# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1357 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1358 --- ## [Myindex/\_stats?filter\_path=indices.\*\*.query\_cache got {}](https://discuss.elastic.co/t/myindex-stats-filter-path-indices-query-cache-got/173428)
**Author:** [@yc1024](https://discuss.elastic.co/u/yc1024)\ **Replies:** 0\ **Last updated:** [March 22, 2019, 5:01am UTC](https://discuss.elastic.co/t/myindex-stats-filter-path-indices-query-cache-got/173428 "2019-03-22T05:01:57Z")
{ "query": { "bool":{ "filter":{ "bool":{ "must":\[ {"match\_phrase" : { "text" :"123" }}, {"match\_phrase" : { "text" :"245" }}, {"match\_phrase" : { "text… --- ## [How to extend es storage to the remote storage cluster?](https://discuss.elastic.co/t/how-to-extend-es-storage-to-the-remote-storage-cluster/173424)
**Author:** [@JiGe](https://discuss.elastic.co/u/JiGe)\ **Replies:** 1\ **Last updated:** [March 22, 2019, 4:39am UTC](https://discuss.elastic.co/t/how-to-extend-es-storage-to-the-remote-storage-cluster/173424 "2019-03-22T04:39:01Z")
Can I use glusterfs or ceph to solve this problem? I tried to use glusterfs, and mount the remote storage server as a folder(fuse.glusterfs) to es server. but it doesn't work. Is there any mature solution on how to ext… --- ## [Get Results of individual jenkins job and create Dashboard](https://discuss.elastic.co/t/get-results-of-individual-jenkins-job-and-create-dashboard/173205)
**Author:** [@syedsfayaz](https://discuss.elastic.co/u/syedsfayaz)\ **Replies:** 3\ **Last updated:** [March 22, 2019, 3:03am UTC](https://discuss.elastic.co/t/get-results-of-individual-jenkins-job-and-create-dashboard/173205 "2019-03-22T03:03:29Z")
HI Thanks in advance. I am new to kibana and see it is possible to show time series data in kibana. I have a different requirement. I am trying to setup a dashboard for monitoring our software flow. The process looks l… --- ## [Logfile exclude filter example flagged as invalid in Kibana](https://discuss.elastic.co/t/logfile-exclude-filter-example-flagged-as-invalid-in-kibana/173415)
**Author:** [@rugenl](https://discuss.elastic.co/u/rugenl)\ **Replies:** 1\ **Last updated:** [March 22, 2019, 1:14am UTC](https://discuss.elastic.co/t/logfile-exclude-filter-example-flagged-as-invalid-in-kibana/173415 "2019-03-22T01:14:18Z")
From the blog post the example gets an error in Kibana that I can't figure out. This sample: PUT /\_cluster/settings { "transient": { "xpack.security.audit.logfile.events.ignore\_filters": { "si… --- ## [Why doesn't \_cat/recovery honor the bytes=XX in the URI?](https://discuss.elastic.co/t/why-doesnt-cat-recovery-honor-the-bytes-xx-in-the-uri/173241)
**Author:** [@slmingol](https://discuss.elastic.co/u/slmingol)\ **Replies:** 4\ **Last updated:** [March 21, 2019, 11:30pm UTC](https://discuss.elastic.co/t/why-doesnt-cat-recovery-honor-the-bytes-xx-in-the-uri/173241 "2019-03-21T23:30:05Z")
I'm trying to change the units for the following API call: GET /\_cat/recovery?bytes=gb The docs around the cat API imply that you can do this, but the recovery endpoint doesn't seem to work with this. The units are alw… --- ## [Audit logging initial volume](https://discuss.elastic.co/t/audit-logging-initial-volume/173402)
**Author:** [@rugenl](https://discuss.elastic.co/u/rugenl)\ **Replies:** 2\ **Last updated:** [March 21, 2019, 10:05pm UTC](https://discuss.elastic.co/t/audit-logging-initial-volume/173402 "2019-03-21T22:05:15Z")
I turned on audit log to files on a single node cluster. It started generating about 8700 audit events per minute with no one using the cluster. What should be turned off to get this down to a manageable volume? --- ## [How to display Percentiles rank values?](https://discuss.elastic.co/t/how-to-display-percentiles-rank-values/171782)
**Author:** [@hmezoughi](https://discuss.elastic.co/u/hmezoughi)\ **Replies:** 3\ **Last updated:** [March 21, 2019, 9:19pm UTC](https://discuss.elastic.co/t/how-to-display-percentiles-rank-values/171782 "2019-03-21T21:19:07Z")
I want to call values of percentiles rank 500 and/or 1000 in a variable to compare it with conditions "aggs": { "load\_time\_outlier": { "percentile\_ranks": { "field": "TOTAL\_TIM… --- ## [Pipeline Aggregation and Counting Buckets](https://discuss.elastic.co/t/pipeline-aggregation-and-counting-buckets/173401)
**Author:** [@KenS](https://discuss.elastic.co/u/KenS)\ **Replies:** 0\ **Last updated:** [March 21, 2019, 8:50pm UTC](https://discuss.elastic.co/t/pipeline-aggregation-and-counting-buckets/173401 "2019-03-21T20:50:23Z")
I'm running ES-6.2 and have an index that contains Windows eventlog data. I'm trying to create a query using pipeline aggregations to aggregate failed logins by username and then again by the count of actual failures. … --- ## [Phrase Query with Prefix produces 0 results](https://discuss.elastic.co/t/phrase-query-with-prefix-produces-0-results/172549)
**Author:** [@myronuecker](https://discuss.elastic.co/u/myronuecker)\ **Replies:** 8\ **Last updated:** [March 21, 2019, 8:38pm UTC](https://discuss.elastic.co/t/phrase-query-with-prefix-produces-0-results/172549 "2019-03-21T20:38:37Z")
We are replacing a homegrown search engine written with pure Lucene (currently 4.9.1) with ElasticSearch. After adding the search analyzers we used in the old system, I'm now trying to replicate our queries. Right now I'… --- ## [Bug in ElasticSearch (Aggs and moving\_fn) v6.6.2](https://discuss.elastic.co/t/bug-in-elasticsearch-aggs-and-moving-fn-v6-6-2/173393)
**Author:** [@Chris\_Bartos](https://discuss.elastic.co/u/Chris_Bartos)\ **Replies:** 0\ **Last updated:** [March 21, 2019, 7:59pm UTC](https://discuss.elastic.co/t/bug-in-elasticsearch-aggs-and-moving-fn-v6-6-2/173393 "2019-03-21T19:59:25Z")
This is my query: { "sort": \[ { "start\_time": { "order": "asc" } } \], "size": 4, "query": { "bool": { "must": \[ { "match": { "start\_date": "03-22-2019" } }, { "match": { "ope… --- ## [Storing user based events in elasticsearch](https://discuss.elastic.co/t/storing-user-based-events-in-elasticsearch/173387)
**Author:** [@Bharathi\_Kannan](https://discuss.elastic.co/u/Bharathi_Kannan)\ **Replies:** 0\ **Last updated:** [March 21, 2019, 7:49pm UTC](https://discuss.elastic.co/t/storing-user-based-events-in-elasticsearch/173387 "2019-03-21T19:49:54Z")
Hi, We are building a events data store on top of elasticsearch. Our goal is to provide real-time analytics with advanced segmentation on top of users & events. Our entities are Users or Visitors Events (Which is per… --- ## [Significant field aggregation ElasticSearch](https://discuss.elastic.co/t/significant-field-aggregation-elasticsearch/173350)
**Author:** [@Vincent\_Stevenson](https://discuss.elastic.co/u/Vincent_Stevenson)\ **Replies:** 3\ **Last updated:** [March 21, 2019, 7:13pm UTC](https://discuss.elastic.co/t/significant-field-aggregation-elasticsearch/173350 "2019-03-21T19:13:13Z")
Is there something similar to ElasticSearch's significant\_text aggregation, but for significant\_fields? Example: based on the foreground of Json documents, there is an uncommonly common occurrence of the field "RAM capa… --- ## [Dynamic templates don´t seem to support object types](https://discuss.elastic.co/t/dynamic-templates-don-t-seem-to-support-object-types/173379)
**Author:** [@fabiofernandes](https://discuss.elastic.co/u/fabiofernandes)\ **Replies:** 0\ **Last updated:** [March 21, 2019, 6:47pm UTC](https://discuss.elastic.co/t/dynamic-templates-don-t-seem-to-support-object-types/173379 "2019-03-21T18:47:44Z")
Our team is currently using ElasticSearch 6.2.2. We were trying create events with object datatype using the character '.'. It seems that dynamic templates don´t support this. When we add a event with the object datatype… --- ## [Queries are very slow](https://discuss.elastic.co/t/queries-are-very-slow/173365)
**Author:** [@Sashi](https://discuss.elastic.co/u/Sashi)\ **Replies:** 1\ **Last updated:** [March 21, 2019, 6:36pm UTC](https://discuss.elastic.co/t/queries-are-very-slow/173365 "2019-03-21T18:36:32Z")
I have this query which took 38 seconds to execute. { "size": 10000, "timeout": "30089ms", "query": { "constant\_score": { "filter": { "bool": { "must": \[{ "terms": { "detail.status": \["ACTIVE"\], "boost": 1.0 … --- ## [How do I map a meta.title field to search within it using NEST](https://discuss.elastic.co/t/how-do-i-map-a-meta-title-field-to-search-within-it-using-nest/171343)
**Author:** [@siradude](https://discuss.elastic.co/u/siradude)\ **Replies:** 18\ **Last updated:** [March 21, 2019, 6:35pm UTC](https://discuss.elastic.co/t/how-do-i-map-a-meta-title-field-to-search-within-it-using-nest/171343 "2019-03-21T18:35:34Z")
I have a Index created by FSCRAWLER of a document (either HTML or PDF). This index has many (what I assume are) auto created fields. My needs are simple, I need to search withing the ID of the document (which) will be … --- ## [High level rest client maven dependency issue](https://discuss.elastic.co/t/high-level-rest-client-maven-dependency-issue/173298)
**Author:** [@Martin.Sp](https://discuss.elastic.co/u/Martin.Sp)\ **Replies:** 0\ **Last updated:** [March 21, 2019, 11:29am UTC](https://discuss.elastic.co/t/high-level-rest-client-maven-dependency-issue/173298 "2019-03-21T11:29:37Z")
Hi guys, I have an issue with high level rest client. I'm using version 6.4.3 of the client, and every time I build my project I get version version 5.2.2 of org.elasticsearch:elasticsearch instead of 6.4.3. This issue … --- ## [Elasticsearch in Openshift with local volumes](https://discuss.elastic.co/t/elasticsearch-in-openshift-with-local-volumes/173354)
**Author:** [@ZrytyAHD](https://discuss.elastic.co/u/ZrytyAHD)\ **Replies:** 0\ **Last updated:** [March 21, 2019, 4:45pm UTC](https://discuss.elastic.co/t/elasticsearch-in-openshift-with-local-volumes/173354 "2019-03-21T16:45:11Z")
Hello, I have a problem with Elasticsearch on Openshift. I deploy it on my cluster with GlusterFs such as Storage Volume what is not recomended. My idea is switch it to from GlusterFS to Local Volume but i can't find… --- ## [Defining analyzer per query](https://discuss.elastic.co/t/defining-analyzer-per-query/173273)
**Author:** [@xxviktor](https://discuss.elastic.co/u/xxviktor)\ **Replies:** 6\ **Last updated:** [March 21, 2019, 4:33pm UTC](https://discuss.elastic.co/t/defining-analyzer-per-query/173273 "2019-03-21T16:33:25Z")
Hi, I have read in the documentation that it should be possible to specify analyzer per query. I tried a few examples with custom ngram analyzer set for match query, but it was not working as I expected. put people { … --- ## [Long GC pauses on data nodes](https://discuss.elastic.co/t/long-gc-pauses-on-data-nodes/173251)
**Author:** [@arvind297](https://discuss.elastic.co/u/arvind297)\ **Replies:** 8\ **Last updated:** [March 21, 2019, 4:30pm UTC](https://discuss.elastic.co/t/long-gc-pauses-on-data-nodes/173251 "2019-03-21T16:30:22Z")
Hi, We are seeing hot nodes going out frequently(atleast once in a day) with the below error and we need to restart the services manually to add the node back to the cluster. We have 8 hot nodes and Most of the time no… --- ## [Reasoning behind attaching Lifecycle policies to index template](https://discuss.elastic.co/t/reasoning-behind-attaching-lifecycle-policies-to-index-template/173342)
**Author:** [@trondhindenes](https://discuss.elastic.co/u/trondhindenes)\ **Replies:** 1\ **Last updated:** [March 21, 2019, 4:06pm UTC](https://discuss.elastic.co/t/reasoning-behind-attaching-lifecycle-policies-to-index-template/173342 "2019-03-21T16:06:44Z")
We just updated to Elasticsearch 6.7, and were looking forward to start using Index Lifecycle Policies instead of Curator. I was very surprised to see that index lifecycles are "activated" by attaching them to index tem… --- ## [Can't search or filter on custom fields](https://discuss.elastic.co/t/cant-search-or-filter-on-custom-fields/173278)
**Author:** [@tflorac](https://discuss.elastic.co/u/tflorac)\ **Replies:** 0\ **Last updated:** [March 21, 2019, 9:57am UTC](https://discuss.elastic.co/t/cant-search-or-filter-on-custom-fields/173278 "2019-03-21T09:57:11Z")
Hi, I followed another topic to update my APM index template this way to include custom HTTP headers used in my applications: setup.template.overwrite: true setup.template.append\_fields: - name: context.request.heade… --- ## [ElasticSearch Error When Integrating with Azure AD for SSO Capabilities](https://discuss.elastic.co/t/elasticsearch-error-when-integrating-with-azure-ad-for-sso-capabilities/172836)
**Author:** [@Kehinde\_Owens](https://discuss.elastic.co/u/Kehinde_Owens)\ **Replies:** 12\ **Last updated:** [March 21, 2019, 3:42pm UTC](https://discuss.elastic.co/t/elasticsearch-error-when-integrating-with-azure-ad-for-sso-capabilities/172836 "2019-03-21T15:42:24Z")
Hello, I am currently attempting to use my Azure Active Directory as with my ElasticSearch/Kibana instance in order to give my users SSO capabilities. I receive a 502 error message once I enable the settings in Kibana a… --- ## [Watcher for index size](https://discuss.elastic.co/t/watcher-for-index-size/172612)
**Author:** [@taandrews](https://discuss.elastic.co/u/taandrews)\ **Replies:** 2\ **Last updated:** [March 21, 2019, 3:23pm UTC](https://discuss.elastic.co/t/watcher-for-index-size/172612 "2019-03-21T15:23:04Z")
I have several indices that have a prefix, let's say ABCD-123-\* . Is there a way to monitor/watch each individual index that starts with the aforementioned prefix and alert when the index reach a particular size. For in… --- ## [How to upgrade ES Cloud 1.7.3 to most current?](https://discuss.elastic.co/t/how-to-upgrade-es-cloud-1-7-3-to-most-current/173332)
**Author:** [@1tek4u](https://discuss.elastic.co/u/1tek4u)\ **Replies:** 1\ **Last updated:** [March 21, 2019, 3:15pm UTC](https://discuss.elastic.co/t/how-to-upgrade-es-cloud-1-7-3-to-most-current/173332 "2019-03-21T15:15:05Z")
Console does not seem to have option to upgrade, and by looking in documentation I can't seem to find custom yml, scripts, etc to perform first stage upgrade to version 2.4. --- ## [Is it possible to disable date\_detection only for certain fields?](https://discuss.elastic.co/t/is-it-possible-to-disable-date-detection-only-for-certain-fields/173331)
**Author:** [@gitstash](https://discuss.elastic.co/u/gitstash)\ **Replies:** 0\ **Last updated:** [March 21, 2019, 2:40pm UTC](https://discuss.elastic.co/t/is-it-possible-to-disable-date-detection-only-for-certain-fields/173331 "2019-03-21T14:40:55Z")
Hi all, I would like to have date\_detection enabled for most fields, but for some certain fields I want to disable it. I tried dynamic\_templates but it doesn't work. Does anyone know how to do it or have some workaround… --- ## [Startswith analyzer not working](https://discuss.elastic.co/t/startswith-analyzer-not-working/172394)
**Author:** [@Mohsin\_Farooq](https://discuss.elastic.co/u/Mohsin_Farooq)\ **Replies:** 6\ **Last updated:** [March 21, 2019, 2:14pm UTC](https://discuss.elastic.co/t/startswith-analyzer-not-working/172394 "2019-03-21T14:14:55Z")
So i just created a new index to search for a string which starts with some specific characters like 'Kibana\*' (just like 'Kibana%' in SQL) which means it should return results with text "Starting with" Kibana and not "… --- ## [How to create sub-indices inside indices](https://discuss.elastic.co/t/how-to-create-sub-indices-inside-indices/171725)
**Author:** [@soumrock123](https://discuss.elastic.co/u/soumrock123)\ **Replies:** 6\ **Last updated:** [March 21, 2019, 1:56pm UTC](https://discuss.elastic.co/t/how-to-create-sub-indices-inside-indices/171725 "2019-03-21T13:56:11Z")
I have currently around 200 customer databases under one ES node and for each database, I am running 10 different queries to assess performance. For that I have 200\*10 indices now, but that does not look good. I plan to … --- ## [Increase ignore\_above for custom field](https://discuss.elastic.co/t/increase-ignore-above-for-custom-field/173282)
**Author:** [@leprovokateur](https://discuss.elastic.co/u/leprovokateur)\ **Replies:** 1\ **Last updated:** [March 21, 2019, 1:51pm UTC](https://discuss.elastic.co/t/increase-ignore-above-for-custom-field/173282 "2019-03-21T13:51:11Z")
Hi, I use filebeat, logstash, and elasticsearch to index log messages, kibana for visualization. Within logstash I use grok to split the message into different fields, one of which is "logmessage". If "logmessage" is t… --- ## [Serial difference of timestamps between documents](https://discuss.elastic.co/t/serial-difference-of-timestamps-between-documents/173318)
**Author:** [@nandrik](https://discuss.elastic.co/u/nandrik)\ **Replies:** 0\ **Last updated:** [March 21, 2019, 1:37pm UTC](https://discuss.elastic.co/t/serial-difference-of-timestamps-between-documents/173318 "2019-03-21T13:37:44Z")
I'm trying to calculate the time difference between two specific types of messages coming out of Logstash. I've read the post: Calculate the time difference between consecutive documents and I've successfully implemented… --- ## [SearchResponse Vs CURL response. Aggregations responses don't match](https://discuss.elastic.co/t/searchresponse-vs-curl-response-aggregations-responses-dont-match/170894)
**Author:** [@Shankar\_Daruga](https://discuss.elastic.co/u/Shankar_Daruga)\ **Replies:** 6\ **Last updated:** [March 21, 2019, 1:30pm UTC](https://discuss.elastic.co/t/searchresponse-vs-curl-response-aggregations-responses-dont-match/170894 "2019-03-21T13:30:37Z")
Hello, In our current configuration, with 5.2 jar, the 'SearchResponse' Object, after converting it to JSON using XContentBuilder, the JSON matches that of the CURL request. We are now trying to upgrade to 6.6 and so t… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1356) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1358)