# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1413 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1414 --- ## [Dynamic index expiration dates](https://discuss.elastic.co/t/dynamic-index-expiration-dates/165963)
**Author:** [@vincentvm](https://discuss.elastic.co/u/vincentvm)\ **Replies:** 1\ **Last updated:** [January 28, 2019, 1:36pm UTC](https://discuss.elastic.co/t/dynamic-index-expiration-dates/165963 "2019-01-28T13:36:48Z")
We're using the following curator script to expire data older than 7 days. actions: 1: action: delete\_indices description: \>- Delete indices older than 7 days (based on index name), for logstash- p… --- ## [X-Pack Watcher - Trigger time drift gap](https://discuss.elastic.co/t/x-pack-watcher-trigger-time-drift-gap/165600)
**Author:** [@Steve\_Stevens](https://discuss.elastic.co/u/Steve_Stevens)\ **Replies:** 1\ **Last updated:** [January 28, 2019, 12:18pm UTC](https://discuss.elastic.co/t/x-pack-watcher-trigger-time-drift-gap/165600 "2019-01-28T12:18:44Z")
Afternoon all! I'm using X-Pack Watchers in Kibana to poll the logs every 1 minute for particular faults. The watcher itself is set to trigger every "1m": and to query (amongst other things) for logs between 1m of t… --- ## [How to get distinct keys from nested object](https://discuss.elastic.co/t/how-to-get-distinct-keys-from-nested-object/165994)
**Author:** [@sesha](https://discuss.elastic.co/u/sesha)\ **Replies:** 0\ **Last updated:** [January 28, 2019, 11:36am UTC](https://discuss.elastic.co/t/how-to-get-distinct-keys-from-nested-object/165994 "2019-01-28T11:36:58Z")
I am trying to get distinct keys (key1, key2 ..) from a nested object as below example. \` { "labels": { "key1": "value", "key2": "value", "key3": "value", "key4": "value" } } I dont know , how to aggreagate dis… --- ## [Field name contains dots](https://discuss.elastic.co/t/field-name-contains-dots/164898)
**Author:** [@kunliu](https://discuss.elastic.co/u/kunliu)\ **Replies:** 1\ **Last updated:** [January 28, 2019, 11:30am UTC](https://discuss.elastic.co/t/field-name-contains-dots/164898 "2019-01-28T11:30:27Z")
Hi Team, When put the mappings in Index, we have some field name that contains dots, for example: Server.users. PUT my\_index { "mappings": { "\_doc": { "properties": { "Server.users": { "… --- ## [Kibana suggestions aggs lead to high CPU, "terminate\_after" didn't work](https://discuss.elastic.co/t/kibana-suggestions-aggs-lead-to-high-cpu-terminate-after-didnt-work/165990)
**Author:** [@LoadingZhang](https://discuss.elastic.co/u/LoadingZhang)\ **Replies:** 0\ **Last updated:** [January 28, 2019, 11:18am UTC](https://discuss.elastic.co/t/kibana-suggestions-aggs-lead-to-high-cpu-terminate-after-didnt-work/165990 "2019-01-28T11:18:22Z")
With ES/Kibana 6.4.0. We have 16TB+/150+Bil indices in ES, with high cardinality fields such as uid. If turn on autocomplete feature, then input uid: in search bar, kibana would send this query to ES: { "size": 0, … --- ## [Set Custom analyzer as default](https://discuss.elastic.co/t/set-custom-analyzer-as-default/165983)
**Author:** [@danisowa](https://discuss.elastic.co/u/danisowa)\ **Replies:** 0\ **Last updated:** [January 28, 2019, 10:47am UTC](https://discuss.elastic.co/t/set-custom-analyzer-as-default/165983 "2019-01-28T10:47:50Z")
Hello together, i'm new on elasticsearch server and i want to set my server to use whitespace analyzer with lowercase as default analyzer for my index. configuration (which is not working) looks like { "testindex" : {… --- ## [Get elasticsearch's indices names - and names only](https://discuss.elastic.co/t/get-elasticsearchs-indices-names-and-names-only/165981)
**Author:** [@yishain11](https://discuss.elastic.co/u/yishain11)\ **Replies:** 1\ **Last updated:** [January 28, 2019, 10:47am UTC](https://discuss.elastic.co/t/get-elasticsearchs-indices-names-and-names-only/165981 "2019-01-28T10:47:32Z")
Hi there. I know that in order to get all indices I need to use: GET /\_cat/indices?v But then I get response body that contains alot of information that I don't need (like index size) and I'm having trouble parsing the… --- ## [Bulked script error: "Only sibling pipeline aggregations are allowed at the top level", and how to add scripts to my json input on my visualization](https://discuss.elastic.co/t/bulked-script-error-only-sibling-pipeline-aggregations-are-allowed-at-the-top-level-and-how-to-add-scripts-to-my-json-input-on-my-visualization/165978)
**Author:** [@Celso\_Agra](https://discuss.elastic.co/u/Celso_Agra)\ **Replies:** 0\ **Last updated:** [January 28, 2019, 10:30am UTC](https://discuss.elastic.co/t/bulked-script-error-only-sibling-pipeline-aggregations-are-allowed-at-the-top-level-and-how-to-add-scripts-to-my-json-input-on-my-visualization/165978 "2019-01-28T10:30:42Z")
I'm new on elasticsearch and painless language. I'm trying to understand what kind of error is occuring and why, is that occurs. Here is my code, below: GET club/\_search { "query" : { "match\_all": {} … --- ## [Kibana dashboard slowelness](https://discuss.elastic.co/t/kibana-dashboard-slowelness/165971)
**Author:** [@aboullaite](https://discuss.elastic.co/u/aboullaite)\ **Replies:** 1\ **Last updated:** [January 28, 2019, 9:57am UTC](https://discuss.elastic.co/t/kibana-dashboard-slowelness/165971 "2019-01-28T09:57:18Z")
Hi, Recently we start noticing that kibana request takes very long to show up (around +30s)! I believe this is not related to kibana, since it does nothing except sending\_msearch requests to our elasticsearch cluster… --- ## [Not booting if repository is unavailable](https://discuss.elastic.co/t/not-booting-if-repository-is-unavailable/165954)
**Author:** [@asp](https://discuss.elastic.co/u/asp)\ **Replies:** 1\ **Last updated:** [January 28, 2019, 9:37am UTC](https://discuss.elastic.co/t/not-booting-if-repository-is-unavailable/165954 "2019-01-28T09:37:59Z")
Hi there, I encountered an issue, that elasticseach did not start. After searching the logs, it looks like that elasticsearch did not start because the backup repository was not available: \[2019-01-27T11:14:46,831\]\[ERR… --- ## [Remove \_id field in index](https://discuss.elastic.co/t/remove-id-field-in-index/165968)
**Author:** [@vinu89](https://discuss.elastic.co/u/vinu89)\ **Replies:** 2\ **Last updated:** [January 28, 2019, 9:33am UTC](https://discuss.elastic.co/t/remove-id-field-in-index/165968 "2019-01-28T09:33:16Z")
Hi , Is there any way to remove the \_id field in elastic since \_id field requires to load a lot of data in memory . I have used mutate field but it is not removing the \_id field --- ## [ML - deleting old indexes in Elasticsearch](https://discuss.elastic.co/t/ml-deleting-old-indexes-in-elasticsearch/165617)
**Author:** [@Rohlik](https://discuss.elastic.co/u/Rohlik)\ **Replies:** 2\ **Last updated:** [January 28, 2019, 8:52am UTC](https://discuss.elastic.co/t/ml-deleting-old-indexes-in-elasticsearch/165617 "2019-01-28T08:52:43Z")
Hello, I cannot find any relevant information in the docs, so I decided to ask here. Situation: We have real-time ML job on specific indexes. We are using daily indexes and our oldest index is two years old. What if… --- ## [Data nodes are not able to join master, failed to send join request to master](https://discuss.elastic.co/t/data-nodes-are-not-able-to-join-master-failed-to-send-join-request-to-master/165845)
**Author:** [@mola\_me](https://discuss.elastic.co/u/mola_me)\ **Replies:** 1\ **Last updated:** [January 28, 2019, 7:53am UTC](https://discuss.elastic.co/t/data-nodes-are-not-able-to-join-master-failed-to-send-join-request-to-master/165845 "2019-01-28T07:53:27Z")
Hi guys, I can't get node-2 to join master I am running 2 nodes node-1 as master and node-2 as data node Here is my configuration: master node : cluster.name: cluster node.name: production2 node.master: true path… --- ## [Secure connection using transport client](https://discuss.elastic.co/t/secure-connection-using-transport-client/165399)
**Author:** [@kedarsdixit](https://discuss.elastic.co/u/kedarsdixit)\ **Replies:** 1\ **Last updated:** [January 28, 2019, 7:41am UTC](https://discuss.elastic.co/t/secure-connection-using-transport-client/165399 "2019-01-28T07:41:49Z")
Need to connect to a secure elastic search which has https authentication using Transport client in java code. I have userId and password to connect however need example on how can we do it? I am using elasticsearch 5.6.… --- ## [The differences between xpack.security.http.ssl. and xpack.http.ssl. settings](https://discuss.elastic.co/t/the-differences-between-xpack-security-http-ssl-and-xpack-http-ssl-settings/165426)
**Author:** [@li\_jessen2016](https://discuss.elastic.co/u/li_jessen2016)\ **Replies:** 1\ **Last updated:** [January 28, 2019, 7:39am UTC](https://discuss.elastic.co/t/the-differences-between-xpack-security-http-ssl-and-xpack-http-ssl-settings/165426 "2019-01-28T07:39:59Z")
What are the differences? The only thing I know is that one is for security settings and the other appears in watcher configuration. I need further details. --- ## [Watcher parse\_exception (actions proxy.host)](https://discuss.elastic.co/t/watcher-parse-exception-actions-proxy-host/165347)
**Author:** [@hanase](https://discuss.elastic.co/u/hanase)\ **Replies:** 6\ **Last updated:** [January 28, 2019, 3:15am UTC](https://discuss.elastic.co/t/watcher-parse-exception-actions-proxy-host/165347 "2019-01-28T03:15:52Z")
Hi elastic community, I use kibana watcher send alert message to telegram. error log input search and filter work very well. But, in actions part, I need to use proxy connect to the external network. I got informati… --- ## [部署使用logstash he filebeat. logstash 在启动后使用-f参数 验证配置文件会报ERROR\] 2019-01-18 15:56:15.414 \[\[main\]\ **Author:** [@tian](https://discuss.elastic.co/u/tian)\ **Replies:** 5\ **Last updated:** [January 28, 2019, 3:02am UTC](https://discuss.elastic.co/t/logstash-he-filebeat-logstash-f-error-2019-01-18-1515-414-main-beats-pipeline-a-plugin-had-an-unrecoverable-error-will-restart-this-plugin-ps-axf-grep-logstash/164751 "2019-01-28T03:02:33Z") C\[root@ conf.d\]# /usr/share/logstash/bin/logstash -f nginx.conf WARNING: Could not find logstash.yml which is typically located in $LS\_HOME/config or /etc/logstash. You can specify the path using --path.settings. Coefau… --- ## [Elastic/elasticsearch-ruby](https://discuss.elastic.co/t/elastic-elasticsearch-ruby/165130)
**Author:** [@Karthik\_K\_G](https://discuss.elastic.co/u/Karthik_K_G)\ **Replies:** 4\ **Last updated:** [January 28, 2019, 12:51am UTC](https://discuss.elastic.co/t/elastic-elasticsearch-ruby/165130 "2019-01-28T00:51:42Z")
Hi Team, After going through the below repo I haven't seen anything related to down node information in any of the API like client.cluster.health or client.cluster.state or client.cluster.stats etc For example I ha… --- ## [Elasticsearch security not available](https://discuss.elastic.co/t/elasticsearch-security-not-available/165916)
**Author:** [@smekkley](https://discuss.elastic.co/u/smekkley)\ **Replies:** 1\ **Last updated:** [January 27, 2019, 8:32pm UTC](https://discuss.elastic.co/t/elasticsearch-security-not-available/165916 "2019-01-27T20:32:09Z")
According to the following page, X-pack security plugin is available since the version 6.3. https://www.elastic.co/products/x-pack/open I am using Elasticsearch 6.5.4, however when I run bin/elasticsearch-setup-passwor… --- ## [Multi GET and sort](https://discuss.elastic.co/t/multi-get-and-sort/165616)
**Author:** [@tombee74](https://discuss.elastic.co/u/tombee74)\ **Replies:** 4\ **Last updated:** [January 27, 2019, 7:55pm UTC](https://discuss.elastic.co/t/multi-get-and-sort/165616 "2019-01-27T19:55:20Z")
Hello, I want to retrieve a list of documents of the same type based on document IDs - Multi GET API works great. Now, I would like to sort the documents based on a specific field of that type. Is it possible to sort … --- ## [Why doesn't Kibana need CORS on ES to be configured?](https://discuss.elastic.co/t/why-doesnt-kibana-need-cors-on-es-to-be-configured/165898)
**Author:** [@ninesalt](https://discuss.elastic.co/u/ninesalt)\ **Replies:** 1\ **Last updated:** [January 27, 2019, 6:08pm UTC](https://discuss.elastic.co/t/why-doesnt-kibana-need-cors-on-es-to-be-configured/165898 "2019-01-27T18:08:18Z")
I just built a very basic web page that sends HTTP requests to an ES instance running locally and I noticed I needed to setup CORS on the ES instance for the requests to work, specifically I needed to add these lines to e… --- ## [Start elasticsearch server on intellij idea](https://discuss.elastic.co/t/start-elasticsearch-server-on-intellij-idea/165874)
**Author:** [@meow\_licous](https://discuss.elastic.co/u/meow_licous)\ **Replies:** 3\ **Last updated:** [January 27, 2019, 5:06pm UTC](https://discuss.elastic.co/t/start-elasticsearch-server-on-intellij-idea/165874 "2019-01-27T17:06:18Z")
Are there any docs how to do this. I tried to run org.elasticsearch.bootstrap.Elasticsearch but couldn't get too far. --- ## [Issue with JSON bulk insert "The bulk request must be terminated by a newline \[\\n\]"](https://discuss.elastic.co/t/issue-with-json-bulk-insert-the-bulk-request-must-be-terminated-by-a-newline-n/165902)
**Author:** [@ballavamsi](https://discuss.elastic.co/u/ballavamsi)\ **Replies:** 4\ **Last updated:** [January 27, 2019, 2:50pm UTC](https://discuss.elastic.co/t/issue-with-json-bulk-insert-the-bulk-request-must-be-terminated-by-a-newline-n/165902 "2019-01-27T14:50:52Z")
I'm trying to bulk upload json to elasticsearch with the below data. I searched in the forums and found that last line should be newline even if I did that i'm getting the same error. This is the index i'm using {… --- ## [Filter on last digit of long number](https://discuss.elastic.co/t/filter-on-last-digit-of-long-number/165739)
**Author:** [@JimboJones](https://discuss.elastic.co/u/JimboJones)\ **Replies:** 1\ **Last updated:** [January 27, 2019, 2:41pm UTC](https://discuss.elastic.co/t/filter-on-last-digit-of-long-number/165739 "2019-01-27T14:41:04Z")
I'm trying to filter documents on the last digit of a long number field called file.mode to find world writable files. I would like to do something like this regex query file.mode:/0..\[2367\]/ So filter documents where … --- ## [Need help in creating mapping](https://discuss.elastic.co/t/need-help-in-creating-mapping/165909)
**Author:** [@ballavamsi](https://discuss.elastic.co/u/ballavamsi)\ **Replies:** 0\ **Last updated:** [January 27, 2019, 2:40pm UTC](https://discuss.elastic.co/t/need-help-in-creating-mapping/165909 "2019-01-27T14:40:33Z")
Hi, I need help in creating mapping for the JSON format. The number 0,1 and 2 will be like number and now when I import the data to elastic it in the format of 0.From and 1.From This is not helping me creating graph a… --- ## [KeyAsString is null using aggregations](https://discuss.elastic.co/t/keyasstring-is-null-using-aggregations/164929)
**Author:** [@Shira\_Bendor](https://discuss.elastic.co/u/Shira_Bendor)\ **Replies:** 1\ **Last updated:** [January 27, 2019, 9:47am UTC](https://discuss.elastic.co/t/keyasstring-is-null-using-aggregations/164929 "2019-01-27T09:47:50Z")
Hi, I'm using Elastic 6.0.0. Using aggregations for the first time and I'm having some trouble with it. My documents look something like this: { ... "name" : "myname" (string), "result\_count": 1234 (numbe… --- ## [DateRangeAggregation minDocCount filter](https://discuss.elastic.co/t/daterangeaggregation-mindoccount-filter/165888)
**Author:** [@Shira\_Bendor](https://discuss.elastic.co/u/Shira_Bendor)\ **Replies:** 0\ **Last updated:** [January 27, 2019, 9:45am UTC](https://discuss.elastic.co/t/daterangeaggregation-mindoccount-filter/165888 "2019-01-27T09:45:16Z")
Hi, I'm on version 6.5.3 using this aggregation via the java api and I don't see a way to filter based on numDocCount. Is there such a way and I just missed it? or if not, I would like to propose it. Here is my code: \>… --- ## [Failing to retrieve results from ES when the timezone is UTC+1, UTC+2 - Problem started in indexes opened since 1/1/2019](https://discuss.elastic.co/t/failing-to-retrieve-results-from-es-when-the-timezone-is-utc-1-utc-2-problem-started-in-indexes-opened-since-1-1-2019/162716)
**Author:** [@Ariel\_Assaraf](https://discuss.elastic.co/u/Ariel_Assaraf)\ **Replies:** 14\ **Last updated:** [January 27, 2019, 9:34am UTC](https://discuss.elastic.co/t/failing-to-retrieve-results-from-es-when-the-timezone-is-utc-1-utc-2-problem-started-in-indexes-opened-since-1-1-2019/162716 "2019-01-27T09:34:56Z")
We are seeing very odd behavior when trying to query ES via Kibana or directly (using Postman). If the timezone is set to UTC or a timezone that is UTC+3 and above/UTC-3 and below, queries return fast, while queries ran … --- ## [High node JVM heap cause ES cluster almost stop working](https://discuss.elastic.co/t/high-node-jvm-heap-cause-es-cluster-almost-stop-working/165880)
**Author:** [@blackgrill](https://discuss.elastic.co/u/blackgrill)\ **Replies:** 5\ **Last updated:** [January 27, 2019, 9:10am UTC](https://discuss.elastic.co/t/high-node-jvm-heap-cause-es-cluster-almost-stop-working/165880 "2019-01-27T09:10:47Z")
Hi Everyone, We meet some JVM memory issue in 3 of our warm nodes,the JVM heap of this nodes keep increasing and up to 99%,and then the following error message are reported in the node log file.and then,the cluster seem… --- ## [Prioritize new index shard allocation over other shard reallocations](https://discuss.elastic.co/t/prioritize-new-index-shard-allocation-over-other-shard-reallocations/165876)
**Author:** [@amomchilov](https://discuss.elastic.co/u/amomchilov)\ **Replies:** 0\ **Last updated:** [January 27, 2019, 4:10am UTC](https://discuss.elastic.co/t/prioritize-new-index-shard-allocation-over-other-shard-reallocations/165876 "2019-01-27T04:10:25Z")
Apologies if this is a case of RTFM, but I read the Index Recovery Prioritization docs among others and couldn't find an answer. I was descaling one of my Elasticsearch clusters, with a few hundred shard relocations run… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1412) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1414)