# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1359 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1360 --- ## [Which search to use for a custom site search](https://discuss.elastic.co/t/which-search-to-use-for-a-custom-site-search/173048)
**Author:** [@mc1392](https://discuss.elastic.co/u/mc1392)\ **Replies:** 3\ **Last updated:** [March 20, 2019, 4:07pm UTC](https://discuss.elastic.co/t/which-search-to-use-for-a-custom-site-search/173048 "2019-03-20T16:07:27Z")
I am planning on creating a site search. Which search do you recommend? It gets a bit confusing with so many options. I'd like to take the values from an HTML form input field and perform some fuzzy matching, across al… --- ## [Is new mapping applied to new document in same index?](https://discuss.elastic.co/t/is-new-mapping-applied-to-new-document-in-same-index/172561)
**Author:** [@xyz2](https://discuss.elastic.co/u/xyz2)\ **Replies:** 2\ **Last updated:** [March 20, 2019, 3:59pm UTC](https://discuss.elastic.co/t/is-new-mapping-applied-to-new-document-in-same-index/172561 "2019-03-20T15:59:18Z")
Hi, I created a new mapping template. Will the new documents in the existing index not have the latest mapping ? Is new mapping template applied on new index only or new documents also within same index ? Thanks, Kan… --- ## [Search by any location](https://discuss.elastic.co/t/search-by-any-location/173042)
**Author:** [@Miguel\_Michelsongs](https://discuss.elastic.co/u/Miguel_Michelsongs)\ **Replies:** 7\ **Last updated:** [March 20, 2019, 3:33pm UTC](https://discuss.elastic.co/t/search-by-any-location/173042 "2019-03-20T15:33:41Z")
Hi I have a mapping with geopoints, and I would like to query all the items that have a location. is there any way to search results that have geopoint and skip items without geopoints ? thanks --- ## [Restoring Backups of Shrunk Indices](https://discuss.elastic.co/t/restoring-backups-of-shrunk-indices/173183)
**Author:** [@Mohammad\_Etemad](https://discuss.elastic.co/u/Mohammad_Etemad)\ **Replies:** 0\ **Last updated:** [March 20, 2019, 3:33pm UTC](https://discuss.elastic.co/t/restoring-backups-of-shrunk-indices/173183 "2019-03-20T15:33:37Z")
Hello everyone, I am trying to clean up my ES and am using the following strategy: 1- Roll indices every day 2- Shrink indices not in use 3- Take backup of indices every month This process works fine. The problem is… --- ## [Datafeed not respecting start date](https://discuss.elastic.co/t/datafeed-not-respecting-start-date/173135)
**Author:** [@AitorF](https://discuss.elastic.co/u/AitorF)\ **Replies:** 1\ **Last updated:** [March 20, 2019, 3:22pm UTC](https://discuss.elastic.co/t/datafeed-not-respecting-start-date/173135 "2019-03-20T15:22:13Z")
My datafeed is not processing data. When I start it using the web interface, I set a date in the past, but the Job Messages tab always says something like: Datafeed started (from: 2019-03-20T11:45:00.000Z to: real-time) … --- ## [Unable to extract a saved search csv file via watcher in ES-6.6.2](https://discuss.elastic.co/t/unable-to-extract-a-saved-search-csv-file-via-watcher-in-es-6-6-2/173181)
**Author:** [@Nithani25](https://discuss.elastic.co/u/Nithani25)\ **Replies:** 0\ **Last updated:** [March 20, 2019, 3:21pm UTC](https://discuss.elastic.co/t/unable-to-extract-a-saved-search-csv-file-via-watcher-in-es-6-6-2/173181 "2019-03-20T15:21:27Z")
Hi Team, I am trying to email a copy of saved search(.csv file) via watcher email action. but i am continuous failure with the url and with status code 404 & 405 Here is the copy of my watcher alert: { "trigger": { … --- ## [Elasticsearch index throughtput](https://discuss.elastic.co/t/elasticsearch-index-throughtput/172160)
**Author:** [@Jayabal\_K](https://discuss.elastic.co/u/Jayabal_K)\ **Replies:** 14\ **Last updated:** [March 20, 2019, 3:17pm UTC](https://discuss.elastic.co/t/elasticsearch-index-throughtput/172160 "2019-03-20T15:17:03Z")
We have ES-Cluster setup as following, but we cant index not more than 1000 documents per second. We are trying verifying performance and scalablity. Client node (2 cpu,4GB memory) - 1 Data node (2 cpu,4GB memory) - 10 … --- ## [Custom Rule using Scripted Field](https://discuss.elastic.co/t/custom-rule-using-scripted-field/171830)
**Author:** [@cosruss](https://discuss.elastic.co/u/cosruss)\ **Replies:** 3\ **Last updated:** [March 20, 2019, 3:12pm UTC](https://discuss.elastic.co/t/custom-rule-using-scripted-field/171830 "2019-03-20T15:12:55Z")
Is it possible to create an ML job with custom rule referencing a scripted field? I'm trying to skip results during a certain period of the day. Running 6.6 Here are the relevant snippets: In the datafeed\_config section… --- ## [Elasticsearch API to add a lifecycle policy to an index template](https://discuss.elastic.co/t/elasticsearch-api-to-add-a-lifecycle-policy-to-an-index-template/173164)
**Author:** [@Matt\_Russell](https://discuss.elastic.co/u/Matt_Russell)\ **Replies:** 2\ **Last updated:** [March 20, 2019, 2:57pm UTC](https://discuss.elastic.co/t/elasticsearch-api-to-add-a-lifecycle-policy-to-an-index-template/173164 "2019-03-20T14:57:15Z")
Is there a way to update an index template to add a lifecycle policy through Elasticsearch APIs (to achieve the same effect as can be done in Kibana)? --- ## [ElasticsearchParseException using Ingest Attachment Processor Plugin in Elasticsearch 6.4.2](https://discuss.elastic.co/t/elasticsearchparseexception-using-ingest-attachment-processor-plugin-in-elasticsearch-6-4-2/172943)
**Author:** [@thbaan](https://discuss.elastic.co/u/thbaan)\ **Replies:** 8\ **Last updated:** [March 20, 2019, 2:31pm UTC](https://discuss.elastic.co/t/elasticsearchparseexception-using-ingest-attachment-processor-plugin-in-elasticsearch-6-4-2/172943 "2019-03-20T14:31:38Z")
Hi there We use the Ingest Attachment Processor Plugin in Elasticsearch 6.4.2 for indexing content from OCR-processed PDF files. Today a user reported an error regarding to a specific document which is provided here. St… --- ## [Invalid Results with whitespace analyzer and Multi match search](https://discuss.elastic.co/t/invalid-results-with-whitespace-analyzer-and-multi-match-search/172015)
**Author:** [@TARUN\_KUNDHIYA](https://discuss.elastic.co/u/TARUN_KUNDHIYA)\ **Replies:** 5\ **Last updated:** [March 20, 2019, 2:23pm UTC](https://discuss.elastic.co/t/invalid-results-with-whitespace-analyzer-and-multi-match-search/172015 "2019-03-20T14:23:42Z")
These are only 3 documents in my index \ "hits": \[ { "\_index": "test\_index", "\_type": "relationship", "\_id": "AWly5Q6mfOHUG\_jfP5e8", "\_score": 1, "\_source": { "fromEntityId": "a323dd-d43de-d43d3d4-d4334", "toEntityId… --- ## [Separate production logs](https://discuss.elastic.co/t/separate-production-logs/173146)
**Author:** [@Habbiot](https://discuss.elastic.co/u/Habbiot)\ **Replies:** 3\ **Last updated:** [March 20, 2019, 2:19pm UTC](https://discuss.elastic.co/t/separate-production-logs/173146 "2019-03-20T14:19:38Z")
I have Test and production logs going to the same elasticsearch cluster. how can i separate them ? --- ## [Can esrally publish a docker cluster for testing?](https://discuss.elastic.co/t/can-esrally-publish-a-docker-cluster-for-testing/173094)
**Author:** [@asp](https://discuss.elastic.co/u/asp)\ **Replies:** 1\ **Last updated:** [March 20, 2019, 2:15pm UTC](https://discuss.elastic.co/t/can-esrally-publish-a-docker-cluster-for-testing/173094 "2019-03-20T14:15:48Z")
Hi, as mentioned in a different thread I want to evaluate performance differences of elasticsearch when running in docker or as native application. We want to do that before deploying as docker on production. Is it pos… --- ## [The publish\_address {1.2.3.4:9300} is not the real ip address](https://discuss.elastic.co/t/the-publish-address-1-2-3-4-9300-is-not-the-real-ip-address/173126)
**Author:** [@JiGe](https://discuss.elastic.co/u/JiGe)\ **Replies:** 4\ **Last updated:** [March 20, 2019, 1:48pm UTC](https://discuss.elastic.co/t/the-publish-address-1-2-3-4-9300-is-not-the-real-ip-address/173126 "2019-03-20T13:48:12Z")
\[2019-03-20T19:01:58,144\]\[INFO \]\[o.e.t.TransportService \] \[node-12\] publish\_address {1.2.3.4:9300}, bound\_addresses {\[::\]:9300} \[node-12\] zen-disco-elected-as-master (\[0\] nodes joined), reason: new\_master {node-12}{hs… --- ## [Escaping special characters in regex](https://discuss.elastic.co/t/escaping-special-characters-in-regex/173071)
**Author:** [@pk.241011](https://discuss.elastic.co/u/pk.241011)\ **Replies:** 1\ **Last updated:** [March 20, 2019, 1:26pm UTC](https://discuss.elastic.co/t/escaping-special-characters-in-regex/173071 "2019-03-20T13:26:02Z")
I was writing pipeline and in the gsub processor I wrote a regex. As per the documentation Allowed characters Any Unicode characters may be used in the pattern, but certain characters are reserved and must be escaped. … --- ## [Split a field in elastic search](https://discuss.elastic.co/t/split-a-field-in-elastic-search/173030)
**Author:** [@Tim\_Rice](https://discuss.elastic.co/u/Tim_Rice)\ **Replies:** 6\ **Last updated:** [March 20, 2019, 1:16pm UTC](https://discuss.elastic.co/t/split-a-field-in-elastic-search/173030 "2019-03-20T13:16:16Z")
I have winbeats installed and things are working great. I have a field that is called: event\_data.RuleName and an actual value is: technique\_id=T1130,technique\_name=Install Root Certificate I would like to split tha… --- ## [Red Index](https://discuss.elastic.co/t/red-index/172986)
**Author:** [@Flamecube667](https://discuss.elastic.co/u/Flamecube667)\ **Replies:** 2\ **Last updated:** [March 20, 2019, 12:48pm UTC](https://discuss.elastic.co/t/red-index/172986 "2019-03-20T12:48:08Z")
Hello, i use Elasticsearch version 6.3.2. I do not understand why some indexes are red and i don't know how to fix it. I tried to re-assign thoose index or set replica to a specific value as i saw in multiple discussio… --- ## [How does Curator achieve TLS from EC2 to AWS S3?](https://discuss.elastic.co/t/how-does-curator-achieve-tls-from-ec2-to-aws-s3/172855)
**Author:** [@jonassteinberg1](https://discuss.elastic.co/u/jonassteinberg1)\ **Replies:** 8\ **Last updated:** [March 20, 2019, 12:17pm UTC](https://discuss.elastic.co/t/how-does-curator-achieve-tls-from-ec2-to-aws-s3/172855 "2019-03-20T12:17:00Z")
@theuntergeek I have a policy on an S3 bucket that will reject anything not using TLS. And my cluster snapshots are making it to S3 so obviously transport from my EC2 box (where Curator is running) to S3 is encrypted, … --- ## [Does Elasticsearch pick up OS environment variable automatically, or I have to reference it in elasticsearch.yml explicitly](https://discuss.elastic.co/t/does-elasticsearch-pick-up-os-environment-variable-automatically-or-i-have-to-reference-it-in-elasticsearch-yml-explicitly/172810)
**Author:** [@morningspace](https://discuss.elastic.co/u/morningspace)\ **Replies:** 4\ **Last updated:** [March 20, 2019, 11:48am UTC](https://discuss.elastic.co/t/does-elasticsearch-pick-up-os-environment-variable-automatically-or-i-have-to-reference-it-in-elasticsearch-yml-explicitly/172810 "2019-03-20T11:48:33Z")
I was using "reindex.remote.whitelist" to configure whitelist hosts for my remote reindex. Previously, I define that as normal environment variable w/o touching elasticsearch.yml. This works perfect on my local machine. … --- ## [Updating a field results in error](https://discuss.elastic.co/t/updating-a-field-results-in-error/172838)
**Author:** [@farooq.muhammad41](https://discuss.elastic.co/u/farooq.muhammad41)\ **Replies:** 1\ **Last updated:** [March 20, 2019, 11:45am UTC](https://discuss.elastic.co/t/updating-a-field-results-in-error/172838 "2019-03-20T11:45:50Z")
When trying to update a field in a document like so: POST index/doc/id/\_update { "script": "ctx.\_source.test-field = 'Hello'"} I get the following error: {"error":{"root\_cause":\[{"type":"illegal\_state\_exception","rea… --- ## [Mocking Elasticsearch in Postman](https://discuss.elastic.co/t/mocking-elasticsearch-in-postman/173124)
**Author:** [@xxviktor](https://discuss.elastic.co/u/xxviktor)\ **Replies:** 0\ **Last updated:** [March 20, 2019, 11:00am UTC](https://discuss.elastic.co/t/mocking-elasticsearch-in-postman/173124 "2019-03-20T11:00:26Z")
Hi, I just wanted to know, if anyone tried to mock Elasticsearch API in Postman. We are using Nest and there is a problem that requests differ only in body, but the URL is the same. I know that this may be more Postman … --- ## [Avoid/Remove inter-node communication in elasticsearch](https://discuss.elastic.co/t/avoid-remove-inter-node-communication-in-elasticsearch/172893)
**Author:** [@MKU](https://discuss.elastic.co/u/MKU)\ **Replies:** 15\ **Last updated:** [March 20, 2019, 10:51am UTC](https://discuss.elastic.co/t/avoid-remove-inter-node-communication-in-elasticsearch/172893 "2019-03-20T10:51:10Z")
Hi, I am looking for a way to avoid inter-node communication (that happens through port 9300), Is there a way to block this. Thanks --- ## [Watcher: Email settings for local postfix](https://discuss.elastic.co/t/watcher-email-settings-for-local-postfix/167313)
**Author:** [@Rohlik](https://discuss.elastic.co/u/Rohlik)\ **Replies:** 1\ **Last updated:** [March 20, 2019, 9:02am UTC](https://discuss.elastic.co/t/watcher-email-settings-for-local-postfix/167313 "2019-03-20T09:02:05Z")
Hello, I try search for postfix configuration in your docs but I cannot find any related info. Can you help me with this? Basically I want send email alerts (Watcher) from my ELK stack 6.5 using local postfix (already … --- ## [Index restored from snapshot performs differently compared to original one](https://discuss.elastic.co/t/index-restored-from-snapshot-performs-differently-compared-to-original-one/173107)
**Author:** [@Bing\_Xie](https://discuss.elastic.co/u/Bing_Xie)\ **Replies:** 3\ **Last updated:** [March 20, 2019, 9:51am UTC](https://discuss.elastic.co/t/index-restored-from-snapshot-performs-differently-compared-to-original-one/173107 "2019-03-20T09:51:20Z")
I run an elasticsearch on a new server and retore an index from snapshot which was created in another elasticsearch server. But I find the new es server performs different from the original server. I prepared a list of q… --- ## [Elasticsearch : How to Struct the content of a PDF file read by Ingest Attachment Processor Plugin for PDF](https://discuss.elastic.co/t/elasticsearch-how-to-struct-the-content-of-a-pdf-file-read-by-ingest-attachment-processor-plugin-for-pdf/173105)
**Author:** [@Adil\_Bakkouri](https://discuss.elastic.co/u/Adil_Bakkouri)\ **Replies:** 1\ **Last updated:** [March 20, 2019, 9:44am UTC](https://discuss.elastic.co/t/elasticsearch-how-to-struct-the-content-of-a-pdf-file-read-by-ingest-attachment-processor-plugin-for-pdf/173105 "2019-03-20T09:44:40Z")
Hello, After i used Ingest Attachment Processor Plugin to extract the content of my list of pdf files, i would like to structure this contant like what we have with DataSets in the goal to make my research more powerful… --- ## [What is the best query for this Watcher?](https://discuss.elastic.co/t/what-is-the-best-query-for-this-watcher/165078)
**Author:** [@arisbanach](https://discuss.elastic.co/u/arisbanach)\ **Replies:** 2\ **Last updated:** [March 20, 2019, 9:06am UTC](https://discuss.elastic.co/t/what-is-the-best-query-for-this-watcher/165078 "2019-03-20T09:06:27Z")
I have multiple term values that are for the customer field. I would like to set up a Watcher to alert me when ANY of our customers have a document count less than a certain amount. I currently have one dedicated watcher… --- ## [Pull new data from my updated CSV](https://discuss.elastic.co/t/pull-new-data-from-my-updated-csv/173103)
**Author:** [@kushaangdeswal](https://discuss.elastic.co/u/kushaangdeswal)\ **Replies:** 0\ **Last updated:** [March 20, 2019, 9:05am UTC](https://discuss.elastic.co/t/pull-new-data-from-my-updated-csv/173103 "2019-03-20T09:05:58Z")
Hi, I created a bar visualization to pull data from a csv file. Following is the sample data BuiltFileType | BuiltCount A | 100 B | 200 This data gets refreshed ever… --- ## [Listing all values of one field](https://discuss.elastic.co/t/listing-all-values-of-one-field/172784)
**Author:** [@DidierB](https://discuss.elastic.co/u/DidierB)\ **Replies:** 4\ **Last updated:** [March 20, 2019, 9:01am UTC](https://discuss.elastic.co/t/listing-all-values-of-one-field/172784 "2019-03-20T09:01:34Z")
Hello, I have a big index (in fact many: one per day) with a field "id". I would like to know each value that this field has. The classical answer is : { "size": 0, "aggs": { "2": { "terms": { "fi… --- ## [Elasticsearch bulk query with version?](https://discuss.elastic.co/t/elasticsearch-bulk-query-with-version/173102)
**Author:** [@surajdalvi](https://discuss.elastic.co/u/surajdalvi)\ **Replies:** 0\ **Last updated:** [March 20, 2019, 9:01am UTC](https://discuss.elastic.co/t/elasticsearch-bulk-query-with-version/173102 "2019-03-20T09:01:28Z")
Hi, Can we update multiple documents in elastic search with the bulk query with version support (don't need version conflict error)? is possible in bulk update query to set a condition for version query? can we use up… --- ## [Index\_out\_of\_bounds\_exception watcher using aggregration](https://discuss.elastic.co/t/index-out-of-bounds-exception-watcher-using-aggregration/170376)
**Author:** [@Muhammad\_Saleem](https://discuss.elastic.co/u/Muhammad_Saleem)\ **Replies:** 1\ **Last updated:** [March 20, 2019, 8:59am UTC](https://discuss.elastic.co/t/index-out-of-bounds-exception-watcher-using-aggregration/170376 "2019-03-20T08:59:11Z")
Here is my code to create a watcher, which is trying to compare two values from the aggregated values from the payload. The problem is when there is no data being context by the condition in the watcher, it returns the … [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1358) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1360)