# Elasticsearch

**URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1384

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 1385

---

## [After upgrading from Elasticsearch 6.5 to 6.6 - All shards failed](https://discuss.elastic.co/t/after-upgrading-from-elasticsearch-6-5-to-6-6-all-shards-failed/167366)

<div class="topic-metadata">

**Author:** [@rafael.gumiero](https://discuss.elastic.co/u/rafael.gumiero)\
**Replies:** 2\
**Last updated:** [February 25, 2019, 8:27am UTC](https://discuss.elastic.co/t/after-upgrading-from-elasticsearch-6-5-to-6-6-all-shards-failed/167366 "2019-02-25T08:27:59Z")

</div>

Hi Team, I have performed update via repository and the following error is occurring in Elasticsearch: Environment: uname -r 3.10.0-957.5.1.el7.x86\_64 cat /etc/redhat-release Red Hat Enterprise Linux Server release 7…

---

## [Create a Scripted field](https://discuss.elastic.co/t/create-a-scripted-field/169763)

<div class="topic-metadata">

**Author:** [@examin](https://discuss.elastic.co/u/examin)\
**Replies:** 1\
**Last updated:** [February 25, 2019, 8:18am UTC](https://discuss.elastic.co/t/create-a-scripted-field/169763 "2019-02-25T08:18:19Z")

</div>

I have a field Recieved\_Date , I need two more field month and day from Recieved\_Date to query easily. What i sbest way to do so, i think my options are to re-index whole data with a new mapping or create a scripted f…

---

## [Data loss when old master node dead and startup again](https://discuss.elastic.co/t/data-loss-when-old-master-node-dead-and-startup-again/169506)

<div class="topic-metadata">

**Author:** [@jffree](https://discuss.elastic.co/u/jffree)\
**Replies:** 15\
**Last updated:** [February 25, 2019, 7:08am UTC](https://discuss.elastic.co/t/data-loss-when-old-master-node-dead-and-startup-again/169506 "2019-02-25T07:08:55Z")

</div>

Describe the feature: Elasticsearch version (bin/elasticsearch --version): elasticsearch/elasticsearch-oss:6.3.2 docker version: 18.03.1-ce OS version (uname -a if on a Unix-like system): centos7.5 Description of the…

---

## [@timestamp in Elasticsearch](https://discuss.elastic.co/t/timestamp-in-elasticsearch/169742)

<div class="topic-metadata">

**Author:** [@sparkjonez](https://discuss.elastic.co/u/sparkjonez)\
**Replies:** 4\
**Last updated:** [February 25, 2019, 4:41am UTC](https://discuss.elastic.co/t/timestamp-in-elasticsearch/169742 "2019-02-25T04:41:20Z")

</div>

Hello, My understanding is that the @timestamp field I see in Kibana is set when Logstash receives an event and forwards it to the Elasticsearch cluster. Is @timestamp change or modified under any other circumstances? F…

---

## [Documentation: Anchor link tooltips](https://discuss.elastic.co/t/documentation-anchor-link-tooltips/169747)

<div class="topic-metadata">

**Author:** [@Darren\_Meiss](https://discuss.elastic.co/u/Darren_Meiss)\
**Replies:** 2\
**Last updated:** [February 25, 2019, 3:02am UTC](https://discuss.elastic.co/t/documentation-anchor-link-tooltips/169747 "2019-02-25T03:02:42Z")

</div>

While making some edits to the Elasticsearch docs, I've noticed that the link tooltips for anchor links append the word "edit" to the tooltip text, e.g. the link "Search Cancellation" has a tooltip of "Search Cancellatio…

---

## [Elasticsearch queries in scripts](https://discuss.elastic.co/t/elasticsearch-queries-in-scripts/169745)

<div class="topic-metadata">

**Author:** [@krambambuli](https://discuss.elastic.co/u/krambambuli)\
**Replies:** 0\
**Last updated:** [February 24, 2019, 9:29pm UTC](https://discuss.elastic.co/t/elasticsearch-queries-in-scripts/169745 "2019-02-24T21:29:17Z")

</div>

Hi, I'm trying to figure out whether Elasticsearch might be a reasonable choice for our needs. We have time-indexed location data for several vehicles and want to know at what points in time the vehicles leave certain r…

---

## [Index setting read\_only\_allow\_delete does not allow \_delete\_by\_query](https://discuss.elastic.co/t/index-setting-read-only-allow-delete-does-not-allow-delete-by-query/169719)

<div class="topic-metadata">

**Author:** [@iamredlus](https://discuss.elastic.co/u/iamredlus)\
**Replies:** 3\
**Last updated:** [February 24, 2019, 8:55pm UTC](https://discuss.elastic.co/t/index-setting-read-only-allow-delete-does-not-allow-delete-by-query/169719 "2019-02-24T20:55:01Z")

</div>

Hi After applying read\_only\_allow\_delete to an index - PUT /index\_name/\_settings { "index": { "blocks": { "read\_only\_allow\_delete": true } } } Issuing a \_delete\_by\_query produces t…

---

## [Multi tenant elasticsearch deployment](https://discuss.elastic.co/t/multi-tenant-elasticsearch-deployment/169622)

<div class="topic-metadata">

**Author:** [@Animesh\_Agarwal](https://discuss.elastic.co/u/Animesh_Agarwal)\
**Replies:** 3\
**Last updated:** [February 24, 2019, 8:35pm UTC](https://discuss.elastic.co/t/multi-tenant-elasticsearch-deployment/169622 "2019-02-24T20:35:22Z")

</div>

I need some advice on deploying elasticsearch for multi-tenant application. I have 3 options: 1 index for each tenant One big index for all the tenants with default routing One big index for all the tenants with custo…

---

## [JSON & Index conversion factors Elastic sizing factors](https://discuss.elastic.co/t/json-index-conversion-factors-elastic-sizing-factors/169211)

<div class="topic-metadata">

**Author:** [@manikandanid](https://discuss.elastic.co/u/manikandanid)\
**Replies:** 1\
**Last updated:** [February 24, 2019, 8:10pm UTC](https://discuss.elastic.co/t/json-index-conversion-factors-elastic-sizing-factors/169211 "2019-02-24T20:10:33Z")

</div>

I am trying to come up with the cluster sizing for our centralised logging system. On reading the factors influencing the size i came across two terms JSON conversion factor Index conversion factor Not sure what are …

---

## [Error trying to index products](https://discuss.elastic.co/t/error-trying-to-index-products/169715)

<div class="topic-metadata">

**Author:** [@hgarnelo](https://discuss.elastic.co/u/hgarnelo)\
**Replies:** 1\
**Last updated:** [February 24, 2019, 7:37pm UTC](https://discuss.elastic.co/t/error-trying-to-index-products/169715 "2019-02-24T19:37:55Z")

</div>

When trying to index products, 80000, after a few seconds the following error message appears: \[PrestaShop\] Fatal error in module file :/var/www/xxxxxx.es/modules/elasticsearchpro/vendor/elasticsearch/elasticsearch/src/…

---

## [Hash function in painless](https://discuss.elastic.co/t/hash-function-in-painless/169721)

<div class="topic-metadata">

**Author:** [@Yaming\_Ma](https://discuss.elastic.co/u/Yaming_Ma)\
**Replies:** 0\
**Last updated:** [February 24, 2019, 12:58pm UTC](https://discuss.elastic.co/t/hash-function-in-painless/169721 "2019-02-24T12:58:24Z")

</div>

Hi guys, I'm new to ES painless script. Is there any approach to do MD5 hash on certain fields in painless? I checked the API reference but found no such API. Or what the most efficient approach is if I want to do run M…

---

## [Print ElasticSearch logs in java console](https://discuss.elastic.co/t/print-elasticsearch-logs-in-java-console/169710)

<div class="topic-metadata">

**Author:** [@compsecstudent](https://discuss.elastic.co/u/compsecstudent)\
**Replies:** 0\
**Last updated:** [February 24, 2019, 9:26am UTC](https://discuss.elastic.co/t/print-elasticsearch-logs-in-java-console/169710 "2019-02-24T09:26:46Z")

</div>

I want to use the logs from the Get request below in my my Maven JavaFX application, for now I just want to print the data out to console (and then move on to adding it into an array). Would this be possible? I've tried…

---

## [Upgrade from 2.X to 6.6](https://discuss.elastic.co/t/upgrade-from-2-x-to-6-6/169678)

<div class="topic-metadata">

**Author:** [@The-Prasun](https://discuss.elastic.co/u/The-Prasun)\
**Replies:** 3\
**Last updated:** [February 24, 2019, 8:50am UTC](https://discuss.elastic.co/t/upgrade-from-2-x-to-6-6/169678 "2019-02-24T08:50:37Z")

</div>

We are trying to upgraded from ES 2.2 to ES 6.6. Can anyone can help us with best possible way to do it? Do we need to upgrade to 5.X first before upgrading to 6.X? Thanks in advance.

---

## [Nested aggregations with multiple nested fields](https://discuss.elastic.co/t/nested-aggregations-with-multiple-nested-fields/169244)

<div class="topic-metadata">

**Author:** [@sesha](https://discuss.elastic.co/u/sesha)\
**Replies:** 2\
**Last updated:** [February 24, 2019, 6:49am UTC](https://discuss.elastic.co/t/nested-aggregations-with-multiple-nested-fields/169244 "2019-02-24T06:49:19Z")

</div>

I have example data as below, But I need to aggregate teams and players with multiple nested fields ("foot-ball-teams", "cricket-teams"). I have to get output unique teams from "foot-ball-teams", "cricket-teams" and uni…

---

## [What ports are used to communicate between Elasticsearch/Logstash/Kibana?](https://discuss.elastic.co/t/what-ports-are-used-to-communicate-between-elasticsearch-logstash-kibana/169703)

<div class="topic-metadata">

**Author:** [@wad11656](https://discuss.elastic.co/u/wad11656)\
**Replies:** 1\
**Last updated:** [February 24, 2019, 6:19am UTC](https://discuss.elastic.co/t/what-ports-are-used-to-communicate-between-elasticsearch-logstash-kibana/169703 "2019-02-24T06:19:49Z")

</div>

I'm trying to design a topology diagram indicating with IP:port of how each service is communicating with one another. How would I fix and complete this diagram? I'm sending logs through Logstash I'm using Nginx with…

---

## [Query by the sum of two or more fields](https://discuss.elastic.co/t/query-by-the-sum-of-two-or-more-fields/169682)

<div class="topic-metadata">

**Author:** [@hello](https://discuss.elastic.co/u/hello)\
**Replies:** 3\
**Last updated:** [February 23, 2019, 11:32pm UTC](https://discuss.elastic.co/t/query-by-the-sum-of-two-or-more-fields/169682 "2019-02-23T23:32:11Z")

</div>

Let's say I have the following mapping with hundreds of millions of docs currently populating the index: { "properties": { "a": { "type": "integer" }, "b": { "type": "integer" }, "c": { "type": "integer" }…

---

## [Recommended shard size and data node instance type in AWS](https://discuss.elastic.co/t/recommended-shard-size-and-data-node-instance-type-in-aws/169676)

<div class="topic-metadata">

**Author:** [@Ijas\_ahamed](https://discuss.elastic.co/u/Ijas_ahamed)\
**Replies:** 1\
**Last updated:** [February 23, 2019, 6:44pm UTC](https://discuss.elastic.co/t/recommended-shard-size-and-data-node-instance-type-in-aws/169676 "2019-02-23T18:44:26Z")

</div>

I am developing elastic search with about 17B documents per index(daily index) and 90 indices in total. Each document will have a size of less than 1Kb. Since we are using per day index, only one index will be hot write…

---

## [Partial update/add/delete of a document using java](https://discuss.elastic.co/t/partial-update-add-delete-of-a-document-using-java/169641)

<div class="topic-metadata">

**Author:** [@nikuland](https://discuss.elastic.co/u/nikuland)\
**Replies:** 10\
**Last updated:** [February 23, 2019, 6:37pm UTC](https://discuss.elastic.co/t/partial-update-add-delete-of-a-document-using-java/169641 "2019-02-23T18:37:54Z")

</div>

I would like to add/update/delete nested documents in java. If there is example can someone point me that please. Is it done only through scripts or there are api's to do dthat.

---

## [Elasticsearch: connection issue](https://discuss.elastic.co/t/elasticsearch-connection-issue/169665)

<div class="topic-metadata">

**Author:** [@MikeBY](https://discuss.elastic.co/u/MikeBY)\
**Replies:** 0\
**Last updated:** [February 23, 2019, 1:40pm UTC](https://discuss.elastic.co/t/elasticsearch-connection-issue/169665 "2019-02-23T13:40:34Z")

</div>

Hi all. Maybe someone can help. I can't connect to elastic from other host. Elastic configured to bind on "network.host: 10.254.1.88" Log shows the following: \[2019-02-23T16:17:37,387\]\[INFO \]\[o.e.t.TransportService …

---

## [Racing the patched 6.4.0 source](https://discuss.elastic.co/t/racing-the-patched-6-4-0-source/165587)

<div class="topic-metadata">

**Author:** [@Mikhail\_Khludnev](https://discuss.elastic.co/u/Mikhail_Khludnev)\
**Replies:** 6\
**Last updated:** [February 23, 2019, 1:22pm UTC](https://discuss.elastic.co/t/racing-the-patched-6-4-0-source/165587 "2019-02-23T13:22:29Z")

</div>

Hello, Thanks for the great tool. I'm trying to benchmark patched 6.4.0 source, thus I use --revision=current, but it seems like it uses master branch for teams config (~/.rally/benchmarks/teams/default) that pull 7.0 c…

---

## [Balance New Data Among Nodes](https://discuss.elastic.co/t/balance-new-data-among-nodes/169610)

<div class="topic-metadata">

**Author:** [@codeboy](https://discuss.elastic.co/u/codeboy)\
**Replies:** 2\
**Last updated:** [February 23, 2019, 7:13am UTC](https://discuss.elastic.co/t/balance-new-data-among-nodes/169610 "2019-02-23T07:13:54Z")

</div>

I am doing high volume inserts into a cluster. Sometimes we take a node down for maintenance, or failure. When the node comes back up, the disk utilization on the node is lower than the other nodes. This causes new sh…

---

## [Problem with keystore password was incorrect](https://discuss.elastic.co/t/problem-with-keystore-password-was-incorrect/168950)

<div class="topic-metadata">

**Author:** [@Behzad\_Rezaie](https://discuss.elastic.co/u/Behzad_Rezaie)\
**Replies:** 6\
**Last updated:** [February 23, 2019, 6:31am UTC](https://discuss.elastic.co/t/problem-with-keystore-password-was-incorrect/168950 "2019-02-23T06:31:25Z")

</div>

Hi pals, I have configured my elasticsearch.yml as follow: xpack.security.audit.enabled: true xpack.security.enabled: true xpack.security.transport.ssl.enabled: true xpack.security.transport.ssl.verification\_mode: cer…

---

## [ILM of index naming rule](https://discuss.elastic.co/t/ilm-of-index-naming-rule/169350)

<div class="topic-metadata">

**Author:** [@Izek](https://discuss.elastic.co/u/Izek)\
**Replies:** 2\
**Last updated:** [February 23, 2019, 2:04am UTC](https://discuss.elastic.co/t/ilm-of-index-naming-rule/169350 "2019-02-23T02:04:49Z")

</div>

Hi folks, Would it be possible to setup the shrink index name with prefix or suffix in ILM? for example: original name: metrics-2019.02.21 shrink name: metrics-2019.02.21-shrink

---

## [Can't seem to register a snapshot repository with AWS S3](https://discuss.elastic.co/t/cant-seem-to-register-a-snapshot-repository-with-aws-s3/169026)

<div class="topic-metadata">

**Author:** [@3minus1](https://discuss.elastic.co/u/3minus1)\
**Replies:** 1\
**Last updated:** [February 23, 2019, 1:53am UTC](https://discuss.elastic.co/t/cant-seem-to-register-a-snapshot-repository-with-aws-s3/169026 "2019-02-23T01:53:04Z")

</div>

I'm running an Elasticsearch V6.3.2 cluster on Kubernetes, and I've installed the repository-s3 plugin. I've added my AWS Access Key and Secret Key to the elasticsearch.keystore. I'm trying to register my snapshot repo…

---

## [Elasticsearch: Post migration to new server encountered: Field data loading is forbidden on \<fieldname\>](https://discuss.elastic.co/t/elasticsearch-post-migration-to-new-server-encountered-field-data-loading-is-forbidden-on-fieldname/169070)

<div class="topic-metadata">

**Author:** [@vnukal](https://discuss.elastic.co/u/vnukal)\
**Replies:** 0\
**Last updated:** [February 19, 2019, 4:50pm UTC](https://discuss.elastic.co/t/elasticsearch-post-migration-to-new-server-encountered-field-data-loading-is-forbidden-on-fieldname/169070 "2019-02-19T16:50:16Z")

</div>

Hi All, Recently had to migrate a 2-node elasticsearch cluster from old (old\_machine\_1, old\_machine\_2) to new servers(new\_machine\_1,new\_machine\_2). The data directories (~55GB each) was copied between the 2 sets of mach…

---

## [Timezone offset for the day starting at +00:00 after applying an offset](https://discuss.elastic.co/t/timezone-offset-for-the-day-starting-at-00-00-after-applying-an-offset/169621)

<div class="topic-metadata">

**Author:** [@srizzle](https://discuss.elastic.co/u/srizzle)\
**Replies:** 0\
**Last updated:** [February 22, 2019, 6:23pm UTC](https://discuss.elastic.co/t/timezone-offset-for-the-day-starting-at-00-00-after-applying-an-offset/169621 "2019-02-22T18:23:29Z")

</div>

{ "size": 0, "query": { "range": { "escalationDate": { "gte": "now-6d/d", "time\_zone": "\[(${timezoneOffset})\]" } } }, "aggs": { …

---

## [Separate Query Aggregation Nodes from Data Nodes](https://discuss.elastic.co/t/separate-query-aggregation-nodes-from-data-nodes/168727)

<div class="topic-metadata">

**Author:** [@codeboy](https://discuss.elastic.co/u/codeboy)\
**Replies:** 4\
**Last updated:** [February 22, 2019, 4:43pm UTC](https://discuss.elastic.co/t/separate-query-aggregation-nodes-from-data-nodes/168727 "2019-02-22T16:43:19Z")

</div>

Is there a way to make the data ingest load separate from the query aggregation activity? My goal is to allocate some data nodes that can handle the ingest and low level query load. But for higher level aggregation for…

---

## [\[bool\] query does not support \[range\]](https://discuss.elastic.co/t/bool-query-does-not-support-range/169536)

<div class="topic-metadata">

**Author:** [@rajkumar\_E1](https://discuss.elastic.co/u/rajkumar_E1)\
**Replies:** 1\
**Last updated:** [February 22, 2019, 2:58pm UTC](https://discuss.elastic.co/t/bool-query-does-not-support-range/169536 "2019-02-22T14:58:20Z")

</div>

Dear Team, I am working on to filter record with match + range filter, but its throw following issue "\[bool\] query does not support \[range\]" What I did: Array ( \[index\] =\> index\_name \[type\] =\> …

---

## [What will be the beneficial if I do not analyze a text field?](https://discuss.elastic.co/t/what-will-be-the-beneficial-if-i-do-not-analyze-a-text-field/169408)

<div class="topic-metadata">

**Author:** [@Kramer\_Li](https://discuss.elastic.co/u/Kramer_Li)\
**Replies:** 3\
**Last updated:** [February 22, 2019, 2:55pm UTC](https://discuss.elastic.co/t/what-will-be-the-beneficial-if-i-do-not-analyze-a-text-field/169408 "2019-02-22T14:55:33Z")

</div>

I find that some of my data has to be stored as text field (The are long, not used for sort, aggregation). But I also do not need to search based on the content of these fields. So I think I should specify the field not…

---

## [Snapshot backup to AWS s3](https://discuss.elastic.co/t/snapshot-backup-to-aws-s3/169397)

<div class="topic-metadata">

**Author:** [@Phandora](https://discuss.elastic.co/u/Phandora)\
**Replies:** 4\
**Last updated:** [February 22, 2019, 2:51pm UTC](https://discuss.elastic.co/t/snapshot-backup-to-aws-s3/169397 "2019-02-22T14:51:14Z")

</div>

Hi, Could I create a snapshot backup on AWS s3 from some specific index pattern and later create another one without saving the index that already exist on the previous snapshot? I know it could be done by day just cons…

[Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1383)

[Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1385)
