# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1433 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1434 --- ## [How to tell the "exists"-query to include empty fields](https://discuss.elastic.co/t/how-to-tell-the-exists-query-to-include-empty-fields/163221)
**Author:** [@cherry-wave](https://discuss.elastic.co/u/cherry-wave)\ **Replies:** 2\ **Last updated:** [January 7, 2019, 3:07pm UTC](https://discuss.elastic.co/t/how-to-tell-the-exists-query-to-include-empty-fields/163221 "2019-01-07T15:07:13Z")
Hello =) I am using elastic search in version 5.6.4 and want to find entries where a field "tags" is existent. One rule of this query is "At least one non- null value is required." However, I want to treat empty fields… --- ## [Elasticsearch Dedicated Master Node](https://discuss.elastic.co/t/elasticsearch-dedicated-master-node/163193)
**Author:** [@Nikesh](https://discuss.elastic.co/u/Nikesh)\ **Replies:** 4\ **Last updated:** [January 7, 2019, 3:02pm UTC](https://discuss.elastic.co/t/elasticsearch-dedicated-master-node/163193 "2019-01-07T15:02:12Z")
Hi, I have a cluster with one dedicated master node and two data nodes. I use my master node URL to search my documents. What is the advantage and disadvantage of using dedicated master node? Also, Is it better to use… --- ## [Results not as expected while querying alias (execution plan of alias query?)](https://discuss.elastic.co/t/results-not-as-expected-while-querying-alias-execution-plan-of-alias-query/162680)
**Author:** [@JF2018](https://discuss.elastic.co/u/JF2018)\ **Replies:** 4\ **Last updated:** [January 7, 2019, 2:44pm UTC](https://discuss.elastic.co/t/results-not-as-expected-while-querying-alias-execution-plan-of-alias-query/162680 "2019-01-07T14:44:05Z")
I have a problem with querying two indices using an alias. A simple setup resembling mine could be like this: ElasticVersion 1.7.5 I have two indices with a common alias. That is: Index: Index1 Alias: TestAlias and … --- ## [How to get report of before and after 5 lines of log when message match = my-error to my email in x-pack in elasticsearch in plain text format](https://discuss.elastic.co/t/how-to-get-report-of-before-and-after-5-lines-of-log-when-message-match-my-error-to-my-email-in-x-pack-in-elasticsearch-in-plain-text-format/162572)
**Author:** [@balamelangi](https://discuss.elastic.co/u/balamelangi)\ **Replies:** 7\ **Last updated:** [January 7, 2019, 12:54pm UTC](https://discuss.elastic.co/t/how-to-get-report-of-before-and-after-5-lines-of-log-when-message-match-my-error-to-my-email-in-x-pack-in-elasticsearch-in-plain-text-format/162572 "2019-01-07T12:54:12Z")
PUT \_xpack/watcher/watch/log\_error\_watch { "trigger" : { "schedule" : { "interval" : "10s" }}, "input" : { "search" : { "request" : { "indices" : \[ "filebeat-\*" \], "body" : { "query" : { "bool" : { "must" : \[ … --- ## [Data from Splunk not reaching Ealsticsearch server through Apache Loadbalancer](https://discuss.elastic.co/t/data-from-splunk-not-reaching-ealsticsearch-server-through-apache-loadbalancer/163160)
**Author:** [@sumith\_naduvath](https://discuss.elastic.co/u/sumith_naduvath)\ **Replies:** 5\ **Last updated:** [January 7, 2019, 12:04pm UTC](https://discuss.elastic.co/t/data-from-splunk-not-reaching-ealsticsearch-server-through-apache-loadbalancer/163160 "2019-01-07T12:04:47Z")
Hi All, I am trying to setup an Elasticsearch and Kibana on my server and the input data for Elasticsearch is a splunk log forwarder. The splunk is being managed by a third party company and they have configured the log… --- ## [Uninstall fails on Ubuntu with SysV](https://discuss.elastic.co/t/uninstall-fails-on-ubuntu-with-sysv/162631)
**Author:** [@Chewbacca](https://discuss.elastic.co/u/Chewbacca)\ **Replies:** 4\ **Last updated:** [January 7, 2019, 11:57am UTC](https://discuss.elastic.co/t/uninstall-fails-on-ubuntu-with-sysv/162631 "2019-01-07T11:57:32Z")
I have elasticsearch installed on my Ubuntu installation (18.04 on WSL), which uses SysV. I installed it using the instructions https://www.elastic.co/guide/en/elasticsearch/reference/current/deb.html I want to uninsta… --- ## [Sum aggregation over filtered data (per filter per sub level) - query help](https://discuss.elastic.co/t/sum-aggregation-over-filtered-data-per-filter-per-sub-level-query-help/162807)
**Author:** [@maheshgawali](https://discuss.elastic.co/u/maheshgawali)\ **Replies:** 2\ **Last updated:** [January 7, 2019, 11:37am UTC](https://discuss.elastic.co/t/sum-aggregation-over-filtered-data-per-filter-per-sub-level-query-help/162807 "2019-01-07T11:37:29Z")
I have a script (example: movie script) index with structure as given below PUT scripts { "settings": { "analysis": { "filter": { "email": { "type": "pattern\_capture", "preserve\_o… --- ## [Reindex returns "Content-Type" exception](https://discuss.elastic.co/t/reindex-returns-content-type-exception/163184)
**Author:** [@Zorobay](https://discuss.elastic.co/u/Zorobay)\ **Replies:** 2\ **Last updated:** [January 7, 2019, 11:12am UTC](https://discuss.elastic.co/t/reindex-returns-content-type-exception/163184 "2019-01-07T11:12:13Z")
Hi! I'm trying to move my data from our old server to our new one through reindexing. This is the command I'm using in the Kibana console from the new server: POST \_reindex { "source": { "remote": { "host"… --- ## [How to show the settings of discovery?](https://discuss.elastic.co/t/how-to-show-the-settings-of-discovery/163039)
**Author:** [@li\_jessen2016](https://discuss.elastic.co/u/li_jessen2016)\ **Replies:** 3\ **Last updated:** [January 7, 2019, 10:39am UTC](https://discuss.elastic.co/t/how-to-show-the-settings-of-discovery/163039 "2019-01-07T10:39:57Z")
As we know, we can use curl host IP:9200/nodes/transport?pretty to get the settings about the transport. But how to show the settings of discovery? Such as discovery.type? --- ## [System call filtering](https://discuss.elastic.co/t/system-call-filtering/163155)
**Author:** [@li\_jessen2016](https://discuss.elastic.co/u/li_jessen2016)\ **Replies:** 3\ **Last updated:** [January 7, 2019, 10:38am UTC](https://discuss.elastic.co/t/system-call-filtering/163155 "2019-01-07T10:38:57Z")
These system call filters are installed to prevent the ability to execute system calls related to forking as a defense mechanism against arbitrary code execution attacks on Elasticsearch . What is "system calls related … --- ## ["Fielddata is disabled on text fields by default" error on keyword field](https://discuss.elastic.co/t/fielddata-is-disabled-on-text-fields-by-default-error-on-keyword-field/163175)
**Author:** [@trondhindenes](https://discuss.elastic.co/u/trondhindenes)\ **Replies:** 3\ **Last updated:** [January 7, 2019, 10:04am UTC](https://discuss.elastic.co/t/fielddata-is-disabled-on-text-fields-by-default-error-on-keyword-field/163175 "2019-01-07T10:04:21Z")
I'm getting this error in my log: Caused by: java.lang.IllegalArgumentException: Fielddata is disabled on text fields by default. Set fielddata=true on \[component\] in order to load fielddata in memory by uninverting the… --- ## [How to pass body to endPoint using a watcher](https://discuss.elastic.co/t/how-to-pass-body-to-endpoint-using-a-watcher/162982)
**Author:** [@mdavi](https://discuss.elastic.co/u/mdavi)\ **Replies:** 2\ **Last updated:** [January 7, 2019, 9:42am UTC](https://discuss.elastic.co/t/how-to-pass-body-to-endpoint-using-a-watcher/162982 "2019-01-07T09:42:38Z")
Hi, I'm trying to call a public endpoint (p-log.herokuapp.com), sending the json-body in the request, using a sentinl watcher The service p-log.herokuapp.com show me the request with headers but the body is always empt… --- ## [AuditLog index filtering problem](https://discuss.elastic.co/t/auditlog-index-filtering-problem/162852)
**Author:** [@mmisztal1980](https://discuss.elastic.co/u/mmisztal1980)\ **Replies:** 1\ **Last updated:** [January 7, 2019, 9:38am UTC](https://discuss.elastic.co/t/auditlog-index-filtering-problem/162852 "2019-01-07T09:38:43Z")
Hi. We are using the ElasticStack v 6.5.3 . Our requirements are to only record audit events originating from 2x index patterns exclusively: aaa-\* bbb-\* Here is a fragment of our configuration in elasticsearch.yml x… --- ## [Elasticsearch one-to-many relations](https://discuss.elastic.co/t/elasticsearch-one-to-many-relations/163172)
**Author:** [@ismailcakir](https://discuss.elastic.co/u/ismailcakir)\ **Replies:** 1\ **Last updated:** [January 7, 2019, 9:32am UTC](https://discuss.elastic.co/t/elasticsearch-one-to-many-relations/163172 "2019-01-07T09:32:02Z")
Hi Everyone, I have two table in SQL and i want to them to elasticsearch(thier relation is one to many). Object1: { id, name, alias, ... } Object2: { id, idObject1, flag, .... } I am indexing this relatio… --- ## [Unable to send CSV data through email notification](https://discuss.elastic.co/t/unable-to-send-csv-data-through-email-notification/160867)
**Author:** [@priya08](https://discuss.elastic.co/u/priya08)\ **Replies:** 3\ **Last updated:** [January 7, 2019, 9:31am UTC](https://discuss.elastic.co/t/unable-to-send-csv-data-through-email-notification/160867 "2019-01-07T09:31:02Z")
Hi Team, I am unable to send the email notification with kibana generated CSV report actual data , its having some meta data information like index name and other columns name . I am using below reqeust , PUT \_xpack/… --- ## [Migrating data from one node setup to new cluster](https://discuss.elastic.co/t/migrating-data-from-one-node-setup-to-new-cluster/163079)
**Author:** [@ethrbunny](https://discuss.elastic.co/u/ethrbunny)\ **Replies:** 5\ **Last updated:** [January 7, 2019, 8:29am UTC](https://discuss.elastic.co/t/migrating-data-from-one-node-setup-to-new-cluster/163079 "2019-01-07T08:29:15Z")
Recently got budget to upgrade our one node setup to a clustered, kubernetes-based system. To this end I need to migrate the existing data to the new setup. Existing node will not be part of the cluster. How? --- ## [Data node left the cluster due to \`master\_left - failed to ping, tried \[3\] times, each with maximum \[30s\] timeout\]\`](https://discuss.elastic.co/t/data-node-left-the-cluster-due-to-master-left-failed-to-ping-tried-3-times-each-with-maximum-30s-timeout/162618)
**Author:** [@David\_comp](https://discuss.elastic.co/u/David_comp)\ **Replies:** 5\ **Last updated:** [January 7, 2019, 7:53am UTC](https://discuss.elastic.co/t/data-node-left-the-cluster-due-to-master-left-failed-to-ping-tried-3-times-each-with-maximum-30s-timeout/162618 "2019-01-07T07:53:07Z")
we have Elaticsearch cluster that running over a year with 54 data nodes and 3 master nodes. ES version is 5.2.1. in the last month, some data node are left the cluster with the following error: failed to ping, tried \[… --- ## [How to pretty-print response of a curl request of information?](https://discuss.elastic.co/t/how-to-pretty-print-response-of-a-curl-request-of-information/163151)
**Author:** [@li\_jessen2016](https://discuss.elastic.co/u/li_jessen2016)\ **Replies:** 4\ **Last updated:** [January 7, 2019, 7:51am UTC](https://discuss.elastic.co/t/how-to-pretty-print-response-of-a-curl-request-of-information/163151 "2019-01-07T07:51:22Z")
When I execute curl host IP:9200/\_nodes?filter\_path=\*\*.bootstrap, it returns with the following: {"nodes":{"idI\_aGgSRpuwcFXfQ2UrUA":{"settings":{"bootstrap":{"memory\_lock":"true"}}}}} How can I pretty-print it? --- ## [How to disable the autocreation .monitoring index in Elasticsearch](https://discuss.elastic.co/t/how-to-disable-the-autocreation-monitoring-index-in-elasticsearch/163036)
**Author:** [@karthick\_tgi](https://discuss.elastic.co/u/karthick_tgi)\ **Replies:** 5\ **Last updated:** [January 7, 2019, 7:32am UTC](https://discuss.elastic.co/t/how-to-disable-the-autocreation-monitoring-index-in-elasticsearch/163036 "2019-01-07T07:32:37Z")
When we start the ES and kibana its automatically created dot(.) monitoring index in elasticsearch so its very frustrated for me . Is there any options to disable or enable when we need that. Elastic version - 6.3.2 Ki… --- ## [Writing Dataframe to Elasticsearch using scala](https://discuss.elastic.co/t/writing-dataframe-to-elasticsearch-using-scala/162228)
**Author:** [@Ram18](https://discuss.elastic.co/u/Ram18)\ **Replies:** 3\ **Last updated:** [January 7, 2019, 7:29am UTC](https://discuss.elastic.co/t/writing-dataframe-to-elasticsearch-using-scala/162228 "2019-01-07T07:29:59Z")
Hi, How to map the fields in the dataframe using scala code to load data into ES. For example - string to int or string to date field or string to array. please help me to achieve the same. --- ## [How to get report of before and after +/-5 lines of log when message match = my-error to my email in x-pack in elasticsearch](https://discuss.elastic.co/t/how-to-get-report-of-before-and-after-5-lines-of-log-when-message-match-my-error-to-my-email-in-x-pack-in-elasticsearch/163149)
**Author:** [@balamelangi](https://discuss.elastic.co/u/balamelangi)\ **Replies:** 1\ **Last updated:** [January 7, 2019, 7:03am UTC](https://discuss.elastic.co/t/how-to-get-report-of-before-and-after-5-lines-of-log-when-message-match-my-error-to-my-email-in-x-pack-in-elasticsearch/163149 "2019-01-07T07:03:56Z")
PUT \_xpack/watcher/watch/log\_error\_watch { "trigger" : { "schedule" : { "interval" : "10s" }}, "input" : { "search" : { "request" : { "indices" : \[ "filebeat-\*" \], "body" : { "query" : { "bool" : { "must" : \[ … --- ## [Adding script.max\_size\_in\_bytes: 10000000 is not considered in elastisearch](https://discuss.elastic.co/t/adding-script-max-size-in-bytes-10000000-is-not-considered-in-elastisearch/163114)
**Author:** [@amitshree](https://discuss.elastic.co/u/amitshree)\ **Replies:** 0\ **Last updated:** [January 7, 2019, 6:14am UTC](https://discuss.elastic.co/t/adding-script-max-size-in-bytes-10000000-is-not-considered-in-elastisearch/163114 "2019-01-07T06:14:50Z")
Default value of max\_size\_in\_bytes in elastic 6.5 seems to be 16384 . I am using a wyomind magneto 2 search plugin which is throwing following issue if search result contains a lot of data. If search result contains less… --- ## [Flush.total numbers are big different in cluster](https://discuss.elastic.co/t/flush-total-numbers-are-big-different-in-cluster/162886)
**Author:** [@jasony](https://discuss.elastic.co/u/jasony)\ **Replies:** 8\ **Last updated:** [January 7, 2019, 6:13am UTC](https://discuss.elastic.co/t/flush-total-numbers-are-big-different-in-cluster/162886 "2019-01-07T06:13:25Z")
Hello, My cluster consists of 9nodes and uses hot-warm architecture. 01: coordinating 02,03: master eligible nodes 04,05,06: hot 07,08,09: warm I have questions about flush.total results from \_cat api's. As we see… --- ## [ELK licensing and security](https://discuss.elastic.co/t/elk-licensing-and-security/163109)
**Author:** [@l001](https://discuss.elastic.co/u/l001)\ **Replies:** 2\ **Last updated:** [January 7, 2019, 6:09am UTC](https://discuss.elastic.co/t/elk-licensing-and-security/163109 "2019-01-07T06:09:10Z")
My company is looking at a logging suite and ELK seemed promising. However, as I was exploring Elasticsearch and Kibana, I found this subscriptions doc showing that Security cannot be implemented for free version. Is th… --- ## [How can I delete older data to free my disk space](https://discuss.elastic.co/t/how-can-i-delete-older-data-to-free-my-disk-space/163107)
**Author:** [@kimown](https://discuss.elastic.co/u/kimown)\ **Replies:** 1\ **Last updated:** [January 7, 2019, 6:08am UTC](https://discuss.elastic.co/t/how-can-i-delete-older-data-to-free-my-disk-space/163107 "2019-01-07T06:08:09Z")
The question is same as title. --- ## [Elasticsearch Cluster, how to create 2 data nodes single node to primary shards and the other to replica?](https://discuss.elastic.co/t/elasticsearch-cluster-how-to-create-2-data-nodes-single-node-to-primary-shards-and-the-other-to-replica/163089)
**Author:** [@m\_5amy](https://discuss.elastic.co/u/m_5amy)\ **Replies:** 19\ **Last updated:** [January 7, 2019, 2:41am UTC](https://discuss.elastic.co/t/elasticsearch-cluster-how-to-create-2-data-nodes-single-node-to-primary-shards-and-the-other-to-replica/163089 "2019-01-07T02:41:17Z")
Elasticsearch Cluster, what is the best configuration to create 2 data nodes single node to primary shards and the other to replica?? --- ## [Org.elasticsearch-6.5.4 Jar (Java) on maven central missing XContentFactory and other classes](https://discuss.elastic.co/t/org-elasticsearch-6-5-4-jar-java-on-maven-central-missing-xcontentfactory-and-other-classes/162685)
**Author:** [@Dan\_Morozoff](https://discuss.elastic.co/u/Dan_Morozoff)\ **Replies:** 2\ **Last updated:** [January 7, 2019, 2:11am UTC](https://discuss.elastic.co/t/org-elasticsearch-6-5-4-jar-java-on-maven-central-missing-xcontentfactory-and-other-classes/162685 "2019-01-07T02:11:12Z")
Note the missing XContentFactory etc. I checked version 6.4.3 as well and this was missing too. org.elasticsearch-6.5.4.common.xcontent directory: . ├── LoggingDeprecationHandler.class ├── ObjectParserHelper.class ├── … --- ## [How are shards chosen when disk usage exceeds high water mark?](https://discuss.elastic.co/t/how-are-shards-chosen-when-disk-usage-exceeds-high-water-mark/162467)
**Author:** [@YuWatanabe](https://discuss.elastic.co/u/YuWatanabe)\ **Replies:** 2\ **Last updated:** [January 7, 2019, 2:05am UTC](https://discuss.elastic.co/t/how-are-shards-chosen-when-disk-usage-exceeds-high-water-mark/162467 "2019-01-07T02:05:01Z")
I appreciate if I could get help to understand behavior of disk high watermark in elasticsearch. From the document, I have understood that when disk usage of the partion where path.data exists exceeds high watemark … --- ## [Migrating data to "cold" indexes - docs?](https://discuss.elastic.co/t/migrating-data-to-cold-indexes-docs/163078)
**Author:** [@ethrbunny](https://discuss.elastic.co/u/ethrbunny)\ **Replies:** 1\ **Last updated:** [January 6, 2019, 10:30pm UTC](https://discuss.elastic.co/t/migrating-data-to-cold-indexes-docs/163078 "2019-01-06T22:30:31Z")
Im looking for documentation about how to migrate old(er) data to "cold" storage. Specifically we use elastic to store audit data. This needs to be kept (nearly) indefinitely but certainly isn't accessed very often. Ther… --- ## [Curator rollover fails with alias on multiple indices but only one is\_write\_index](https://discuss.elastic.co/t/curator-rollover-fails-with-alias-on-multiple-indices-but-only-one-is-write-index/163093)
**Author:** [@memelet](https://discuss.elastic.co/u/memelet)\ **Replies:** 2\ **Last updated:** [January 6, 2019, 8:12pm UTC](https://discuss.elastic.co/t/curator-rollover-fails-with-alias-on-multiple-indices-but-only-one-is-write-index/163093 "2019-01-06T20:12:11Z")
I have a series rolled over indices { "test-000003" : { "aliases" : { "test-xxx" : { "is\_write\_index" : true }, "test-yyy" : { } } }, "test-000002" : { "aliases" : { "te… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1432) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1434)