# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1435 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1436 --- ## [Searching on Multiple index with relationship](https://discuss.elastic.co/t/searching-on-multiple-index-with-relationship/162659)
**Author:** [@pranav24](https://discuss.elastic.co/u/pranav24)\ **Replies:** 4\ **Last updated:** [January 4, 2019, 3:52pm UTC](https://discuss.elastic.co/t/searching-on-multiple-index-with-relationship/162659 "2019-01-04T15:52:53Z")
Hi All, I have two indexes Example -Questions and Answer. Questions index content example- post - http://localhost:9200/question/\_doc/que1 { "QUE\_ID": "que1", "QUESTION\_TITLE": "Sorting in Elasticsea… --- ## [Nodes with different disk sizes](https://discuss.elastic.co/t/nodes-with-different-disk-sizes/162981)
**Author:** [@philv](https://discuss.elastic.co/u/philv)\ **Replies:** 1\ **Last updated:** [January 4, 2019, 3:47pm UTC](https://discuss.elastic.co/t/nodes-with-different-disk-sizes/162981 "2019-01-04T15:47:05Z")
I presume that having an ES cluster composed of nodes with different storage capacities (different drive sizes) is ok ? That ES is smart enough to have some shards larger than others ? --- ## [Search children documents from parent](https://discuss.elastic.co/t/search-children-documents-from-parent/162961)
**Author:** [@wissil](https://discuss.elastic.co/u/wissil)\ **Replies:** 7\ **Last updated:** [January 4, 2019, 3:27pm UTC](https://discuss.elastic.co/t/search-children-documents-from-parent/162961 "2019-01-04T15:27:44Z")
I have a parent - child relationship in my Elastic Search mappings, and they look like follows. There is an "abstract" entity of type user and both driver and passenger inherit from it. I've created user index like this… --- ## [Mapping Parser Error when migrating from version 1.7 to 6.5](https://discuss.elastic.co/t/mapping-parser-error-when-migrating-from-version-1-7-to-6-5/162974)
**Author:** [@itsron143](https://discuss.elastic.co/u/itsron143)\ **Replies:** 0\ **Last updated:** [January 4, 2019, 2:56pm UTC](https://discuss.elastic.co/t/mapping-parser-error-when-migrating-from-version-1-7-to-6-5/162974 "2019-01-04T14:56:51Z")
I have an index which I want to upgrade from version 1.7 to 6.5. I've been following this post for the migrating and decided to go with the second option of creating a 6.5 cluster first and then reindexing from remote. … --- ## [Particular mapping under index is not searchable](https://discuss.elastic.co/t/particular-mapping-under-index-is-not-searchable/162972)
**Author:** [@alf\_sender](https://discuss.elastic.co/u/alf_sender)\ **Replies:** 0\ **Last updated:** [January 4, 2019, 2:48pm UTC](https://discuss.elastic.co/t/particular-mapping-under-index-is-not-searchable/162972 "2019-01-04T14:48:20Z")
Hi, I have index which has 4 mappings configured under it. Out of 4, I am able to search for 3 mapping data using "\_type: " in Kibana "Discover" tab. But, for 4th mapping though it has data, when I enter "\_type: \<4th-m… --- ## [Index and Search URL](https://discuss.elastic.co/t/index-and-search-url/160734)
**Author:** [@h1fra](https://discuss.elastic.co/u/h1fra)\ **Replies:** 3\ **Last updated:** [January 4, 2019, 2:46pm UTC](https://discuss.elastic.co/t/index-and-search-url/160734 "2019-01-04T14:46:19Z")
Hello, I've searched a lot around this forum and google but I didn't find a proper way to index URL that would also allow partial match. My use case is, I have documents that contains fully qualified URL (hostname + pa… --- ## [Two index query, linking field](https://discuss.elastic.co/t/two-index-query-linking-field/162933)
**Author:** [@tonelk](https://discuss.elastic.co/u/tonelk)\ **Replies:** 0\ **Last updated:** [January 4, 2019, 10:19am UTC](https://discuss.elastic.co/t/two-index-query-linking-field/162933 "2019-01-04T10:19:47Z")
Hi, I justs started with Elasticsearch in order to analyse our network data. So far it works well and above expectation. The netflow data goes to the index log\_netflow: "\_source" : { "host" : "192.168.1.1", "type" :… --- ## [Elasticsearch | Should query combining multiple clauses](https://discuss.elastic.co/t/elasticsearch-should-query-combining-multiple-clauses/162964)
**Author:** [@Nikesh](https://discuss.elastic.co/u/Nikesh)\ **Replies:** 0\ **Last updated:** [January 4, 2019, 1:42pm UTC](https://discuss.elastic.co/t/elasticsearch-should-query-combining-multiple-clauses/162964 "2019-01-04T13:42:24Z")
Hi, I am working on query that has multiple clauses within one should clause My query : { "from": 0, "size": 5, "\_source": {}, "query": { "bool": { "should": \[ { "bool": { … --- ## [Removing stopwords from index during indexing document](https://discuss.elastic.co/t/removing-stopwords-from-index-during-indexing-document/161270)
**Author:** [@atom](https://discuss.elastic.co/u/atom)\ **Replies:** 2\ **Last updated:** [January 4, 2019, 1:08pm UTC](https://discuss.elastic.co/t/removing-stopwords-from-index-during-indexing-document/161270 "2019-01-04T13:08:45Z")
Hi, is it possible to remove stopword during indexing from a document completely? I don't want that the values will be shown in Kibana after the document is indexed. Unfortunately, i did not found anything in the docu… --- ## [Version check](https://discuss.elastic.co/t/version-check/162811)
**Author:** [@Yashwant\_Shettigar](https://discuss.elastic.co/u/Yashwant_Shettigar)\ **Replies:** 6\ **Last updated:** [January 4, 2019, 11:48am UTC](https://discuss.elastic.co/t/version-check/162811 "2019-01-04T11:48:44Z")
Is there any way to check the versions of installed logstash, kibana, filebeat and winlogbeat ? Like to check elasticsearch version you execute: curl -XGET 'localhost:9200' --- ## [Connection refused when calling CXF Webclient in custom Realm plugin](https://discuss.elastic.co/t/connection-refused-when-calling-cxf-webclient-in-custom-realm-plugin/162854)
**Author:** [@Linc12](https://discuss.elastic.co/u/Linc12)\ **Replies:** 1\ **Last updated:** [January 4, 2019, 9:11am UTC](https://discuss.elastic.co/t/connection-refused-when-calling-cxf-webclient-in-custom-realm-plugin/162854 "2019-01-04T09:11:02Z")
Hi, I'm building an Elasticsearch plugin and, while it's running, I need to reach an external service in order to retrieve some data to use in the plugin code and my the proper queries. I use org.apache.cxf.jaxrs.clien… --- ## [\[host\] is defined as an object in mapping \[logs\] but this name is already used for a field in other types](https://discuss.elastic.co/t/host-is-defined-as-an-object-in-mapping-logs-but-this-name-is-already-used-for-a-field-in-other-types/162237)
**Author:** [@xojima](https://discuss.elastic.co/u/xojima)\ **Replies:** 1\ **Last updated:** [January 4, 2019, 11:11am UTC](https://discuss.elastic.co/t/host-is-defined-as-an-object-in-mapping-logs-but-this-name-is-already-used-for-a-field-in-other-types/162237 "2019-01-04T11:11:39Z")
Hi, We started getting this error in the active master log. It is so bad that the log file fills the disk overnight. I've read about it but what I've found is people having fields named the same but with different type… --- ## [Import (21gb) csv to elasticsearch](https://discuss.elastic.co/t/import-21gb-csv-to-elasticsearch/162771)
**Author:** [@examin](https://discuss.elastic.co/u/examin)\ **Replies:** 8\ **Last updated:** [January 4, 2019, 11:00am UTC](https://discuss.elastic.co/t/import-21gb-csv-to-elasticsearch/162771 "2019-01-04T11:00:54Z")
Please advice me how can i upload this huge file. Any sample java/python or name of plugin to use will help. I am doing on local machine and single node. --- ## [Is there any solution with elasticsearch parent-child join](https://discuss.elastic.co/t/is-there-any-solution-with-elasticsearch-parent-child-join/162726)
**Author:** [@wallellen](https://discuss.elastic.co/u/wallellen)\ **Replies:** 10\ **Last updated:** [January 4, 2019, 10:26am UTC](https://discuss.elastic.co/t/is-there-any-solution-with-elasticsearch-parent-child-join/162726 "2019-01-04T10:26:04Z")
I have an es settings like following: PUT /test { "mappings": { "doc": { "properties": { "status": { "type": "keyword" }, "counting": { "type": "intege… --- ## [Running terms query with filter context causes maxClauseCount](https://discuss.elastic.co/t/running-terms-query-with-filter-context-causes-maxclausecount/162571)
**Author:** [@YuvalPruss](https://discuss.elastic.co/u/YuvalPruss)\ **Replies:** 1\ **Last updated:** [January 4, 2019, 10:19am UTC](https://discuss.elastic.co/t/running-terms-query-with-filter-context-causes-maxclausecount/162571 "2019-01-04T10:19:44Z")
I'm trying to tun a terms query and filter with the results on some aggrs I run. It looks like this: { "aggregations": { "aggs\_name": { "aggregations": { ... }, "filter": { "bool… --- ## [Index pattern for Grafana](https://discuss.elastic.co/t/index-pattern-for-grafana/162919)
**Author:** [@Roshan\_r](https://discuss.elastic.co/u/Roshan_r)\ **Replies:** 7\ **Last updated:** [January 4, 2019, 10:16am UTC](https://discuss.elastic.co/t/index-pattern-for-grafana/162919 "2019-01-04T10:16:18Z")
Hello I am not sure whether i can ask this here. Just trying my luck here. I am integrating Grafana with ElasticSearch. In the Grafana screen, i need to give the ElasticSearch details. What is the value for Index? Th… --- ## [Saving a snap shot in windows UNC path from Elasticsearch running in a linux machine](https://discuss.elastic.co/t/saving-a-snap-shot-in-windows-unc-path-from-elasticsearch-running-in-a-linux-machine/162929)
**Author:** [@Sree\_Saran](https://discuss.elastic.co/u/Sree_Saran)\ **Replies:** 1\ **Last updated:** [January 4, 2019, 10:14am UTC](https://discuss.elastic.co/t/saving-a-snap-shot-in-windows-unc-path-from-elasticsearch-running-in-a-linux-machine/162929 "2019-01-04T10:14:53Z")
I have a elasticsearch running in linux machine is it possible to backup data in windows shared location. How to take a snapshot of data from Elasticsearch cluster running in Linux machine. --- ## [Creating multiple users for Kibana/Elasticsearch](https://discuss.elastic.co/t/creating-multiple-users-for-kibana-elasticsearch/162903)
**Author:** [@KindTomato](https://discuss.elastic.co/u/KindTomato)\ **Replies:** 2\ **Last updated:** [January 4, 2019, 10:01am UTC](https://discuss.elastic.co/t/creating-multiple-users-for-kibana-elasticsearch/162903 "2019-01-04T10:01:16Z")
Hey, I wanted to move from default one user on kibana and create multiple. I'v been stuck doing it for couple of hours now so .. here I am : ). Running Elasticsearch 6.5.2-1(x-pack is installed by default and I believe … --- ## [Searching records](https://discuss.elastic.co/t/searching-records/162923)
**Author:** [@Manivyoobam](https://discuss.elastic.co/u/Manivyoobam)\ **Replies:** 1\ **Last updated:** [January 4, 2019, 9:52am UTC](https://discuss.elastic.co/t/searching-records/162923 "2019-01-04T09:52:48Z")
I have searching data from index. I am not getting exact data. I am also getting related data too. How can i restrict that. Here is my code "fields": \["xxx"\], "query": { "bool": { "should": \[ … --- ## [Elasticsearch Architecture Problem](https://discuss.elastic.co/t/elasticsearch-architecture-problem/162915)
**Author:** [@josephmanalo](https://discuss.elastic.co/u/josephmanalo)\ **Replies:** 8\ **Last updated:** [January 4, 2019, 9:35am UTC](https://discuss.elastic.co/t/elasticsearch-architecture-problem/162915 "2019-01-04T09:35:35Z")
Hi guys. The picture below is the existing data pipeline of a certain client. Their MAIN PROBLEM are: Not all the data are being ingested in Node 2 and Node 3 Slow retrieval of data Do you have any idea what might be… --- ## [Distinguish full match hits from partial match hits](https://discuss.elastic.co/t/distinguish-full-match-hits-from-partial-match-hits/162528)
**Author:** [@elkster](https://discuss.elastic.co/u/elkster)\ **Replies:** 1\ **Last updated:** [January 4, 2019, 9:32am UTC](https://discuss.elastic.co/t/distinguish-full-match-hits-from-partial-match-hits/162528 "2019-01-04T09:32:05Z")
Hi, I'm new to Elasticsearch and been working on refining my searches. I am interested in finding out how my results can indicate full matches from partial matches i.e. in my search I could have both a single term or a … --- ## [Creating a status-aware system using Elasticsearch](https://discuss.elastic.co/t/creating-a-status-aware-system-using-elasticsearch/162357)
**Author:** [@erlfos](https://discuss.elastic.co/u/erlfos)\ **Replies:** 1\ **Last updated:** [January 4, 2019, 9:29am UTC](https://discuss.elastic.co/t/creating-a-status-aware-system-using-elasticsearch/162357 "2019-01-04T09:29:25Z")
Hi I am new to ELK so be nice :slight\_smile: I am trying to use ELK to keep track of the alarm status of our network. Our current system is so old and user-unfriendly that we are looking into some Open-source tools ins… --- ## [AuditLog logfile retention problem](https://discuss.elastic.co/t/auditlog-logfile-retention-problem/162853)
**Author:** [@mmisztal1980](https://discuss.elastic.co/u/mmisztal1980)\ **Replies:** 0\ **Last updated:** [January 3, 2019, 5:18pm UTC](https://discuss.elastic.co/t/auditlog-logfile-retention-problem/162853 "2019-01-03T17:18:19Z")
Hello, We are running Elastic Stack v6.5.3 and have configured the auditlog to emit events to the logfile sink. We'd like to ensure that the logfiles are kept with a 3-day retention. Therefore we have attempted to appl… --- ## [Aws ES Attempted to send a bulk request to elasticsearch' but Elasticsearch appears to be unreachable or down!](https://discuss.elastic.co/t/aws-es-attempted-to-send-a-bulk-request-to-elasticsearch-but-elasticsearch-appears-to-be-unreachable-or-down/162916)
**Author:** [@arun5635](https://discuss.elastic.co/u/arun5635)\ **Replies:** 2\ **Last updated:** [January 4, 2019, 9:02am UTC](https://discuss.elastic.co/t/aws-es-attempted-to-send-a-bulk-request-to-elasticsearch-but-elasticsearch-appears-to-be-unreachable-or-down/162916 "2019-01-04T09:02:03Z")
HI I am trying to push data from logstash to AWS ES and getting below error. Could anyone please me to fix this. \[2019-01-04T08:52:50,757\]\[ERROR\]\[logstash.outputs.elasticsearch\] Attempted to send a bulk request to elas… --- ## [About CCR](https://discuss.elastic.co/t/about-ccr/162311)
**Author:** [@zhutong](https://discuss.elastic.co/u/zhutong)\ **Replies:** 7\ **Last updated:** [January 4, 2019, 7:19am UTC](https://discuss.elastic.co/t/about-ccr/162311 "2019-01-04T07:19:42Z")
I am currently upgrading cluster from 6.2.2 to 6.5.4 and mainly want to use Cross Cluster Replication, but how do I support Cross Cluster Replication with my old index in 6.2.2. --- ## [Can't connect to localhost port with EtcdNettyClient in plugin code](https://discuss.elastic.co/t/cant-connect-to-localhost-port-with-etcdnettyclient-in-plugin-code/162885)
**Author:** [@poitevinpm](https://discuss.elastic.co/u/poitevinpm)\ **Replies:** 1\ **Last updated:** [January 4, 2019, 6:50am UTC](https://discuss.elastic.co/t/cant-connect-to-localhost-port-with-etcdnettyclient-in-plugin-code/162885 "2019-01-04T06:50:55Z")
Hi all! I am developing a script plugin that uses a dynamic config via etcd. I am using elasticsearch 6.3.2. However, when I run an etcd cluster locally (and verify it is actually up) on the port 2379, and I try to co… --- ## [Define Index mapping for time based indexes my\_index-%{YYYY-MM-DD}](https://discuss.elastic.co/t/define-index-mapping-for-time-based-indexes-my-index-yyyy-mm-dd/162898)
**Author:** [@BHAVIK\_CHITRODA](https://discuss.elastic.co/u/BHAVIK_CHITRODA)\ **Replies:** 1\ **Last updated:** [January 4, 2019, 5:25am UTC](https://discuss.elastic.co/t/define-index-mapping-for-time-based-indexes-my-index-yyyy-mm-dd/162898 "2019-01-04T05:25:28Z")
Is there a way to use define mapping for an index that will be used for all the subsequent indexes with different time stamps? I am sending logs from Logstash to ES using elasticsearch plugin. In the index configuration… --- ## [Security Hardening Parameters for Elastic stack](https://discuss.elastic.co/t/security-hardening-parameters-for-elastic-stack/161189)
**Author:** [@DineshTripathi](https://discuss.elastic.co/u/DineshTripathi)\ **Replies:** 6\ **Last updated:** [January 4, 2019, 5:24am UTC](https://discuss.elastic.co/t/security-hardening-parameters-for-elastic-stack/161189 "2019-01-04T05:24:50Z")
I am working on operational readiness of Elastic stack and one of the key requirement is to ensure Elastic stack is hardened. Did anyone already have the recommended security parameters? Please help me with that. --- ## [SUDO template for Elastic stack](https://discuss.elastic.co/t/sudo-template-for-elastic-stack/162895)
**Author:** [@DineshTripathi](https://discuss.elastic.co/u/DineshTripathi)\ **Replies:** 3\ **Last updated:** [January 4, 2019, 5:23am UTC](https://discuss.elastic.co/t/sudo-template-for-elastic-stack/162895 "2019-01-04T05:23:47Z")
I have implemented Elastic stack on RHEL 7 but going forward the plan is to enable SUDO on Linux. Do we have a SUDO template which i can use for Elastic stack components? --- ## [It seemed to be stuck when initializing](https://discuss.elastic.co/t/it-seemed-to-be-stuck-when-initializing/162191)
**Author:** [@minhua1983](https://discuss.elastic.co/u/minhua1983)\ **Replies:** 6\ **Last updated:** [January 4, 2019, 2:52am UTC](https://discuss.elastic.co/t/it-seemed-to-be-stuck-when-initializing/162191 "2019-01-04T02:52:18Z")
It seems to be stuck when initializing. I have no idea about why it happens when initializing. What does elasticsearch do after the system distributes the heaps to elasticsearch? Please check the text log below. 20… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1434) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1436)