# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1369 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1370 --- ## [Results have a similar score, but the number of fields matched varies](https://discuss.elastic.co/t/results-have-a-similar-score-but-the-number-of-fields-matched-varies/171815)
**Author:** [@RMNYC](https://discuss.elastic.co/u/RMNYC)\ **Replies:** 2\ **Last updated:** [March 11, 2019, 6:59pm UTC](https://discuss.elastic.co/t/results-have-a-similar-score-but-the-number-of-fields-matched-varies/171815 "2019-03-11T18:59:25Z")
To simplify: PUT /test/vendors/1 { "type": "doctor", "name": "Ron", "place": "Boston" } PUT /test/vendors/2 { "type": "doctor", "name": "Tom", "place": "Boston" } PUT /test/vendors/3 { "type": "doct… --- ## [Optimizing our Elastic Stack?](https://discuss.elastic.co/t/optimizing-our-elastic-stack/171555)
**Author:** [@titan1978](https://discuss.elastic.co/u/titan1978)\ **Replies:** 11\ **Last updated:** [March 11, 2019, 6:30pm UTC](https://discuss.elastic.co/t/optimizing-our-elastic-stack/171555 "2019-03-11T18:30:52Z")
We're starting to witness a heavy CPU Load on our stack and were hoping to get some help in understanding how we can lessen these. Our current topology is as follows. Hosted on AWS EC2 5 Master/Data Nodes of M5x4x Lar… --- ## [Implement "racheting" behaviour in Ingest Pipeline](https://discuss.elastic.co/t/implement-racheting-behaviour-in-ingest-pipeline/171562)
**Author:** [@amomchilov](https://discuss.elastic.co/u/amomchilov)\ **Replies:** 2\ **Last updated:** [March 11, 2019, 6:16pm UTC](https://discuss.elastic.co/t/implement-racheting-behaviour-in-ingest-pipeline/171562 "2019-03-11T18:16:19Z")
I have some log lines that have contextually appended segments. Unfortunately, we're not using a structured logging format, so there's no simple way to parse them out. My logs have one of these forms: 2019-01-01 00:00… --- ## [Remove a Node controlling the number of shards reallocating](https://discuss.elastic.co/t/remove-a-node-controlling-the-number-of-shards-reallocating/171765)
**Author:** [@Javier\_Parrondo](https://discuss.elastic.co/u/Javier_Parrondo)\ **Replies:** 2\ **Last updated:** [March 11, 2019, 5:50pm UTC](https://discuss.elastic.co/t/remove-a-node-controlling-the-number-of-shards-reallocating/171765 "2019-03-11T17:50:24Z")
Hello, At the moment on which I want to remove a node inside a Elasticsearch cluster I was wondering if there is possible to controll how many shards are going to be reallocating at the same time, I know the cluster set… --- ## [\[Solved\] Update from 6.2.2 to 6.6.1 on Debian failed, forgot to remove X-pack](https://discuss.elastic.co/t/solved-update-from-6-2-2-to-6-6-1-on-debian-failed-forgot-to-remove-x-pack/171812)
**Author:** [@paspao](https://discuss.elastic.co/u/paspao)\ **Replies:** 1\ **Last updated:** [March 11, 2019, 5:36pm UTC](https://discuss.elastic.co/t/solved-update-from-6-2-2-to-6-6-1-on-debian-failed-forgot-to-remove-x-pack/171812 "2019-03-11T17:36:30Z")
Hello, I hope you can help me. Even if reading step by step docs I forgot to remove xpack plugin before upgrading. I am on Debian 9 and I get the error: Exception in thread "main" java.lang.IllegalStateException: Cou… --- ## [Adding 2nd data center to ES Service](https://discuss.elastic.co/t/adding-2nd-data-center-to-es-service/171609)
**Author:** [@chrisarsen](https://discuss.elastic.co/u/chrisarsen)\ **Replies:** 2\ **Last updated:** [March 11, 2019, 5:31pm UTC](https://discuss.elastic.co/t/adding-2nd-data-center-to-es-service/171609 "2019-03-11T17:31:49Z")
Hi, We are currently only using ES to centralize our logs. We currently have 1 east coast data center and 1 deployment in the ES Service (cloud) for that data center. We are now adding a west coast data center and would… --- ## [Index lifecycle error](https://discuss.elastic.co/t/index-lifecycle-error/171254)
**Author:** [@hsam](https://discuss.elastic.co/u/hsam)\ **Replies:** 5\ **Last updated:** [March 11, 2019, 5:29pm UTC](https://discuss.elastic.co/t/index-lifecycle-error/171254 "2019-03-11T17:29:34Z")
Can you help me using kibana ilm error ? I don't get the meaning of this error: illegal\_argument\_exception: index.lifecycle.rollover\_alias \[metricbeat-6.6.0-alias\] does not point to index \[metricbeat-6.6.0-2019.03.06\] … --- ## [Snapshot](https://discuss.elastic.co/t/snapshot/171818)
**Author:** [@bbking](https://discuss.elastic.co/u/bbking)\ **Replies:** 1\ **Last updated:** [March 11, 2019, 5:19pm UTC](https://discuss.elastic.co/t/snapshot/171818 "2019-03-11T17:19:54Z")
Hello! Can I add snapshot while Elasticsearch cluster is running? Do I have to restart the cluster by adding path.repo in elasticsearch.yml? --- ## [ES 6.5.2 Search for specific terms that appear on the same line in a multiline text field](https://discuss.elastic.co/t/es-6-5-2-search-for-specific-terms-that-appear-on-the-same-line-in-a-multiline-text-field/171753)
**Author:** [@ld\_pvl](https://discuss.elastic.co/u/ld_pvl)\ **Replies:** 2\ **Last updated:** [March 11, 2019, 5:17pm UTC](https://discuss.elastic.co/t/es-6-5-2-search-for-specific-terms-that-appear-on-the-same-line-in-a-multiline-text-field/171753 "2019-03-11T17:17:38Z")
Hi Guys, What is the best way to search for multiple specific terms in a multiline text field but only if those terms appear on the same line in that multiline text field? I couldn't achieve this using the simplied Luc… --- ## [Snapshot Restore](https://discuss.elastic.co/t/snapshot-restore/171783)
**Author:** [@kb2295](https://discuss.elastic.co/u/kb2295)\ **Replies:** 1\ **Last updated:** [March 11, 2019, 5:08pm UTC](https://discuss.elastic.co/t/snapshot-restore/171783 "2019-03-11T17:08:17Z")
Hi, I'm trying to snapshot restore using a repository. This is the command i am running: PUT -u user:password /\_snapshot/my\_backup/snapshot\_20181011 and I'm getting this error (in dev tools kibana): { "error": "Cont… --- ## [Which Storage type to be used for ELK on AWS?](https://discuss.elastic.co/t/which-storage-type-to-be-used-for-elk-on-aws/170047)
**Author:** [@rahulkumar1](https://discuss.elastic.co/u/rahulkumar1)\ **Replies:** 10\ **Last updated:** [March 11, 2019, 5:01pm UTC](https://discuss.elastic.co/t/which-storage-type-to-be-used-for-elk-on-aws/170047 "2019-03-11T17:01:22Z")
https://www.elastic.co/guide/en/elasticsearch/plugins/master/cloud-aws-best-practices.html From the above it is recommended to use Instance storage, but then data is lost in the below scenarios: The underlying disk dr… --- ## [Issue with restoring .kibana\_1 and .security-6 indices](https://discuss.elastic.co/t/issue-with-restoring-kibana-1-and-security-6-indices/171579)
**Author:** [@Eric\_Moss](https://discuss.elastic.co/u/Eric_Moss)\ **Replies:** 4\ **Last updated:** [March 11, 2019, 4:51pm UTC](https://discuss.elastic.co/t/issue-with-restoring-kibana-1-and-security-6-indices/171579 "2019-03-11T16:51:19Z")
After a frustrating day trying to get my head around restoring snapshots from another cluster in ECE/S3 Repo, I've managed to kill my new deployment. I closed the .security-6 index in an attempt to do a full restore and… --- ## [Aggregation exception](https://discuss.elastic.co/t/aggregation-exception/171410)
**Author:** [@aniaks](https://discuss.elastic.co/u/aniaks)\ **Replies:** 4\ **Last updated:** [March 11, 2019, 4:41pm UTC](https://discuss.elastic.co/t/aggregation-exception/171410 "2019-03-11T16:41:31Z")
This aggregation creates too many buckets (10001) and will throw an error in future versions. You should update the \[search.max\_buckets\] cluster setting or use the \[ composite\] aggregation to paginate all buckets in mul… --- ## [Query into Logstash Monitoring Pipeline Data Array](https://discuss.elastic.co/t/query-into-logstash-monitoring-pipeline-data-array/171809)
**Author:** [@nielsoncr](https://discuss.elastic.co/u/nielsoncr)\ **Replies:** 0\ **Last updated:** [March 11, 2019, 4:39pm UTC](https://discuss.elastic.co/t/query-into-logstash-monitoring-pipeline-data-array/171809 "2019-03-11T16:39:53Z")
I would like to build an Alert (Watch) on monitoring data produced by Logstash. An abbreviated sample of the logstash\_stats data is below. I am interested in building a query that will return a result when logstash\_s… --- ## [Expressions in Painless DSL](https://discuss.elastic.co/t/expressions-in-painless-dsl/171502)
**Author:** [@Ryan\_Grannell](https://discuss.elastic.co/u/Ryan_Grannell)\ **Replies:** 2\ **Last updated:** [March 11, 2019, 4:00pm UTC](https://discuss.elastic.co/t/expressions-in-painless-dsl/171502 "2019-03-11T16:00:56Z")
Hi, Does Painless support immediately-invoked function expressions (IIFEs)? For reasons (I'd prefer not to explain them) I need to return the result of several expressions to an if-statement, as shown in an example bel… --- ## [Mixing up field types - can we force text to keyword?](https://discuss.elastic.co/t/mixing-up-field-types-can-we-force-text-to-keyword/171167)
**Author:** [@exocore123](https://discuss.elastic.co/u/exocore123)\ **Replies:** 1\ **Last updated:** [March 11, 2019, 3:44pm UTC](https://discuss.elastic.co/t/mixing-up-field-types-can-we-force-text-to-keyword/171167 "2019-03-11T15:44:48Z")
Could not index event to Elasticsearch. {:status=>400, :action=>\["index", {:\_id=>"52801f35-d64d-4585-b698-5628baa8552d", :\_index=>"logstash-summary-2019.03.06", :\_type=>"doc", :\_routing=>nil}, #<LogS… --- ## [How to upload bulk data into elasticsearch?](https://discuss.elastic.co/t/how-to-upload-bulk-data-into-elasticsearch/171772)
**Author:** [@dattack13](https://discuss.elastic.co/u/dattack13)\ **Replies:** 3\ **Last updated:** [March 11, 2019, 1:51pm UTC](https://discuss.elastic.co/t/how-to-upload-bulk-data-into-elasticsearch/171772 "2019-03-11T13:51:16Z")
Hi, I have bulk of json data with me, and I want to upload it in single hit, can any one knows the process, I am unable to find any way of bulk item upload in elasticsearch. Thanks Gaurav Singh --- ## [Py-script querys againt elastic problem](https://discuss.elastic.co/t/py-script-querys-againt-elastic-problem/171773)
**Author:** [@Daniel19](https://discuss.elastic.co/u/Daniel19)\ **Replies:** 0\ **Last updated:** [March 11, 2019, 1:24pm UTC](https://discuss.elastic.co/t/py-script-querys-againt-elastic-problem/171773 "2019-03-11T13:24:02Z")
My code looks like this. its do get data, monitoring the total amount of hits and so on. Preformatted text def get\_last\_hour(): i = 0 swc\_arr = \[\] res1 = es.search(index='testindex', body={ "quer… --- ## [Elasticsearch missing index fields after upgrade](https://discuss.elastic.co/t/elasticsearch-missing-index-fields-after-upgrade/171457)
**Author:** [@Rigrawl](https://discuss.elastic.co/u/Rigrawl)\ **Replies:** 3\ **Last updated:** [March 11, 2019, 1:18pm UTC](https://discuss.elastic.co/t/elasticsearch-missing-index-fields-after-upgrade/171457 "2019-03-11T13:18:05Z")
Hey, We are facing an issue after upgrading from ELK 5.6 to 6.6.1. We had around 1,5k index fields prior to update, now we are left with ~30. We have 2TC nodes with 1 controller on which we have ELK, APM, Metricbeats T… --- ## [Pipeline aggregation with Date histogram doesn't return expected result](https://discuss.elastic.co/t/pipeline-aggregation-with-date-histogram-doesnt-return-expected-result/171626)
**Author:** [@trickygiang](https://discuss.elastic.co/u/trickygiang)\ **Replies:** 1\ **Last updated:** [March 11, 2019, 1:12pm UTC](https://discuss.elastic.co/t/pipeline-aggregation-with-date-histogram-doesnt-return-expected-result/171626 "2019-03-11T13:12:11Z")
I'm facing an issue regarding to use Pipeline aggregation with Date histogram. I need to filter data from: "2019-03-08T06:00:00Z" to "2019-03-09T10:00:00Z" and do histogram aggregation on that. Then calculate avg value … --- ## [Elasticsearch x-pack-security enable on cluster (SOLVED)](https://discuss.elastic.co/t/elasticsearch-x-pack-security-enable-on-cluster-solved/171766)
**Author:** [@quorum](https://discuss.elastic.co/u/quorum)\ **Replies:** 1\ **Last updated:** [March 11, 2019, 1:07pm UTC](https://discuss.elastic.co/t/elasticsearch-x-pack-security-enable-on-cluster-solved/171766 "2019-03-11T13:07:44Z")
Hey, i am in the process of evaluating elasticsearch in a cluster of three nodes. i want to do an authenticated setup and did not yet configured xpack.security.enabled: true as far as i understood the docs every node w… --- ## [Equivalent to SQL window functions](https://discuss.elastic.co/t/equivalent-to-sql-window-functions/44527)
**Author:** [@sergeyb](https://discuss.elastic.co/u/sergeyb)\ **Replies:** 6\ **Last updated:** [March 11, 2019, 12:27pm UTC](https://discuss.elastic.co/t/equivalent-to-sql-window-functions/44527 "2019-03-11T12:27:00Z")
Is there any way to implement SQL window functions? Here is my use case: Multiple events reported with "Type" and "Timestamp" fields. I'm looking for a way to extract the latest occurrence of each type. In SQL this ca… --- ## [Adding a document to elasticsearch database with high level rest api](https://discuss.elastic.co/t/adding-a-document-to-elasticsearch-database-with-high-level-rest-api/171732)
**Author:** [@Bengagi\_Foued](https://discuss.elastic.co/u/Bengagi_Foued)\ **Replies:** 5\ **Last updated:** [March 11, 2019, 12:08pm UTC](https://discuss.elastic.co/t/adding-a-document-to-elasticsearch-database-with-high-level-rest-api/171732 "2019-03-11T12:08:00Z")
IndexRequest request = new IndexRequest (); request.index("indextest") .type(type) .id(id) .source("title",v.getTitle(),"visState",v.getVisState(),"kibanaSavedObjectM… --- ## [Can ingest-attachment-plugin reads all the contents of attachment?](https://discuss.elastic.co/t/can-ingest-attachment-plugin-reads-all-the-contents-of-attachment/171707)
**Author:** [@pyerunka](https://discuss.elastic.co/u/pyerunka)\ **Replies:** 3\ **Last updated:** [March 11, 2019, 11:33am UTC](https://discuss.elastic.co/t/can-ingest-attachment-plugin-reads-all-the-contents-of-attachment/171707 "2019-03-11T11:33:58Z")
can we indexed attachment content using ingest-attachment-plugin? --- ## [Update document with another document/index](https://discuss.elastic.co/t/update-document-with-another-document-index/171714)
**Author:** [@andurif](https://discuss.elastic.co/u/andurif)\ **Replies:** 1\ **Last updated:** [March 11, 2019, 11:19am UTC](https://discuss.elastic.co/t/update-document-with-another-document-index/171714 "2019-03-11T11:19:52Z")
Hello, I try to update some documents of my index with the update\_by\_query API and adding a new field. I manage to do that manually for one document with the script option. For example: POST /my\_index/\_update\_by\_query … --- ## [How to package release version of elasticsearch 2.3.3](https://discuss.elastic.co/t/how-to-package-release-version-of-elasticsearch-2-3-3/171703)
**Author:** [@Ricky](https://discuss.elastic.co/u/Ricky)\ **Replies:** 5\ **Last updated:** [March 11, 2019, 11:08am UTC](https://discuss.elastic.co/t/how-to-package-release-version-of-elasticsearch-2-3-3/171703 "2019-03-11T11:08:29Z")
Somebody help me , i can't package relealse version from elasticsearch v.2.3.3 source. In high elasticsearch version, only execute ./gradlew assemble -Dbuild.snapshot=false. --- ## [Reindex multiple indices from remote with the same name](https://discuss.elastic.co/t/reindex-multiple-indices-from-remote-with-the-same-name/171674)
**Author:** [@hokkun-dayo](https://discuss.elastic.co/u/hokkun-dayo)\ **Replies:** 4\ **Last updated:** [March 11, 2019, 11:04am UTC](https://discuss.elastic.co/t/reindex-multiple-indices-from-remote-with-the-same-name/171674 "2019-03-11T11:04:19Z")
I'd like to use Reindex API with remote and create indices with the same name as sources. I tried: POST \_reindex { "source": { "remote": { "host": "http://myremote:9200" }, "index": "source-\*" }, … --- ## [Multiline config parameter to single line env variable](https://discuss.elastic.co/t/multiline-config-parameter-to-single-line-env-variable/171723)
**Author:** [@veepee78](https://discuss.elastic.co/u/veepee78)\ **Replies:** 0\ **Last updated:** [March 11, 2019, 10:14am UTC](https://discuss.elastic.co/t/multiline-config-parameter-to-single-line-env-variable/171723 "2019-03-11T10:14:02Z")
Can this be told to ES as a env variable somehow? I'd like to set this in docker-compose.yml instead of mounting a file. xpack.monitoring.exporters: id1: type: http host: \["http://es-mon-1:9200", "http://es-mon2:9200"… --- ## [Text analysis](https://discuss.elastic.co/t/text-analysis/171696)
**Author:** [@Priyasmini\_Sahoo](https://discuss.elastic.co/u/Priyasmini_Sahoo)\ **Replies:** 5\ **Last updated:** [March 11, 2019, 9:38am UTC](https://discuss.elastic.co/t/text-analysis/171696 "2019-03-11T09:38:00Z")
I have an index in Elasticsearch. It has fields with string values. Can I tokenize them? or Can I do text analysis in that index? --- ## [How to store the vectors (arrays) and get the Euclidean distance for the search request?](https://discuss.elastic.co/t/how-to-store-the-vectors-arrays-and-get-the-euclidean-distance-for-the-search-request/171710)
**Author:** [@psyapathy](https://discuss.elastic.co/u/psyapathy)\ **Replies:** 0\ **Last updated:** [March 11, 2019, 9:26am UTC](https://discuss.elastic.co/t/how-to-store-the-vectors-arrays-and-get-the-euclidean-distance-for-the-search-request/171710 "2019-03-11T09:26:47Z")
Hello. I have 2 questions I want to store arrays of images obtained from numpy (Python) Arrays, for example, are as follows: \[1.1, 2.2, 3.3, 4.4, 5.5, 6.6\] How can they be indexed? Let's say they are indexed. We have … [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1368) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1370)