# Elasticsearch

**URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1410

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 1411

---

## [Time out error](https://discuss.elastic.co/t/time-out-error/166401)

<div class="topic-metadata">

**Author:** [@vahid\_heidari](https://discuss.elastic.co/u/vahid_heidari)\
**Replies:** 0\
**Last updated:** [January 30, 2019, 5:02pm UTC](https://discuss.elastic.co/t/time-out-error/166401 "2019-01-30T17:02:17Z")

</div>

hi my node js app can not connect to elasticsearch and return time out error plz help thanks cluster status : { "\_nodes": { "total": 1, "successful": 1, "failed": 0 }, "cluster\_name": "elasticsearch", "cluste…

---

## [Unique token filter not working with array of strings](https://discuss.elastic.co/t/unique-token-filter-not-working-with-array-of-strings/166353)

<div class="topic-metadata">

**Author:** [@Fabrizio\_Fortino](https://discuss.elastic.co/u/Fabrizio_Fortino)\
**Replies:** 0\
**Last updated:** [January 30, 2019, 12:13pm UTC](https://discuss.elastic.co/t/unique-token-filter-not-working-with-array-of-strings/166353 "2019-01-30T12:13:58Z")

</div>

Continuing the discussion from Unique token filter with string array: I'd like to raise again this question that has not been answered. The unique token filter (https://www.elastic.co/guide/en/elasticsearch/reference/c…

---

## [How to upgrade from an older Elasticsearch 1.X ELK stack to a recent one 6.X](https://discuss.elastic.co/t/how-to-upgrade-from-an-older-elasticsearch-1-x-elk-stack-to-a-recent-one-6-x/166238)

<div class="topic-metadata">

**Author:** [@vfiset](https://discuss.elastic.co/u/vfiset)\
**Replies:** 14\
**Last updated:** [January 30, 2019, 4:43pm UTC](https://discuss.elastic.co/t/how-to-upgrade-from-an-older-elasticsearch-1-x-elk-stack-to-a-recent-one-6-x/166238 "2019-01-30T16:43:07Z")

</div>

We have an on premise ELK stack. We are using ES 1.5, Logstash 5.3 to pull data from kafka and Kibana 3 for dashboards. We use the elk stack to store and search all our application logs. Nothing more. We want to move to…

---

## [How to get a count of new users comparing two date ranges](https://discuss.elastic.co/t/how-to-get-a-count-of-new-users-comparing-two-date-ranges/166396)

<div class="topic-metadata">

**Author:** [@Daniel\_Zuluaga](https://discuss.elastic.co/u/Daniel_Zuluaga)\
**Replies:** 0\
**Last updated:** [January 30, 2019, 4:23pm UTC](https://discuss.elastic.co/t/how-to-get-a-count-of-new-users-comparing-two-date-ranges/166396 "2019-01-30T16:23:29Z")

</div>

Hello everyone! So I'm having trouble with a query that I have working on SQL (Impala) but can't get to work on ElasticSearch. On Impala I have the following table: trx\_date customer\_id commerce\_id 20181201 1 1…

---

## [\_cat API from Java rest client?](https://discuss.elastic.co/t/cat-api-from-java-rest-client/166390)

<div class="topic-metadata">

**Author:** [@Alwin](https://discuss.elastic.co/u/Alwin)\
**Replies:** 0\
**Last updated:** [January 30, 2019, 3:39pm UTC](https://discuss.elastic.co/t/cat-api-from-java-rest-client/166390 "2019-01-30T15:39:33Z")

</div>

Is there a way to get information on shard size for an index from the Java rest client? I could not find it in the documentation (Elasticsearch or Javadoc).

---

## [Mapping types \_type or type or both](https://discuss.elastic.co/t/mapping-types-type-or-type-or-both/166359)

<div class="topic-metadata">

**Author:** [@gormanst](https://discuss.elastic.co/u/gormanst)\
**Replies:** 10\
**Last updated:** [January 30, 2019, 3:28pm UTC](https://discuss.elastic.co/t/mapping-types-type-or-type-or-both/166359 "2019-01-30T15:28:15Z")

</div>

Is type, as used below, being removed from elasticsearch? PUT \_template/dogpound\_mpds { "index\_patterns": \["dogpound\_mpds\*"\], "mappings" : { "\_doc" : { "dynamic": "true", "properties": { "t…

---

## [Elastic - spark : deprecated search\_type=scan showing up in post url from spark 2.4 and returning 0 hits](https://discuss.elastic.co/t/elastic-spark-deprecated-search-type-scan-showing-up-in-post-url-from-spark-2-4-and-returning-0-hits/166383)

<div class="topic-metadata">

**Author:** [@johnmarshall](https://discuss.elastic.co/u/johnmarshall)\
**Replies:** 1\
**Last updated:** [January 30, 2019, 3:26pm UTC](https://discuss.elastic.co/t/elastic-spark-deprecated-search-type-scan-showing-up-in-post-url-from-spark-2-4-and-returning-0-hits/166383 "2019-01-30T15:26:53Z")

</div>

Hi Team Am trying to fetch data from elastic server into spark 2.4 environment using "org.elasticsearch.spark.sql" connector, but even though i got all the configs right, there is no data received on the spark engine U…

---

## [Filter documents using AND OR on array field](https://discuss.elastic.co/t/filter-documents-using-and-or-on-array-field/166330)

<div class="topic-metadata">

**Author:** [@Wassim\_Ben\_Amor](https://discuss.elastic.co/u/Wassim_Ben_Amor)\
**Replies:** 1\
**Last updated:** [January 30, 2019, 3:14pm UTC](https://discuss.elastic.co/t/filter-documents-using-and-or-on-array-field/166330 "2019-01-30T15:14:20Z")

</div>

Hello, I have documents having a field called "filters" which is an array containing strings. Example : \['A','B','C'\] I want to make queries to filter documents, example of a query : ((('A' and 'C') or 'B') and ('A' o…

---

## [Mail using Postfix and Alerting not working](https://discuss.elastic.co/t/mail-using-postfix-and-alerting-not-working/166375)

<div class="topic-metadata">

**Author:** [@Miguel\_Plazas](https://discuss.elastic.co/u/Miguel_Plazas)\
**Replies:** 0\
**Last updated:** [January 30, 2019, 2:23pm UTC](https://discuss.elastic.co/t/mail-using-postfix-and-alerting-not-working/166375 "2019-01-30T14:23:49Z")

</div>

Hi, currently i'm trying to send a mail using postfix on my own localhost, where i have instaled elastic. Currently this is main.cf from /etc/postfix/main.cf # See /usr/share/postfix/main.cf.dist for a commented, more c…

---

## [Elasticsearch - Garbage Collection Issues](https://discuss.elastic.co/t/elasticsearch-garbage-collection-issues/166230)

<div class="topic-metadata">

**Author:** [@Timothy\_Pangburn](https://discuss.elastic.co/u/Timothy_Pangburn)\
**Replies:** 5\
**Last updated:** [January 30, 2019, 2:17pm UTC](https://discuss.elastic.co/t/elasticsearch-garbage-collection-issues/166230 "2019-01-30T14:17:28Z")

</div>

Our Elasticsearch cluster is experiencing quite a few issues with garbage collection and "stop the world" events. My questions. Is there any benefit from using Oracle Java vs the OpenJDK? I am using the OpenJDK. Can …

---

## [Integration Testing for a Custom Plugin - Security Policy Issue](https://discuss.elastic.co/t/integration-testing-for-a-custom-plugin-security-policy-issue/166370)

<div class="topic-metadata">

**Author:** [@Oussema\_Samet](https://discuss.elastic.co/u/Oussema_Samet)\
**Replies:** 0\
**Last updated:** [January 30, 2019, 2:04pm UTC](https://discuss.elastic.co/t/integration-testing-for-a-custom-plugin-security-policy-issue/166370 "2019-01-30T14:04:21Z")

</div>

OS: Mac OS 10.13.6 JDK: 1.8.0\_191 Elasticsearch: 6.5.4 Dependencies management: Maven 3.6.0 I 've developed a Custom ES plugin with custom security policy, so I added the plugin-security.policy file wich containing t…

---

## [Date parser in pipeline ignores half of the day](https://discuss.elastic.co/t/date-parser-in-pipeline-ignores-half-of-the-day/166362)

<div class="topic-metadata">

**Author:** [@k-troska](https://discuss.elastic.co/u/k-troska)\
**Replies:** 1\
**Last updated:** [January 30, 2019, 1:59pm UTC](https://discuss.elastic.co/t/date-parser-in-pipeline-ignores-half-of-the-day/166362 "2019-01-30T13:59:43Z")

</div>

Hi, I have problem that filebeat is logging incorrect time when parasing agains time of the day. Example: { "pipeline": { "version": 1, "processors": \[ { "grok": { "field": "message", "patterns": \[ "%{ADHOC\_T…

---

## [Search text with both exact values within double quotes and the other values](https://discuss.elastic.co/t/search-text-with-both-exact-values-within-double-quotes-and-the-other-values/166364)

<div class="topic-metadata">

**Author:** [@Gokulprasath\_Narayan](https://discuss.elastic.co/u/Gokulprasath_Narayan)\
**Replies:** 0\
**Last updated:** [January 30, 2019, 1:37pm UTC](https://discuss.elastic.co/t/search-text-with-both-exact-values-within-double-quotes-and-the-other-values/166364 "2019-01-30T13:37:27Z")

</div>

my search criteria should full-fill the string having exact values(inside double quotes) and the rest other string. please suggest. example search text: "what is the capital for /"united states of america/"" output: …

---

## [Searching for an expression inside a field and returning the information that comes after](https://discuss.elastic.co/t/searching-for-an-expression-inside-a-field-and-returning-the-information-that-comes-after/166360)

<div class="topic-metadata">

**Author:** [@angelogabeira](https://discuss.elastic.co/u/angelogabeira)\
**Replies:** 0\
**Last updated:** [January 30, 2019, 1:17pm UTC](https://discuss.elastic.co/t/searching-for-an-expression-inside-a-field-and-returning-the-information-that-comes-after/166360 "2019-01-30T13:17:13Z")

</div>

I have an index which has a field 'description' with some text. I want to search for a pattern in this field (ex: Error Message: XXXXXXX) and I want to return the text after it but have not been able to accomplish this y…

---

## [Sql "case" in elasticsearch](https://discuss.elastic.co/t/sql-case-in-elasticsearch/166348)

<div class="topic-metadata">

**Author:** [@examin](https://discuss.elastic.co/u/examin)\
**Replies:** 2\
**Last updated:** [January 30, 2019, 12:22pm UTC](https://discuss.elastic.co/t/sql-case-in-elasticsearch/166348 "2019-01-30T12:22:58Z")

</div>

I want to do query elastic search with bands(example .. age band {10-20,20-30,etc}). How can i do this . i have tried painless scripting: by which i am able to create a new field. But i want to do group by , count , su…

---

## [Enabling monitoring on v6.6](https://discuss.elastic.co/t/enabling-monitoring-on-v6-6/166351)

<div class="topic-metadata">

**Author:** [@adaisley](https://discuss.elastic.co/u/adaisley)\
**Replies:** 4\
**Last updated:** [January 30, 2019, 12:17pm UTC](https://discuss.elastic.co/t/enabling-monitoring-on-v6-6/166351 "2019-01-30T12:17:47Z")

</div>

Hi, we've just upgraded to Elastic Stack v6.6 and tried to enable monitoring (we didn't have it enabled before). I've set the following parameters in elasticsearch.yml: xpack.monitoring.enabled: true xpack.monitoring.…

---

## [Run match query over specific documents](https://discuss.elastic.co/t/run-match-query-over-specific-documents/164961)

<div class="topic-metadata">

**Author:** [@jmngpt](https://discuss.elastic.co/u/jmngpt)\
**Replies:** 4\
**Last updated:** [January 30, 2019, 11:58am UTC](https://discuss.elastic.co/t/run-match-query-over-specific-documents/164961 "2019-01-30T11:58:07Z")

</div>

I have a large index (10M+ docs with large bodies of text) and I'm trying to speed up queries for large bodies of text over it. I know in advance in which documents the "text" is likely to be (i.e. I know the doc's like…

---

## [How to Properly delete previous index before uploading a new one with different mapping](https://discuss.elastic.co/t/how-to-properly-delete-previous-index-before-uploading-a-new-one-with-different-mapping/166342)

<div class="topic-metadata">

**Author:** [@examin](https://discuss.elastic.co/u/examin)\
**Replies:** 1\
**Last updated:** [January 30, 2019, 11:50am UTC](https://discuss.elastic.co/t/how-to-properly-delete-previous-index-before-uploading-a-new-one-with-different-mapping/166342 "2019-01-30T11:50:00Z")

</div>

Many times when we change mapping or try to mutate some columns type , but then we get object mapping error. May be this happen because of not deleting properly last index. Then what steps must be kept in mind before aga…

---

## [How to avoid large index update](https://discuss.elastic.co/t/how-to-avoid-large-index-update/166262)

<div class="topic-metadata">

**Author:** [@adithsukumar](https://discuss.elastic.co/u/adithsukumar)\
**Replies:** 3\
**Last updated:** [January 30, 2019, 11:27am UTC](https://discuss.elastic.co/t/how-to-avoid-large-index-update/166262 "2019-01-30T11:27:18Z")

</div>

Hi All We are trying to sync the relational data from mssql database to ES index. The structure of my sql data base is like this: Teacher table - teacher\_id , teacher\_name Course table- course\_id , course\_name, te…

---

## [Tune for disk usage - phrase queries](https://discuss.elastic.co/t/tune-for-disk-usage-phrase-queries/165231)

<div class="topic-metadata">

**Author:** [@YvorL](https://discuss.elastic.co/u/YvorL)\
**Replies:** 2\
**Last updated:** [January 30, 2019, 11:14am UTC](https://discuss.elastic.co/t/tune-for-disk-usage-phrase-queries/165231 "2019-01-30T11:14:44Z")

</div>

Hi! In the guide for tuning for disk usage, it states: text fields also store frequencies and positions in the index by default. Frequencies are used to compute scores and positions are used to run phrase queries. If …

---

## [ELK in EPASS](https://discuss.elastic.co/t/elk-in-epass/166339)

<div class="topic-metadata">

**Author:** [@gayathri](https://discuss.elastic.co/u/gayathri)\
**Replies:** 3\
**Last updated:** [January 30, 2019, 11:14am UTC](https://discuss.elastic.co/t/elk-in-epass/166339 "2019-01-30T11:14:41Z")

</div>

Hi Team, Is there a chance to configure ELK stack in EPAAS ? Regards, Gayathri T R

---

## [Alternative solution to composite aggregation in java high level rest client](https://discuss.elastic.co/t/alternative-solution-to-composite-aggregation-in-java-high-level-rest-client/165034)

<div class="topic-metadata">

**Author:** [@Mahendra\_Shinde](https://discuss.elastic.co/u/Mahendra_Shinde)\
**Replies:** 2\
**Last updated:** [January 30, 2019, 10:20am UTC](https://discuss.elastic.co/t/alternative-solution-to-composite-aggregation-in-java-high-level-rest-client/165034 "2019-01-30T10:20:02Z")

</div>

Hi, I am trying to solve one performance problem in our elasticsearch use case. Best solution is composite aggregations. But Composite aggregations not available in java high level rest client. Is there any alternative…

---

## [ES 6.5.2 Problem making zen unicast discovery to work when transport.tcp.port is set](https://discuss.elastic.co/t/es-6-5-2-problem-making-zen-unicast-discovery-to-work-when-transport-tcp-port-is-set/166228)

<div class="topic-metadata">

**Author:** [@ld\_pvl](https://discuss.elastic.co/u/ld_pvl)\
**Replies:** 2\
**Last updated:** [January 30, 2019, 10:08am UTC](https://discuss.elastic.co/t/es-6-5-2-problem-making-zen-unicast-discovery-to-work-when-transport-tcp-port-is-set/166228 "2019-01-30T10:08:41Z")

</div>

Hi Team, I have set my discovery.zen.ping.unicast.hosts: \["hostA", "hostB", "hostC"\] without a port range which according to the docs I believe should scan a range of ports by default which looks like it does. Now for …

---

## [Elasticsearch Pricing for security](https://discuss.elastic.co/t/elasticsearch-pricing-for-security/166312)

<div class="topic-metadata">

**Author:** [@rajkumar\_E1](https://discuss.elastic.co/u/rajkumar_E1)\
**Replies:** 3\
**Last updated:** [January 30, 2019, 9:42am UTC](https://discuss.elastic.co/t/elasticsearch-pricing-for-security/166312 "2019-01-30T09:42:57Z")

</div>

Dear Team, We plan to develop search based software using elastic-search, I have some research about security subscription. https://www.elastic.co/subscriptions. Basic and opensource product. Its not have security optio…

---

## [Convert string type(coming from spark structured streaming) to datetime(2019-01-02 17:16:04) in Elastic search and apply aggregation](https://discuss.elastic.co/t/convert-string-type-coming-from-spark-structured-streaming-to-datetime-2019-01-02-1704-in-elastic-search-and-apply-aggregation/166308)

<div class="topic-metadata">

**Author:** [@Radhika\_Maheshwari](https://discuss.elastic.co/u/Radhika_Maheshwari)\
**Replies:** 0\
**Last updated:** [January 30, 2019, 8:51am UTC](https://discuss.elastic.co/t/convert-string-type-coming-from-spark-structured-streaming-to-datetime-2019-01-02-1704-in-elastic-search-and-apply-aggregation/166308 "2019-01-30T08:51:01Z")

</div>

Hi, I am using spark structured streaming and save my data to ES and want to create dashboard from Kibana. In spark , I have order data and I have created\_at field in spark, which is String type. I need to convert it …

---

## [Indexing throttling in Elasticsearch \[2\]](https://discuss.elastic.co/t/indexing-throttling-in-elasticsearch-2/166033)

<div class="topic-metadata">

**Author:** [@bkostya](https://discuss.elastic.co/u/bkostya)\
**Replies:** 5\
**Last updated:** [January 30, 2019, 8:41am UTC](https://discuss.elastic.co/t/indexing-throttling-in-elasticsearch-2/166033 "2019-01-30T08:41:56Z")

</div>

Hello All, Back to the discussion from 2017 Is there a way for Elasticsearch to throttle indexing or search requests? I would argue on "All we have done is move the backpressure problem." We should let the client app…

---

## [Setting up ELK on RHEL using RPM](https://discuss.elastic.co/t/setting-up-elk-on-rhel-using-rpm/166300)

<div class="topic-metadata">

**Author:** [@Imrankhan\_Patan](https://discuss.elastic.co/u/Imrankhan_Patan)\
**Replies:** 0\
**Last updated:** [January 30, 2019, 8:30am UTC](https://discuss.elastic.co/t/setting-up-elk-on-rhel-using-rpm/166300 "2019-01-30T08:30:00Z")

</div>

I am trying to install ELK stack on RHEL linux using RPM packages downloaded.I could install only with root as it requires permissions for /etc directory. But after the installation it created users for logstash and elas…

---

## [Document count after metric aggregation](https://discuss.elastic.co/t/document-count-after-metric-aggregation/166298)

<div class="topic-metadata">

**Author:** [@dclouard](https://discuss.elastic.co/u/dclouard)\
**Replies:** 0\
**Last updated:** [January 30, 2019, 8:14am UTC](https://discuss.elastic.co/t/document-count-after-metric-aggregation/166298 "2019-01-30T08:14:54Z")

</div>

Hi, I have a document representing of event on activity. This document is defined by activity id creation date of event event type message I have to count the number of events per type but only on the last event for …

---

## [Nest Update By Id That Is Auto Generated By ElasticDb](https://discuss.elastic.co/t/nest-update-by-id-that-is-auto-generated-by-elasticdb/166283)

<div class="topic-metadata">

**Author:** [@Eyup\_Can\_Arslan](https://discuss.elastic.co/u/Eyup_Can_Arslan)\
**Replies:** 0\
**Last updated:** [January 30, 2019, 7:20am UTC](https://discuss.elastic.co/t/nest-update-by-id-that-is-auto-generated-by-elasticdb/166283 "2019-01-30T07:20:15Z")

</div>

I used Nest 6.X framework to manage Elasticsearch with c# At there I shared the result of nest query. The c# code like this \_elasticSearchDb.Update(DocumentPath\<myElasticType\>.Id("Cq2jmGgB5bes6sABU8NP"), u =\> u.DocAsUp…

---

## [Elasticsearch Combine Term and Match Phrase Query And Performance Issue](https://discuss.elastic.co/t/elasticsearch-combine-term-and-match-phrase-query-and-performance-issue/166277)

<div class="topic-metadata">

**Author:** [@Eyup\_Can\_Arslan](https://discuss.elastic.co/u/Eyup_Can_Arslan)\
**Replies:** 0\
**Last updated:** [January 30, 2019, 7:18am UTC](https://discuss.elastic.co/t/elasticsearch-combine-term-and-match-phrase-query-and-performance-issue/166277 "2019-01-30T07:18:10Z")

</div>

In the below, I shared a Elastic Search raw query. I used Elasticsearch 6.X verison. In the given Elasticsearch Raw query that is above, I try to generate a result like this t-sql command in below. Here is T-Sql Comman…

[Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1409)

[Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1411)
