# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1418 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1419 --- ## [Don't know how to strat using ELK](https://discuss.elastic.co/t/dont-know-how-to-strat-using-elk/164682)
**Author:** [@rolive86](https://discuss.elastic.co/u/rolive86)\ **Replies:** 4\ **Last updated:** [January 23, 2019, 12:40am UTC](https://discuss.elastic.co/t/dont-know-how-to-strat-using-elk/164682 "2019-01-23T00:40:31Z")
Im kind of struggling with the ELK environment. I mount everything in a virtual box. I was able to set Elastic, Longstash and Kibana in a Linux distro. Im still failing in the index pattern creation and (obviously) und… --- ## [Adding Nested fields in Parent Child](https://discuss.elastic.co/t/adding-nested-fields-in-parent-child/165309)
**Author:** [@akkash.bansal](https://discuss.elastic.co/u/akkash.bansal)\ **Replies:** 0\ **Last updated:** [January 22, 2019, 10:57pm UTC](https://discuss.elastic.co/t/adding-nested-fields-in-parent-child/165309 "2019-01-22T22:57:29Z")
Hi, I am trying to figuring out if it is possible to have nested fields (an array) in child. Basically I have a parent and a children that can contain an array of values. And it works fine in ES 5.6 Now when I am migrati… --- ## [What is the accessDeclaredMembers error?](https://discuss.elastic.co/t/what-is-the-accessdeclaredmembers-error/165303)
**Author:** [@ninesalt](https://discuss.elastic.co/u/ninesalt)\ **Replies:** 0\ **Last updated:** [January 22, 2019, 10:16pm UTC](https://discuss.elastic.co/t/what-is-the-accessdeclaredmembers-error/165303 "2019-01-22T22:16:01Z")
I'm trying to write an plugin in for ES but I keep getting this annoying error whenever I try it and I don't know what's causing it. Below is the class that appears in the errors: public class SentimentAnalyzer { GoSen… --- ## [Shard rebalancing is slow after network failure on any node](https://discuss.elastic.co/t/shard-rebalancing-is-slow-after-network-failure-on-any-node/164716)
**Author:** [@Ninad\_Pradhan](https://discuss.elastic.co/u/Ninad_Pradhan)\ **Replies:** 6\ **Last updated:** [January 22, 2019, 9:45pm UTC](https://discuss.elastic.co/t/shard-rebalancing-is-slow-after-network-failure-on-any-node/164716 "2019-01-22T21:45:14Z")
we are using elastic search 6.3.1, we have a 3 node cluster 1 tb ssd, 30 gb ram on the machine, 8gb allocated to es, 2 masters minimum, in our testing if one of the es node's network goes down, elastic takes about 7 to 1… --- ## [Problem with install (Java\_home)](https://discuss.elastic.co/t/problem-with-install-java-home/165273)
**Author:** [@Americo\_Torres](https://discuss.elastic.co/u/Americo_Torres)\ **Replies:** 2\ **Last updated:** [January 22, 2019, 9:32pm UTC](https://discuss.elastic.co/t/problem-with-install-java-home/165273 "2019-01-22T21:32:49Z")
Hi friends, my name is Americo Torres, im using Windows 8.1, and i have a problem with env var JAVA\_HOME at run, here a screen: https://imgur.com/a/2GFJKGT Thanks for your help --- ## [Supervisord: memlock problem](https://discuss.elastic.co/t/supervisord-memlock-problem/164357)
**Author:** [@langerma](https://discuss.elastic.co/u/langerma)\ **Replies:** 1\ **Last updated:** [January 22, 2019, 9:31pm UTC](https://discuss.elastic.co/t/supervisord-memlock-problem/164357 "2019-01-22T21:31:35Z")
hello, i am building a solution where i have to start native tar.gz deployments with supervisord. elasticsearch limits are set like this: elasticsearch hard nofile 65536 elasticsearch hard memlock unlimited… --- ## [Using Curator to delete old log files](https://discuss.elastic.co/t/using-curator-to-delete-old-log-files/165169)
**Author:** [@cowensel](https://discuss.elastic.co/u/cowensel)\ **Replies:** 1\ **Last updated:** [January 22, 2019, 4:31pm UTC](https://discuss.elastic.co/t/using-curator-to-delete-old-log-files/165169 "2019-01-22T16:31:43Z")
Is there a way to use Curator to delete old log files for both Elasticsearch and logstash after so many days that are not sent to logstash? Can Curator run a powershell script? I use curator currently for deleting old d… --- ## [Ulong to double to ulong magic in Elasticsearch](https://discuss.elastic.co/t/ulong-to-double-to-ulong-magic-in-elasticsearch/165263)
**Author:** [@alex\_b](https://discuss.elastic.co/u/alex_b)\ **Replies:** 0\ **Last updated:** [January 22, 2019, 3:09pm UTC](https://discuss.elastic.co/t/ulong-to-double-to-ulong-magic-in-elasticsearch/165263 "2019-01-22T15:09:53Z")
Hi, I'm currently testing edge cases for saving and retrieving c# base types in ES. Some things are not working as expected, e.g. saving decimal.MaxValue in an ES double field and then retrieving it back. But one stran… --- ## [Icu\_normalizer is not working](https://discuss.elastic.co/t/icu-normalizer-is-not-working/165223)
**Author:** [@Saikiran\_Kyatham1](https://discuss.elastic.co/u/Saikiran_Kyatham1)\ **Replies:** 15\ **Last updated:** [January 22, 2019, 3:08pm UTC](https://discuss.elastic.co/t/icu-normalizer-is-not-working/165223 "2019-01-22T15:08:06Z")
here the Error message - when I'm trying to use icu\_normalizer in my elastic search. installed the plugins as well. { "error": { "root\_cause": \[ { "type": "illegal\_argument\_exception", "reason": "Unknown filter ty… --- ## [Track total hits: support by integer?](https://discuss.elastic.co/t/track-total-hits-support-by-integer/165232)
**Author:** [@kzzzzo2](https://discuss.elastic.co/u/kzzzzo2)\ **Replies:** 3\ **Last updated:** [January 22, 2019, 2:21pm UTC](https://discuss.elastic.co/t/track-total-hits-support-by-integer/165232 "2019-01-22T14:21:31Z")
An exception occurred when setting an integer to track\_total\_hits. The doc is written as set track\_total\_hits as an integer. Is there a way to set an integer? Version 7.0.0-alpha2 Request GET \_search { "track\_total… --- ## [Dependency version changes for ES upgrade 5.5 to 6.5](https://discuss.elastic.co/t/dependency-version-changes-for-es-upgrade-5-5-to-6-5/165237)
**Author:** [@Suryadip\_Nag](https://discuss.elastic.co/u/Suryadip_Nag)\ **Replies:** 2\ **Last updated:** [January 22, 2019, 2:04pm UTC](https://discuss.elastic.co/t/dependency-version-changes-for-es-upgrade-5-5-to-6-5/165237 "2019-01-22T14:04:09Z")
We are upgrading ES from 5.5.1 to 6.5.4. We need to use the correct dependencies to support ES 6.5. Currently for 5.5 we have dependencies mentioned in build.gradle like below. dependencies { compile group: 'org.elasti… --- ## [Did I remove my default mapping](https://discuss.elastic.co/t/did-i-remove-my-default-mapping/165238)
**Author:** [@gormanst](https://discuss.elastic.co/u/gormanst)\ **Replies:** 0\ **Last updated:** [January 22, 2019, 1:16pm UTC](https://discuss.elastic.co/t/did-i-remove-my-default-mapping/165238 "2019-01-22T13:16:58Z")
PUT \_template/dogpound\_mpds { "index\_patterns": \["dogpound\_mpds\*"\], "mappings" : { "\_doc" : { "dynamic": "true", "properties": { "feed": {"type": "text","fields":… --- ## [Controlling RAM consumption](https://discuss.elastic.co/t/controlling-ram-consumption/165180)
**Author:** [@christoph.p](https://discuss.elastic.co/u/christoph.p)\ **Replies:** 1\ **Last updated:** [January 22, 2019, 12:42pm UTC](https://discuss.elastic.co/t/controlling-ram-consumption/165180 "2019-01-22T12:42:56Z")
Hi! Is there any possibility to set an upper bound for the RAM usage of Elasticsearch? Thanks! --- ## [Index has too many segments](https://discuss.elastic.co/t/index-has-too-many-segments/165200)
**Author:** [@ihenrypan](https://discuss.elastic.co/u/ihenrypan)\ **Replies:** 1\ **Last updated:** [January 22, 2019, 11:54am UTC](https://discuss.elastic.co/t/index-has-too-many-segments/165200 "2019-01-22T11:54:22Z")
Hi, I have an index has too many segments(more than 7000). When I restore the index from snapshot, segment number is 340(index has 170 shards). After spark-streaming write data to index in few days, the segment number i… --- ## [Watcher Alert email id customization](https://discuss.elastic.co/t/watcher-alert-email-id-customization/165222)
**Author:** [@rishabh1812](https://discuss.elastic.co/u/rishabh1812)\ **Replies:** 0\ **Last updated:** [January 22, 2019, 11:12am UTC](https://discuss.elastic.co/t/watcher-alert-email-id-customization/165222 "2019-01-22T11:12:21Z")
I have configured watcher to send email but the email comes with specific name and email id and has a signature that i dont want. Watcher Alert noreply@watcheralert.found.io first test mail from watcher … --- ## [Elasticsearch-Logstash Mapping](https://discuss.elastic.co/t/elasticsearch-logstash-mapping/165217)
**Author:** [@Gevorg](https://discuss.elastic.co/u/Gevorg)\ **Replies:** 0\ **Last updated:** [January 22, 2019, 10:41am UTC](https://discuss.elastic.co/t/elasticsearch-logstash-mapping/165217 "2019-01-22T10:41:27Z")
Hello. I have ELK stack on the single server. Logstash have a two config files, first listen nginx logs over udp, Second config read logs from files. Nginx input: input { syslog { host =\> "0.0.0.0" port =\> 5150 … --- ## [How to differentiate the query from multiple queries](https://discuss.elastic.co/t/how-to-differentiate-the-query-from-multiple-queries/165024)
**Author:** [@sesha](https://discuss.elastic.co/u/sesha)\ **Replies:** 2\ **Last updated:** [January 22, 2019, 9:53am UTC](https://discuss.elastic.co/t/how-to-differentiate-the-query-from-multiple-queries/165024 "2019-01-22T09:53:50Z")
We are using multiple Elasticsearch queries from our UI. But we can't able differentiate query from Browser developer tools. Is it possible to have like a description or tag in ES query? --- ## [Primay shards on the same node caused load unbalanced](https://discuss.elastic.co/t/primay-shards-on-the-same-node-caused-load-unbalanced/165205)
**Author:** [@shiloong](https://discuss.elastic.co/u/shiloong)\ **Replies:** 0\ **Last updated:** [January 22, 2019, 9:52am UTC](https://discuss.elastic.co/t/primay-shards-on-the-same-node-caused-load-unbalanced/165205 "2019-01-22T09:52:53Z")
My cluster have 4 data nodes, and this caused many bulk rejections,we didn't have any update operate,Elasticsearch version is 6.4.0 GET \_cat/shards?v&index=2019.01.22&h=index,shared,prirep,stat,node index … --- ## [Aggregate a search result?](https://discuss.elastic.co/t/aggregate-a-search-result/165061)
**Author:** [@Wassim\_Ben\_Amor](https://discuss.elastic.co/u/Wassim_Ben_Amor)\ **Replies:** 12\ **Last updated:** [January 22, 2019, 9:52am UTC](https://discuss.elastic.co/t/aggregate-a-search-result/165061 "2019-01-22T09:52:47Z")
Hello, I have documents with fields: session\_id user\_id Every document represent a user request in a conversation. Example : when I execute a simple aggregation to show for each user how much dialogs he has: { … --- ## [Builtin X-Pack Watchers Email Address](https://discuss.elastic.co/t/builtin-x-pack-watchers-email-address/165199)
**Author:** [@X\_Calibur](https://discuss.elastic.co/u/X_Calibur)\ **Replies:** 0\ **Last updated:** [January 22, 2019, 9:27am UTC](https://discuss.elastic.co/t/builtin-x-pack-watchers-email-address/165199 "2019-01-22T09:27:37Z")
We keep receiving alerts from "X-Pack Admin" regarding shards allocation, cluster members joining disjoining etc. My guess is that it's coming from the builtin X-Pack Watchers which are in-editable. Does anyone know whe… --- ## [Docker or VM which is the best option to set up production elastic cluster on single host](https://discuss.elastic.co/t/docker-or-vm-which-is-the-best-option-to-set-up-production-elastic-cluster-on-single-host/165198)
**Author:** [@vivektsb](https://discuss.elastic.co/u/vivektsb)\ **Replies:** 0\ **Last updated:** [January 22, 2019, 9:18am UTC](https://discuss.elastic.co/t/docker-or-vm-which-is-the-best-option-to-set-up-production-elastic-cluster-on-single-host/165198 "2019-01-22T09:18:55Z")
Hi, Please let us know the best option to set up production cluster whether it is Docker or VM on single host.We have enough RAM around 900 TB.We have faced some difficulties in upgradation and cluster restart data los… --- ## [Can we get required fields from source using innerhits of nested object](https://discuss.elastic.co/t/can-we-get-required-fields-from-source-using-innerhits-of-nested-object/165196)
**Author:** [@prasad.ram1431](https://discuss.elastic.co/u/prasad.ram1431)\ **Replies:** 0\ **Last updated:** [January 22, 2019, 9:07am UTC](https://discuss.elastic.co/t/can-we-get-required-fields-from-source-using-innerhits-of-nested-object/165196 "2019-01-22T09:07:45Z")
Hi All, I wanted to know whether we can get selected fields using innerhits from nested object like, { "query": { "nested": { "path": "", "query": { "range": { "toDate": { "gte": "2015-01-01", "lte": "2016-12-3… --- ## [Network Share location is not recommended for path.data?](https://discuss.elastic.co/t/network-share-location-is-not-recommended-for-path-data/165164)
**Author:** [@Prashant\_Rana](https://discuss.elastic.co/u/Prashant_Rana)\ **Replies:** 1\ **Last updated:** [January 22, 2019, 8:45am UTC](https://discuss.elastic.co/t/network-share-location-is-not-recommended-for-path-data/165164 "2019-01-22T08:45:09Z")
Hi, I want to know if the Network Share location for the data folder is recommended or not. Also, If it is supported in recent versions then please state the version we can use with the shared location for data folder. --- ## [Audit Log index](https://discuss.elastic.co/t/audit-log-index/165179)
**Author:** [@li\_jessen2016](https://discuss.elastic.co/u/li_jessen2016)\ **Replies:** 0\ **Last updated:** [January 22, 2019, 8:20am UTC](https://discuss.elastic.co/t/audit-log-index/165179 "2019-01-22T08:20:46Z")
xpack.security.audit.outputs Specifies where audit logs are output. For example: \[ index, logfile \] . The default value is logfile , which puts the auditing events in a dedicated file named \\_audit.log on… --- ## [Composite vs term aggregation with size](https://discuss.elastic.co/t/composite-vs-term-aggregation-with-size/165115)
**Author:** [@vipul\_tyagi](https://discuss.elastic.co/u/vipul_tyagi)\ **Replies:** 3\ **Last updated:** [January 22, 2019, 8:17am UTC](https://discuss.elastic.co/t/composite-vs-term-aggregation-with-size/165115 "2019-01-22T08:17:01Z")
If I am using terms aggregation with size let's say 100000(knowing that there will not be more entry then it), should it return same result as using composite aggregation? --- ## [Monitoring Search Requests](https://discuss.elastic.co/t/monitoring-search-requests/165176)
**Author:** [@dawiro](https://discuss.elastic.co/u/dawiro)\ **Replies:** 0\ **Last updated:** [January 22, 2019, 8:14am UTC](https://discuss.elastic.co/t/monitoring-search-requests/165176 "2019-01-22T08:14:44Z")
Hi, Can I ask, how can I gather metrics on search activity such as: Number of current searches Longest running searches Highest CPU searches We occasionally get situations where CPU maxes out on our log ingestion dat… --- ## [Watcher and kibana](https://discuss.elastic.co/t/watcher-and-kibana/164146)
**Author:** [@li\_jessen2016](https://discuss.elastic.co/u/li_jessen2016)\ **Replies:** 7\ **Last updated:** [January 22, 2019, 7:59am UTC](https://discuss.elastic.co/t/watcher-and-kibana/164146 "2019-01-22T07:59:42Z")
If I uses a trail license and enables watcher of X-pack, do I need to install kibana? Since from the log, I see the following error messages when I have no kibana installed: at org.elasticsearch.painless.PainlessScript… --- ## [Why does node disconnect after three time big gc?](https://discuss.elastic.co/t/why-does-node-disconnect-after-three-time-big-gc/164981)
**Author:** [@Leeeo](https://discuss.elastic.co/u/Leeeo)\ **Replies:** 19\ **Last updated:** [January 22, 2019, 7:21am UTC](https://discuss.elastic.co/t/why-does-node-disconnect-after-three-time-big-gc/164981 "2019-01-22T07:21:58Z")
version: 6.2.2 \[2019-01-21T12:02:02,098\]\[INFO \]\[o.e.m.j.JvmGcMonitorService\] \[node-142\] \[gc\]\[407049\] overhead, spent \[427ms\] collecting in the last \[1s\] \[2019-01-21T12:02:03,483\]\[INFO \]\[o.e.m.j.JvmGcMonitorService\] \[no… --- ## [Tokenizing based on special characters coupled with shingles](https://discuss.elastic.co/t/tokenizing-based-on-special-characters-coupled-with-shingles/165166)
**Author:** [@Abhilash\_B](https://discuss.elastic.co/u/Abhilash_B)\ **Replies:** 0\ **Last updated:** [January 22, 2019, 7:03am UTC](https://discuss.elastic.co/t/tokenizing-based-on-special-characters-coupled-with-shingles/165166 "2019-01-22T07:03:29Z")
Hey, I have this string "cgi-bin/auth?Login=igorusty@yandex.ru&Password=kweinfsdaf", I would want the following tokens "cgi-bin", "cgi-bin/auth", "cgi-bin/auth?Login"....etc. Basically when I search with a match query … --- ## [Simple elasticsearch database designe help](https://discuss.elastic.co/t/simple-elasticsearch-database-designe-help/164935)
**Author:** [@Mart](https://discuss.elastic.co/u/Mart)\ **Replies:** 13\ **Last updated:** [January 22, 2019, 5:45am UTC](https://discuss.elastic.co/t/simple-elasticsearch-database-designe-help/164935 "2019-01-22T05:45:49Z")
Hello! I have a question about elastic database design. My data is 10 different collections spread to tapes. Every tape can have one or more collections stored and on every tape there are 100K+ unique files. In elastic I… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1417) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1419)