 1\ **Last updated:** [March 25, 2019, 9:04am UTC](https://discuss.elastic.co/t/docker-compose-with-multi-node-setup-does-not-detect-the-second-node/173685 "2019-03-25T09:04:36Z")
I'm attempting to run two ES nodes from a single server. I'm trying to get an understanding of how replica sets etc work - specific to it helping out in terms of searching. Currently I have some data on my first ES inst… --- ## [Why not use bloom filter in es for search?](https://discuss.elastic.co/t/why-not-use-bloom-filter-in-es-for-search/173686)
**Author:** [@zcx](https://discuss.elastic.co/u/zcx)\ **Replies:** 5\ **Last updated:** [March 25, 2019, 8:58am UTC](https://discuss.elastic.co/t/why-not-use-bloom-filter-in-es-for-search/173686 "2019-03-25T08:58:39Z")
as above. thanks --- ## [JVM heap slowly fills until server becomes unresponsive](https://discuss.elastic.co/t/jvm-heap-slowly-fills-until-server-becomes-unresponsive/173338)
**Author:** [@TomCan](https://discuss.elastic.co/u/TomCan)\ **Replies:** 5\ **Last updated:** [March 25, 2019, 8:35am UTC](https://discuss.elastic.co/t/jvm-heap-slowly-fills-until-server-becomes-unresponsive/173338 "2019-03-25T08:35:32Z")
I'll start off with a brief summary of the setup: Single node, ES 6.4.2, Debian 9 with OpenJDK 1.8.0\_212 +/- 500 indexes, 2500 shards, 12M documents, 3.5 GB data. x-pack monitoring, 60s samples, 7 days retention What… --- ## [Failed to ingest a text file converted into json to elasticsearch](https://discuss.elastic.co/t/failed-to-ingest-a-text-file-converted-into-json-to-elasticsearch/173688)
**Author:** [@Fahad\_Khan](https://discuss.elastic.co/u/Fahad_Khan)\ **Replies:** 0\ **Last updated:** [March 25, 2019, 8:28am UTC](https://discuss.elastic.co/t/failed-to-ingest-a-text-file-converted-into-json-to-elasticsearch/173688 "2019-03-25T08:28:39Z")
Hi everyone! I created a random text file which has ("sfjldsjfjsdjflsjdfljsdlkfjsdjfl") these random text I have a code to parse an eml to json, so I have read that file and parse it and then dump it into elasticsearch u… --- ## [Two unassigned shards as failed to create engine with error no such file exception](https://discuss.elastic.co/t/two-unassigned-shards-as-failed-to-create-engine-with-error-no-such-file-exception/173480)
**Author:** [@piyush1337](https://discuss.elastic.co/u/piyush1337)\ **Replies:** 3\ **Last updated:** [March 25, 2019, 7:53am UTC](https://discuss.elastic.co/t/two-unassigned-shards-as-failed-to-create-engine-with-error-no-such-file-exception/173480 "2019-03-25T07:53:11Z")
Hi, I am getting two shards unassigned and obviously the status is "RED" I ran a cluster explanation API failed shard on node \[6PiZfydPRRi06v\_8oISQaA\]: failed recovery, failure RecoveryFailedException\[\[wazuh-archives-… --- ## [Zendesk connection](https://discuss.elastic.co/t/zendesk-connection/173637)
**Author:** [@yaharin\_ben\_ayon](https://discuss.elastic.co/u/yaharin_ben_ayon)\ **Replies:** 4\ **Last updated:** [March 25, 2019, 7:32am UTC](https://discuss.elastic.co/t/zendesk-connection/173637 "2019-03-25T07:32:48Z")
Hey! Has anyone ever tried connecting Zendesk to ElasticSearch? Thanx. --- ## [ES java invoked oom-killer](https://discuss.elastic.co/t/es-java-invoked-oom-killer/170829)
**Author:** [@essmart](https://discuss.elastic.co/u/essmart)\ **Replies:** 1\ **Last updated:** [March 25, 2019, 6:03am UTC](https://discuss.elastic.co/t/es-java-invoked-oom-killer/170829 "2019-03-25T06:03:56Z")
Hello! Elasticsearch version: 5.2.2 JVM version: 1.8.0\_144-b01 OS version: Ubuntu 16.04.1 LTS Kernel version: 4.10.0-32-generic #36~16.04.1-Ubuntu RAM: 64GB JVM heap min and max settings: 31GB Cluster Elasticsearc… --- ## [Intermittent 503 error with Scroll API](https://discuss.elastic.co/t/intermittent-503-error-with-scroll-api/172199)
**Author:** [@BinarMorker](https://discuss.elastic.co/u/BinarMorker)\ **Replies:** 7\ **Last updated:** [March 23, 2019, 10:27am UTC](https://discuss.elastic.co/t/intermittent-503-error-with-scroll-api/172199 "2019-03-23T10:27:38Z")
Hi, I have built a console app in .Net Core that interfaces with ElasticSearch through NEST. I'm trying to send this command: POST /products\_en-ca\_b2df44e0-2a4e-433e-9ea0-ec8a9e8f9e19/product/\_search?pretty=true&error\_t… --- ## [How to create node certificate for Elasticsearch](https://discuss.elastic.co/t/how-to-create-node-certificate-for-elasticsearch/173658)
**Author:** [@aladine](https://discuss.elastic.co/u/aladine)\ **Replies:** 4\ **Last updated:** [March 25, 2019, 2:11am UTC](https://discuss.elastic.co/t/how-to-create-node-certificate-for-elasticsearch/173658 "2019-03-25T02:11:56Z")
I am using elastic cloud. I have a microservice which connect with elasticsearch cloud with rest api. I want to add SSL to enhance security. From the documentation, one of the first step is to generate Certificate Autho… --- ## [Refresh on index hangs](https://discuss.elastic.co/t/refresh-on-index-hangs/173646)
**Author:** [@Igor\_Yakushin](https://discuss.elastic.co/u/Igor_Yakushin)\ **Replies:** 1\ **Last updated:** [March 24, 2019, 7:34pm UTC](https://discuss.elastic.co/t/refresh-on-index-hangs/173646 "2019-03-24T19:34:32Z")
Hi All, Running refresh on an index sometimes hangs forever and sometimes works (from python, using elasticsearch module): r = requests.post(es\_url+'/' + myindex + '/\_refresh?pretty', auth=(username, password)) print… --- ## [Tips for setting new ES indices and cluster](https://discuss.elastic.co/t/tips-for-setting-new-es-indices-and-cluster/173207)
**Author:** [@ansamHox](https://discuss.elastic.co/u/ansamHox)\ **Replies:** 21\ **Last updated:** [March 24, 2019, 1:23pm UTC](https://discuss.elastic.co/t/tips-for-setting-new-es-indices-and-cluster/173207 "2019-03-24T13:23:45Z")
I'm setting up new ES 6.5.4 in cluster containing 6 data nodes. Each node has 16 CPU and heap 8 GB. Here's the conf: \[root@data01~\]# curl -XGET 'https://localhost:9201/\_cat/nodes?v' ip heap.percent ram.per… --- ## [Multi Search in same context request](https://discuss.elastic.co/t/multi-search-in-same-context-request/173627)
**Author:** [@gerardnorton](https://discuss.elastic.co/u/gerardnorton)\ **Replies:** 0\ **Last updated:** [March 24, 2019, 8:47am UTC](https://discuss.elastic.co/t/multi-search-in-same-context-request/173627 "2019-03-24T08:47:11Z")
Hi How i can use a previous values of query in the same one query context? Query1 ---\> $values $values of "Query1" as parameter of Query2 JOIN THIS QUERIES GET filebeat-/\_search { "\_source": \[ "ip." \], "query": { … --- ## [Query within a specific time window](https://discuss.elastic.co/t/query-within-a-specific-time-window/173628)
**Author:** [@eilon](https://discuss.elastic.co/u/eilon)\ **Replies:** 0\ **Last updated:** [March 24, 2019, 9:11am UTC](https://discuss.elastic.co/t/query-within-a-specific-time-window/173628 "2019-03-24T09:11:25Z")
Hi all, I don't know if it's possible within the DSL query capabilities but would love to get some ideas or answers if it is. I want to write a query that matches two different documents within a time frame of, say, 15… --- ## [What data is being queried when there is a continuous stream of input data?](https://discuss.elastic.co/t/what-data-is-being-queried-when-there-is-a-continuous-stream-of-input-data/173149)
**Author:** [@yishain11](https://discuss.elastic.co/u/yishain11)\ **Replies:** 2\ **Last updated:** [March 24, 2019, 7:31am UTC](https://discuss.elastic.co/t/what-data-is-being-queried-when-there-is-a-continuous-stream-of-input-data/173149 "2019-03-24T07:31:09Z")
Hi, sorry if this is a basic question, but here goes: Lets say I have continuous stream of data being pushed into an elasticsearch index. When I'm sending a query, to what data does the query apply to? If relevant data … --- ## [Document level access control](https://discuss.elastic.co/t/document-level-access-control/171338)
**Author:** [@mattkallo](https://discuss.elastic.co/u/mattkallo)\ **Replies:** 1\ **Last updated:** [March 23, 2019, 5:18pm UTC](https://discuss.elastic.co/t/document-level-access-control/171338 "2019-03-23T17:18:40Z")
Hi, Below is our scenario. I couldn't find how to implement this with using both the data in ES and Mysql. Could any of you pls suggest a solution or give some ideas - Thnx Each of our document in ES equates to a file i… --- ## [Is there any option for highlight to highlight the results in "\_source"?](https://discuss.elastic.co/t/is-there-any-option-for-highlight-to-highlight-the-results-in-source/169890)
**Author:** [@Liron1379](https://discuss.elastic.co/u/Liron1379)\ **Replies:** 2\ **Last updated:** [March 23, 2019, 3:57pm UTC](https://discuss.elastic.co/t/is-there-any-option-for-highlight-to-highlight-the-results-in-source/169890 "2019-03-23T15:57:43Z")
Hey, I'm writing a node.js application that uses ES, I want the results from my search to appear highlighted when they're shown in the HTML. How should I use it? The best option is that highlight will highlight the r… --- ## [Ingest Pipeline, apply only if fields exist](https://discuss.elastic.co/t/ingest-pipeline-apply-only-if-fields-exist/173564)
**Author:** [@Tim\_Rice](https://discuss.elastic.co/u/Tim_Rice)\ **Replies:** 4\ **Last updated:** [March 23, 2019, 2:19pm UTC](https://discuss.elastic.co/t/ingest-pipeline-apply-only-if-fields-exist/173564 "2019-03-23T14:19:43Z")
Hello, I have a ingest pipeline that does two things. It basically leverages kv and it applies geo info to a field. PUT \_ingest/pipeline/mitresplit { "description": "splits technique\_name and technique\_id", "p… --- ## [Spring-data-elasticsearch “nested query throws \[nested\] failed to find nested object under path” Exception](https://discuss.elastic.co/t/spring-data-elasticsearch-nested-query-throws-nested-failed-to-find-nested-object-under-path-exception/173586)
**Author:** [@SManorathna](https://discuss.elastic.co/u/SManorathna)\ **Replies:** 5\ **Last updated:** [March 23, 2019, 1:25pm UTC](https://discuss.elastic.co/t/spring-data-elasticsearch-nested-query-throws-nested-failed-to-find-nested-object-under-path-exception/173586 "2019-03-23T13:25:45Z")
I am trying to query nested object in elasticsearch using spring-boot I have 2 POJOs (Person and Car) where one is referred by the other @Document(indexName = "person", type = "user") public class Person { @Id … --- ## [Can Elasticsearch be a good approach for huge login-application](https://discuss.elastic.co/t/can-elasticsearch-be-a-good-approach-for-huge-login-application/173594)
**Author:** [@Chuong\_Nguyen](https://discuss.elastic.co/u/Chuong_Nguyen)\ **Replies:** 1\ **Last updated:** [March 23, 2019, 11:39am UTC](https://discuss.elastic.co/t/can-elasticsearch-be-a-good-approach-for-huge-login-application/173594 "2019-03-23T11:39:03Z")
Hi , We have an online mobile application with very high login frequency, login transactions are counted to 100k per second and in peak hours, we usually get high latency report. So, does elasticsearch is good implemen… --- ## [One node taking much more space than others](https://discuss.elastic.co/t/one-node-taking-much-more-space-than-others/173502)
**Author:** [@Joao\_Pereira](https://discuss.elastic.co/u/Joao_Pereira)\ **Replies:** 1\ **Last updated:** [March 23, 2019, 11:26am UTC](https://discuss.elastic.co/t/one-node-taking-much-more-space-than-others/173502 "2019-03-23T11:26:06Z")
Hi all, I have a small cluster with 37 nodes (3 master and 34 data), the cluster had an unusual number of shards per node (~1200) which was wrong according to elasticsearch documentation. Following the good standards r… --- ## [Join data from two indexes in Elasticsearch or Logstash](https://discuss.elastic.co/t/join-data-from-two-indexes-in-elasticsearch-or-logstash/173588)
**Author:** [@elk\_user188](https://discuss.elastic.co/u/elk_user188)\ **Replies:** 0\ **Last updated:** [March 23, 2019, 9:45am UTC](https://discuss.elastic.co/t/join-data-from-two-indexes-in-elasticsearch-or-logstash/173588 "2019-03-23T09:45:13Z")
Hi! I'd like to add a field from one index to the documents of another index, according to a certain other field (definition of a join basically). Index X has fields A, B, C Index Y has fields B, D I'd like to add to… --- ## [DateHistogram Aggregation over indices split by month](https://discuss.elastic.co/t/datehistogram-aggregation-over-indices-split-by-month/173580)
**Author:** [@arvinds94](https://discuss.elastic.co/u/arvinds94)\ **Replies:** 1\ **Last updated:** [March 23, 2019, 7:55am UTC](https://discuss.elastic.co/t/datehistogram-aggregation-over-indices-split-by-month/173580 "2019-03-23T07:55:09Z")
I do know that ElasticSearch can query across multiple indices when specified, but will it aggregate results that fall into the same bucket but were found in different indices. An example to clarify: A 7 day aggregation… --- ## [How to stop duplicate entries to output file created by output file plugin?](https://discuss.elastic.co/t/how-to-stop-duplicate-entries-to-output-file-created-by-output-file-plugin/173471)
**Author:** [@satyaban](https://discuss.elastic.co/u/satyaban)\ **Replies:** 1\ **Last updated:** [March 23, 2019, 6:57am UTC](https://discuss.elastic.co/t/how-to-stop-duplicate-entries-to-output-file-created-by-output-file-plugin/173471 "2019-03-23T06:57:33Z")
Dear All, I have log file having content \[29-Dec-2017 20:30:06\] - ||CompanyID = 65 \[30-Dec-2017 20:30:06\] - ||CompanyID = 61 I am using output file plugin for storing logs to an output file as below output { f… --- ## [Elasticsearch crashing](https://discuss.elastic.co/t/elasticsearch-crashing/173512)
**Author:** [@mancharagopan](https://discuss.elastic.co/u/mancharagopan)\ **Replies:** 1\ **Last updated:** [March 23, 2019, 6:54am UTC](https://discuss.elastic.co/t/elasticsearch-crashing/173512 "2019-03-23T06:54:57Z")
Elasticsearch is suddenly not working, as i checked following logs being generated. \[2019-03-22T12:34:05,574\]\[DEBUG\]\[o.e.a.s.TransportSearchAction\] \[8sPBzKL\] All shards failed for phase: \[query\] \[2019-03-22T12:34:05,954… --- ## [How to debug Timeout Error](https://discuss.elastic.co/t/how-to-debug-timeout-error/172950)
**Author:** [@harimenonm](https://discuss.elastic.co/u/harimenonm)\ **Replies:** 9\ **Last updated:** [March 23, 2019, 6:51am UTC](https://discuss.elastic.co/t/how-to-debug-timeout-error/172950 "2019-03-23T06:51:18Z")
Hi All, I am getting the following error when performing a bulk insert.Caused by: java.io.IOException: listener timeout after waiting for \[30000\] ms at elasticsearch.client.RestClient$SyncResponseListener.get(RestClien… --- ## [Pipeline grok failure elastic on audit log](https://discuss.elastic.co/t/pipeline-grok-failure-elastic-on-audit-log/173563)
**Author:** [@rugenl](https://discuss.elastic.co/u/rugenl)\ **Replies:** 0\ **Last updated:** [March 22, 2019, 10:18pm UTC](https://discuss.elastic.co/t/pipeline-grok-failure-elastic-on-audit-log/173563 "2019-03-22T22:18:40Z")
Trying to setup security audit logging in a new 6.6.2 stack. Using filebeat elasticsearch module to ingest the \_audit.log file. Get this error: Provided Grok expressions do not match field value: \[{"@timestamp":"2019… --- ## [Curator - Filters output inconsistency - Depending on action type : delete or shrink](https://discuss.elastic.co/t/curator-filters-output-inconsistency-depending-on-action-type-delete-or-shrink/173188)
**Author:** [@ORich](https://discuss.elastic.co/u/ORich)\ **Replies:** 6\ **Last updated:** [March 22, 2019, 8:30pm UTC](https://discuss.elastic.co/t/curator-filters-output-inconsistency-depending-on-action-type-delete-or-shrink/173188 "2019-03-22T20:30:27Z")
I run curator (5.6) from command line: curator /opt/elasticsearch-curator/shrink\_metricbeat\_indices.yml --config /opt/elasticsearch-curator/curator.config.yml --dry-run No indice match as per output: 2019-03-20 16:46:… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1354) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1356)