# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1395 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1396 --- ## [Update\_by\_query list of updated/not updated](https://discuss.elastic.co/t/update-by-query-list-of-updated-not-updated/168432)
**Author:** [@Tagarito](https://discuss.elastic.co/u/Tagarito)\ **Replies:** 0\ **Last updated:** [February 14, 2019, 2:50pm UTC](https://discuss.elastic.co/t/update-by-query-list-of-updated-not-updated/168432 "2019-02-14T14:50:27Z")
Hello, When using the \_update API if we specify \_source:true we are able to retrieve the updated document. Is there any way to return a list of the updated/not updated documents when using the update\_by\_query api? exa… --- ## [Logstash File pattern are more , how to reduce the number of patterns](https://discuss.elastic.co/t/logstash-file-pattern-are-more-how-to-reduce-the-number-of-patterns/167861)
**Author:** [@priya08](https://discuss.elastic.co/u/priya08)\ **Replies:** 8\ **Last updated:** [February 14, 2019, 1:30pm UTC](https://discuss.elastic.co/t/logstash-file-pattern-are-more-how-to-reduce-the-number-of-patterns/167861 "2019-02-14T13:30:20Z")
Hi Team, We are using logstash file , in that we are having so many Grok patterns , the lines of file is very huge , for debugging we are facing issue. Are we having any other option ? --- ## [Hello, may i ask? can elasticsearch, logstash, kibana be installed on Windows? thanks](https://discuss.elastic.co/t/hello-may-i-ask-can-elasticsearch-logstash-kibana-be-installed-on-windows-thanks/168267)
**Author:** [@diooda](https://discuss.elastic.co/u/diooda)\ **Replies:** 5\ **Last updated:** [February 14, 2019, 1:28pm UTC](https://discuss.elastic.co/t/hello-may-i-ask-can-elasticsearch-logstash-kibana-be-installed-on-windows-thanks/168267 "2019-02-14T13:28:17Z")
hello, may i ask? can elasticsearch, logstash, kibana be installed on Windows? thanks --- ## [Red hat and max file descriptors \[4096\] for elasticsearch process is too low, increase to at least \[65536\]](https://discuss.elastic.co/t/red-hat-and-max-file-descriptors-4096-for-elasticsearch-process-is-too-low-increase-to-at-least-65536/168408)
**Author:** [@kirini](https://discuss.elastic.co/u/kirini)\ **Replies:** 1\ **Last updated:** [February 14, 2019, 1:07pm UTC](https://discuss.elastic.co/t/red-hat-and-max-file-descriptors-4096-for-elasticsearch-process-is-too-low-increase-to-at-least-65536/168408 "2019-02-14T13:07:29Z")
Hi I am trying to get sonarqube working on redhat server. sonarqube part seems to start ok, but when it tries to start elasticsearch that part fails. es.log files get this message 2019.02.14 14:04:02 INFO es\[\]\[o.e.t… --- ## [Questions regarding simple JSON logs](https://discuss.elastic.co/t/questions-regarding-simple-json-logs/168417)
**Author:** [@ABuse](https://discuss.elastic.co/u/ABuse)\ **Replies:** 0\ **Last updated:** [February 14, 2019, 1:02pm UTC](https://discuss.elastic.co/t/questions-regarding-simple-json-logs/168417 "2019-02-14T13:02:00Z")
I'm new to the Elastic Stack and have been attempting to input 4 simple single-line JSON files into elasticsearch without success. The format of the logs are: {"0":{"path":"\\Users\\Administrator\\AppData\\Local\\Microsoft\\W… --- ## [Keyword with special character](https://discuss.elastic.co/t/keyword-with-special-character/168209)
**Author:** [@srikanthkadem](https://discuss.elastic.co/u/srikanthkadem)\ **Replies:** 4\ **Last updated:** [February 14, 2019, 11:14am UTC](https://discuss.elastic.co/t/keyword-with-special-character/168209 "2019-02-14T11:14:55Z")
Hi , Can Anyone help how to request ES to treat the words saparated with a special character as single word. for e.g I have 100-01 in one of the column but when I try to search ES giving 100 & 01 both results. I read … --- ## [SIEM Event correlation with Elasticsearch and Logstash](https://discuss.elastic.co/t/siem-event-correlation-with-elasticsearch-and-logstash/168156)
**Author:** [@rao-uno](https://discuss.elastic.co/u/rao-uno)\ **Replies:** 3\ **Last updated:** [February 14, 2019, 10:40am UTC](https://discuss.elastic.co/t/siem-event-correlation-with-elasticsearch-and-logstash/168156 "2019-02-14T10:40:53Z")
Hello, I am using Wazuh with ELK as my SIEM tool. I am able to generate alerts on Kibana from my logs on the basis of ossec ruleset. I need to know find correlation between these events and need to know if this would be… --- ## [Elasticsearch Bandwidth](https://discuss.elastic.co/t/elasticsearch-bandwidth/168271)
**Author:** [@rgupta152](https://discuss.elastic.co/u/rgupta152)\ **Replies:** 3\ **Last updated:** [February 14, 2019, 8:16am UTC](https://discuss.elastic.co/t/elasticsearch-bandwidth/168271 "2019-02-14T08:16:42Z")
I am new to elasticsearch and have been trying to introduce in my company. Many colleagues have asked a question: how much bandwidth is required and, due to this, our production environment can impact. Please advise how … --- ## [Events not indexed although dynamic set to false (and not strict)](https://discuss.elastic.co/t/events-not-indexed-although-dynamic-set-to-false-and-not-strict/168349)
**Author:** [@pkaramol](https://discuss.elastic.co/u/pkaramol)\ **Replies:** 0\ **Last updated:** [February 14, 2019, 7:27am UTC](https://discuss.elastic.co/t/events-not-indexed-although-dynamic-set-to-false-and-not-strict/168349 "2019-02-14T07:27:03Z")
I had initially set my dynamic field of my template to strict. For some reason (perhaps some events out of the ones defined in the template got away) all events got 400, so I decided to change my dynamic field to false. … --- ## [The relation between Search Latency and Search Rate](https://discuss.elastic.co/t/the-relation-between-search-latency-and-search-rate/168326)
**Author:** [@yaoqijun](https://discuss.elastic.co/u/yaoqijun)\ **Replies:** 1\ **Last updated:** [February 14, 2019, 4:03am UTC](https://discuss.elastic.co/t/the-relation-between-search-latency-and-search-rate/168326 "2019-02-14T04:03:02Z")
it make me a little confused , Search Latency and Search Rate has inverse relationship. is the reason cache hit rate or cache time , any setting about that?? --- ## [Need to get result from outer object from inner properties](https://discuss.elastic.co/t/need-to-get-result-from-outer-object-from-inner-properties/168345)
**Author:** [@nayan\_mahale](https://discuss.elastic.co/u/nayan_mahale)\ **Replies:** 0\ **Last updated:** [February 14, 2019, 6:40am UTC](https://discuss.elastic.co/t/need-to-get-result-from-outer-object-from-inner-properties/168345 "2019-02-14T06:40:43Z")
i have mapping like below, "name": { "properties": { "en": { "type": "text", "fields": { "custom": { "type": "text", "analyzer": "custom\_english" }, "raw": { "type": "keyword", "index": true } } }, "hn": … --- ## [Bind to localhost in production mode](https://discuss.elastic.co/t/bind-to-localhost-in-production-mode/167995)
**Author:** [@eds1](https://discuss.elastic.co/u/eds1)\ **Replies:** 2\ **Last updated:** [February 14, 2019, 6:34am UTC](https://discuss.elastic.co/t/bind-to-localhost-in-production-mode/167995 "2019-02-14T06:34:05Z")
Hi, I have a use case that’s a little unusual. I have a node where discovery.type is set to single-node, I want to bind to localhost and put an Nginx reverse proxy in front of the node in order to provide authentication… --- ## [Ngram search whole word](https://discuss.elastic.co/t/ngram-search-whole-word/168336)
**Author:** [@Paddy\_Mahadeva](https://discuss.elastic.co/u/Paddy_Mahadeva)\ **Replies:** 1\ **Last updated:** [February 14, 2019, 6:29am UTC](https://discuss.elastic.co/t/ngram-search-whole-word/168336 "2019-02-14T06:29:43Z")
Hi, Trying to use ngram for first time to solve a search problem. We have a case where we need to do partial mach of input data. Lets say I have the following data in my user index in the name field Doc 1 : Jean Clau… --- ## [How to solve the issue 【Setting index.mapper.dynamic is deprecated since indices may not have more than one type anymore】](https://discuss.elastic.co/t/how-to-solve-the-issue-setting-index-mapper-dynamic-is-deprecated-since-indices-may-not-have-more-than-one-type-anymore/168333)
**Author:** [@Orli](https://discuss.elastic.co/u/Orli)\ **Replies:** 0\ **Last updated:** [February 14, 2019, 5:53am UTC](https://discuss.elastic.co/t/how-to-solve-the-issue-setting-index-mapper-dynamic-is-deprecated-since-indices-may-not-have-more-than-one-type-anymore/168333 "2019-02-14T05:53:10Z")
After I executed the following API, PUT /zipkin\*/\_settings { "index.blocks.read\_only\_allow\_delete": false } I got the following feedback. #! Deprecation: Setting index.mapper.dynamic is deprecated since indices may… --- ## [Using ParallelCompositeReader in ElasticSearch](https://discuss.elastic.co/t/using-parallelcompositereader-in-elasticsearch/168329)
**Author:** [@dextermorgan](https://discuss.elastic.co/u/dextermorgan)\ **Replies:** 0\ **Last updated:** [February 14, 2019, 4:02am UTC](https://discuss.elastic.co/t/using-parallelcompositereader-in-elasticsearch/168329 "2019-02-14T04:02:55Z")
Has anyone ever tried using Lucene's ParallelCompositeReader ? My use case is that I have few of frequently updating fields in an index and want to keep them as a separate index and use ParallelCompositeReader. I am in E… --- ## [Can't get the x-pack-tranport jar from the elastic offical maven url](https://discuss.elastic.co/t/cant-get-the-x-pack-tranport-jar-from-the-elastic-offical-maven-url/168325)
**Author:** [@iamazy](https://discuss.elastic.co/u/iamazy)\ **Replies:** 1\ **Last updated:** [February 14, 2019, 3:18am UTC](https://discuss.elastic.co/t/cant-get-the-x-pack-tranport-jar-from-the-elastic-offical-maven-url/168325 "2019-02-14T03:18:35Z")
I can't get the x-pack-tranport jar from the elastic offical maven url https://artifacts.elastic.co/maven，which way i can get it --- ## [Highlight not working with query\_string](https://discuss.elastic.co/t/highlight-not-working-with-query-string/168277)
**Author:** [@Alain\_Desilets](https://discuss.elastic.co/u/Alain_Desilets)\ **Replies:** 2\ **Last updated:** [February 14, 2019, 12:54am UTC](https://discuss.elastic.co/t/highlight-not-working-with-query-string/168277 "2019-02-14T00:54:29Z")
I am trying to highlight the results of a query as follows: { "size": 1, "\_source": "longDescription", "query" : { "query\_string": {"query": "desert"} }, "highlight" : { "fields" : {"longDesc… --- ## [Aggregating multi-field (array)](https://discuss.elastic.co/t/aggregating-multi-field-array/168310)
**Author:** [@Madhu\_V](https://discuss.elastic.co/u/Madhu_V)\ **Replies:** 0\ **Last updated:** [February 14, 2019, 12:18am UTC](https://discuss.elastic.co/t/aggregating-multi-field-array/168310 "2019-02-14T00:18:03Z")
I have a field in my doc as below { "Term": "\["Randomized","Placebo Control","Single Blind","Prevention","Parallel Assignment","Interventional"\]" } and wanna be able to aggregate by the individual terms like Randomiz… --- ## [VMWare monitoring](https://discuss.elastic.co/t/vmware-monitoring/168273)
**Author:** [@rgupta152](https://discuss.elastic.co/u/rgupta152)\ **Replies:** 1\ **Last updated:** [February 13, 2019, 11:22pm UTC](https://discuss.elastic.co/t/vmware-monitoring/168273 "2019-02-13T23:22:02Z")
I am new to elasticseach. My requirement is to capture the logs for VMWARE. Please suggest the module name and steps so that I can do. --- ## [Shipping logs from Central machine(Jenkins machine) to Elasticsearch](https://discuss.elastic.co/t/shipping-logs-from-central-machine-jenkins-machine-to-elasticsearch/168280)
**Author:** [@vijayakrishna.rg](https://discuss.elastic.co/u/vijayakrishna.rg)\ **Replies:** 1\ **Last updated:** [February 13, 2019, 10:03pm UTC](https://discuss.elastic.co/t/shipping-logs-from-central-machine-jenkins-machine-to-elasticsearch/168280 "2019-02-13T22:03:05Z")
Hi, We have Gatling Load test running on Containers and it generates logs on Container, as soon as done with Load test we will take a backup of logs into Central machine, once backup is done then Container will tear dow… --- ## [Cross Cluster Replication on Elastic Cloud](https://discuss.elastic.co/t/cross-cluster-replication-on-elastic-cloud/168299)
**Author:** [@saurav](https://discuss.elastic.co/u/saurav)\ **Replies:** 0\ **Last updated:** [February 13, 2019, 10:01pm UTC](https://discuss.elastic.co/t/cross-cluster-replication-on-elastic-cloud/168299 "2019-02-13T22:01:09Z")
Is this feature available on Elastic cloud yet? --- ## [Script not works correct in reindex operation when want to copy particular data from source](https://discuss.elastic.co/t/script-not-works-correct-in-reindex-operation-when-want-to-copy-particular-data-from-source/168296)
**Author:** [@kshi\_yelpale000](https://discuss.elastic.co/u/kshi_yelpale000)\ **Replies:** 0\ **Last updated:** [February 13, 2019, 9:27pm UTC](https://discuss.elastic.co/t/script-not-works-correct-in-reindex-operation-when-want-to-copy-particular-data-from-source/168296 "2019-02-13T21:27:36Z")
Here is the script and try... Created one 'demo' index PUT demo { "mappings": { "doc":{ "properties": { "field1":{ "type": "long" }, "field2":{ "type": "text" } } } } } now inserted two documents PUT de… --- ## [Highlight the result of tokenization when viewing full text](https://discuss.elastic.co/t/highlight-the-result-of-tokenization-when-viewing-full-text/168292)
**Author:** [@1fmusic](https://discuss.elastic.co/u/1fmusic)\ **Replies:** 0\ **Last updated:** [February 13, 2019, 9:02pm UTC](https://discuss.elastic.co/t/highlight-the-result-of-tokenization-when-viewing-full-text/168292 "2019-02-13T21:02:30Z")
I have documents with duplicate sentences in the 'notes' field. I was able to tokenize this field and get only the original sentences and their offsets. When the user views this "notes" field, I would like to highlight… --- ## [ELK architecture optimization](https://discuss.elastic.co/t/elk-architecture-optimization/168282)
**Author:** [@maxhyjal](https://discuss.elastic.co/u/maxhyjal)\ **Replies:** 0\ **Last updated:** [February 13, 2019, 8:15pm UTC](https://discuss.elastic.co/t/elk-architecture-optimization/168282 "2019-02-13T20:15:28Z")
I have a question about optimizing ELK architecture. Currently I have set up a ELK stack with 2 logstash servers, with 4 elasticsearch servers (1 client node, 3 data nodes) behind a pair of haproxy nodes. And there is … --- ## [Recognizing succeeded vs failed tasks w/ the Task Management API](https://discuss.elastic.co/t/recognizing-succeeded-vs-failed-tasks-w-the-task-management-api/168281)
**Author:** [@bobbyi](https://discuss.elastic.co/u/bobbyi)\ **Replies:** 0\ **Last updated:** [February 13, 2019, 7:45pm UTC](https://discuss.elastic.co/t/recognizing-succeeded-vs-failed-tasks-w-the-task-management-api/168281 "2019-02-13T19:45:48Z")
The documentation for the Task Management API shows how to get the status of a task as json. However, it does not indicate how to tell from that json whether a task has completed successfully. I don't want to block on … --- ## [\[No code for\] Example of using scrollAsync with the java High Level Rest Client](https://discuss.elastic.co/t/no-code-for-example-of-using-scrollasync-with-the-java-high-level-rest-client/165126)
**Author:** [@juanaramis](https://discuss.elastic.co/u/juanaramis)\ **Replies:** 9\ **Last updated:** [February 13, 2019, 6:34pm UTC](https://discuss.elastic.co/t/no-code-for-example-of-using-scrollasync-with-the-java-high-level-rest-client/165126 "2019-02-13T18:34:22Z")
Hi there, Need an example of using "searchScrollAsync" with the High Level Rest Client 5.6 version The documentation is quite light for that: https://www.elastic.co/guide/en/elasticsearch/client/java-rest/current/java… --- ## [Data nodes on windows, Master node in Rancher (docker/k8)](https://discuss.elastic.co/t/data-nodes-on-windows-master-node-in-rancher-docker-k8/168264)
**Author:** [@Dan-Petter\_Jacobsen](https://discuss.elastic.co/u/Dan-Petter_Jacobsen)\ **Replies:** 1\ **Last updated:** [February 13, 2019, 6:23pm UTC](https://discuss.elastic.co/t/data-nodes-on-windows-master-node-in-rancher-docker-k8/168264 "2019-02-13T18:23:03Z")
Hi We are setting up a cluster where two data nodes are in windows. 3 master nodes are inside rancher. Data (two nodes): discovery.zen.ping.unicast.hosts: ip.address.to.master, ip.to.other.data Master (3 pods in on … --- ## [Elastic shards](https://discuss.elastic.co/t/elastic-shards/168106)
**Author:** [@Mysterious\_Ze](https://discuss.elastic.co/u/Mysterious_Ze)\ **Replies:** 4\ **Last updated:** [February 13, 2019, 5:47pm UTC](https://discuss.elastic.co/t/elastic-shards/168106 "2019-02-13T17:47:33Z")
Hello After installing an elk stack with all configs as default and creating our dashboards, we are experiencing 2 major issues: elastic does not work while reaching 95% of disk space. Is there any fine tuning regard… --- ## [Searching documents indexed via ingest-attachment](https://discuss.elastic.co/t/searching-documents-indexed-via-ingest-attachment/167960)
**Author:** [@Rohan\_Dodeja](https://discuss.elastic.co/u/Rohan_Dodeja)\ **Replies:** 2\ **Last updated:** [February 13, 2019, 5:28pm UTC](https://discuss.elastic.co/t/searching-documents-indexed-via-ingest-attachment/167960 "2019-02-13T17:28:18Z")
Hi All, i'm new to elastic search and wanted to index files with some of the attributes like Author, Title, Subject, Category, Community etc. How far i reached :- i was able to create a attachment pipeline and was abl… --- ## [Curator returns empty output for elasticsearch user](https://discuss.elastic.co/t/curator-returns-empty-output-for-elasticsearch-user/168112)
**Author:** [@George\_Wainwright](https://discuss.elastic.co/u/George_Wainwright)\ **Replies:** 20\ **Last updated:** [February 13, 2019, 5:08pm UTC](https://discuss.elastic.co/t/curator-returns-empty-output-for-elasticsearch-user/168112 "2019-02-13T17:08:10Z")
On my Ubuntu Xenial host curator doesn't work at all under elasticsearch user: root@elastic1:~# su - elasticsearch -s /bin/bash elasticsearch@elastic1:~ export LC\_ALL=C.UTF-8; export LANG=C.UTF-8 elasticsearch@elastic… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1394) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1396)