# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1444 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1445 --- ## [Color based label for average response time and baseline time](https://discuss.elastic.co/t/color-based-label-for-average-response-time-and-baseline-time/162006)
**Author:** [@Hanit\_grover](https://discuss.elastic.co/u/Hanit_grover)\ **Replies:** 0\ **Last updated:** [December 24, 2018, 1:58pm UTC](https://discuss.elastic.co/t/color-based-label-for-average-response-time-and-baseline-time/162006 "2018-12-24T13:58:02Z")
Index Fields : TimeElapsed , URI, Operation and API Name. Based on above I need to create a data table with API Name, URI , Operation , Time Elapsed , BaselineTime and Color Label. where : Baseline time is static value… --- ## [Elasticsearch - Avoid Word based and fuzzy based match when Phrase is matched](https://discuss.elastic.co/t/elasticsearch-avoid-word-based-and-fuzzy-based-match-when-phrase-is-matched/161651)
**Author:** [@Nikesh](https://discuss.elastic.co/u/Nikesh)\ **Replies:** 2\ **Last updated:** [December 24, 2018, 12:05pm UTC](https://discuss.elastic.co/t/elasticsearch-avoid-word-based-and-fuzzy-based-match-when-phrase-is-matched/161651 "2018-12-24T12:05:21Z")
Hi, I have a query which searches on phrase, word level and fuzziness of words searched for. Is there a method where in I can restrict word and fuzzy matches when exact phrase is matched? Query developed is : { "quer… --- ## [WAZUH OSSEC Plugin / intgeration with ELK](https://discuss.elastic.co/t/wazuh-ossec-plugin-intgeration-with-elk/161974)
**Author:** [@Ganngadaran](https://discuss.elastic.co/u/Ganngadaran)\ **Replies:** 4\ **Last updated:** [December 24, 2018, 10:05am UTC](https://discuss.elastic.co/t/wazuh-ossec-plugin-intgeration-with-elk/161974 "2018-12-24T10:05:26Z")
Hi Team, I deployed ELK (Single Server Architecture) on Ubuntu and currently exploring the steps for integration WAZUS OSSEC framework. Can anyone please share the steps or documentation for the same. Thanks. --- ## [LDAP Authentication is not working](https://discuss.elastic.co/t/ldap-authentication-is-not-working/161684)
**Author:** [@sadiesh](https://discuss.elastic.co/u/sadiesh)\ **Replies:** 8\ **Last updated:** [December 24, 2018, 9:02am UTC](https://discuss.elastic.co/t/ldap-authentication-is-not-working/161684 "2018-12-24T09:02:52Z")
Getting above error with XPACK Platinum License --- ## [What does sum\_other\_doc\_count mean exactly?](https://discuss.elastic.co/t/what-does-sum-other-doc-count-mean-exactly/159687)
**Author:** [@nayun\_oh](https://discuss.elastic.co/u/nayun_oh)\ **Replies:** 2\ **Last updated:** [December 24, 2018, 6:13am UTC](https://discuss.elastic.co/t/what-does-sum-other-doc-count-mean-exactly/159687 "2018-12-24T06:13:09Z")
When I use aggregate, I can see sum\_other\_doc\_count in the result. What does this mean? Thank you in advance! --- ## [Why optimization of index-sorting has been removed from composite aggregation?](https://discuss.elastic.co/t/why-optimization-of-index-sorting-has-been-removed-from-composite-aggregation/161965)
**Author:** [@\_ite\_iew](https://discuss.elastic.co/u/_ite_iew)\ **Replies:** 0\ **Last updated:** [December 24, 2018, 3:02am UTC](https://discuss.elastic.co/t/why-optimization-of-index-sorting-has-been-removed-from-composite-aggregation/161965 "2018-12-24T03:02:30Z")
Composite aggregation is an exciting feature, but I still have some questions about it. In https://github.com/elastic/elasticsearch/pull/26800, the aggregation was firstly added and optimized for indices that set an in… --- ## [Reindex data with with new timestamp field](https://discuss.elastic.co/t/reindex-data-with-with-new-timestamp-field/161961)
**Author:** [@Roman\_Kournjaev](https://discuss.elastic.co/u/Roman_Kournjaev)\ **Replies:** 0\ **Last updated:** [December 24, 2018, 12:03am UTC](https://discuss.elastic.co/t/reindex-data-with-with-new-timestamp-field/161961 "2018-12-24T00:03:14Z")
I am creating index every day for some computation i am running , turns out i forgot to add a timestamp field to the index. I would like to reindex every index into a new one and add a @timestamp field that is extract… --- ## [SOLVED: Consuming ElasticSearch endpoint behind Basic-Auth with RestHighLevelClient](https://discuss.elastic.co/t/solved-consuming-elasticsearch-endpoint-behind-basic-auth-with-resthighlevelclient/161949)
**Author:** [@philly-vanilly](https://discuss.elastic.co/u/philly-vanilly)\ **Replies:** 0\ **Last updated:** [December 23, 2018, 12:59pm UTC](https://discuss.elastic.co/t/solved-consuming-elasticsearch-endpoint-behind-basic-auth-with-resthighlevelclient/161949 "2018-12-23T12:59:53Z")
Hi. I have an ElasticSearch cluster that is behind a proxy configured with Basic Auth. How do I make a call from RestHighLevelClient with credentials? In SpringBoot you usually have to configure a HttpClientContext like … --- ## [Add more sort on specific fields](https://discuss.elastic.co/t/add-more-sort-on-specific-fields/161775)
**Author:** [@ge\_gary](https://discuss.elastic.co/u/ge_gary)\ **Replies:** 5\ **Last updated:** [December 23, 2018, 2:28pm UTC](https://discuss.elastic.co/t/add-more-sort-on-specific-fields/161775 "2018-12-23T14:28:27Z")
When the first field is equal, the second field is not equal but not compared my query : GET /filebeat.2018-12-20/\_search { "size": 20, "query": { "bool": { "must": \[ { … --- ## [Geodistance query NEST API](https://discuss.elastic.co/t/geodistance-query-nest-api/161094)
**Author:** [@waleedkaramat](https://discuss.elastic.co/u/waleedkaramat)\ **Replies:** 2\ **Last updated:** [December 23, 2018, 1:20pm UTC](https://discuss.elastic.co/t/geodistance-query-nest-api/161094 "2018-12-23T13:20:30Z")
Hello, I want to use elastic geodistance query in my C# application. I have referred the example on Elastic NEST API documentation which didn't work for me. Below is my code. kindly share with me an example I'm using e… --- ## [Logstash/Elasticseach and template issue](https://discuss.elastic.co/t/logstash-elasticseach-and-template-issue/161535)
**Author:** [@Delphin](https://discuss.elastic.co/u/Delphin)\ **Replies:** 4\ **Last updated:** [December 23, 2018, 10:59am UTC](https://discuss.elastic.co/t/logstash-elasticseach-and-template-issue/161535 "2018-12-23T10:59:58Z")
Hello, I am using ELK 6.5.3 with Docker-Compose. I have an issue between the index template defined at logstash-side and the indexed documents. logstash.config input { beats { host =\> "0.0.0.0" port =\> 5000 } }… --- ## [How to generate big size of "generate" data type file in python](https://discuss.elastic.co/t/how-to-generate-big-size-of-generate-data-type-file-in-python/161931)
**Author:** [@zarka](https://discuss.elastic.co/u/zarka)\ **Replies:** 1\ **Last updated:** [December 22, 2018, 9:56pm UTC](https://discuss.elastic.co/t/how-to-generate-big-size-of-generate-data-type-file-in-python/161931 "2018-12-22T21:56:28Z")
Hello all, Im using the "Helpers" dictionary (for the "scan" method) for query in python environment to the ELK. The query reply a data type file as a "generate". Now in order to to something with this data-type im g… --- ## [Elasticsearch JMX debugging](https://discuss.elastic.co/t/elasticsearch-jmx-debugging/161880)
**Author:** [@cactus](https://discuss.elastic.co/u/cactus)\ **Replies:** 2\ **Last updated:** [December 22, 2018, 11:00am UTC](https://discuss.elastic.co/t/elasticsearch-jmx-debugging/161880 "2018-12-22T11:00:08Z")
Hello, I'm trying to debug Elasticsearch with JMX using ldap authentication and jmxremote.access file. jmxremote.access file: testuser readwrite jvm.options file -Dcom.sun.management.jmxremote -Dcom.sun.management.j… --- ## [How to achive optimal size of indexes for hot/warm/cold architecture](https://discuss.elastic.co/t/how-to-achive-optimal-size-of-indexes-for-hot-warm-cold-architecture/161907)
**Author:** [@vb4t](https://discuss.elastic.co/u/vb4t)\ **Replies:** 8\ **Last updated:** [December 22, 2018, 2:02am UTC](https://discuss.elastic.co/t/how-to-achive-optimal-size-of-indexes-for-hot-warm-cold-architecture/161907 "2018-12-22T02:02:31Z")
For some time we are using hot/warm/cold data nodes. We are indexing a large number of sources to daily/weekly or monthy indexes with logstash, trying to avoid having small indexes. From https://www.elastic.co/webinars/o… --- ## [NLP (talking to the elasticsearch database)](https://discuss.elastic.co/t/nlp-talking-to-the-elasticsearch-database/161902)
**Author:** [@shani\_angarkadu](https://discuss.elastic.co/u/shani_angarkadu)\ **Replies:** 0\ **Last updated:** [December 21, 2018, 10:35pm UTC](https://discuss.elastic.co/t/nlp-talking-to-the-elasticsearch-database/161902 "2018-12-21T22:35:04Z")
Any source or any ideas to ask questions and get answers from elastic search just like chat bots. --- ## [Mapping conflit with no data](https://discuss.elastic.co/t/mapping-conflit-with-no-data/161701)
**Author:** [@Akaren](https://discuss.elastic.co/u/Akaren)\ **Replies:** 1\ **Last updated:** [December 21, 2018, 9:44pm UTC](https://discuss.elastic.co/t/mapping-conflit-with-no-data/161701 "2018-12-21T21:44:08Z")
We are having ELK 6.1.1, we don't have any indices but we still have error for mapping conflit when new event come. Any idea why? \[2018-12-20T11:48:41,891\]\[WARN \]\[logstash.outputs.elasticsearch\] Could not index event to… --- ## [Tuning Elasticsearch - massive virtual memory timeouts](https://discuss.elastic.co/t/tuning-elasticsearch-massive-virtual-memory-timeouts/161714)
**Author:** [@mathurin68](https://discuss.elastic.co/u/mathurin68)\ **Replies:** 9\ **Last updated:** [December 21, 2018, 9:22pm UTC](https://discuss.elastic.co/t/tuning-elasticsearch-massive-virtual-memory-timeouts/161714 "2018-12-21T21:22:58Z")
I haven't had time to look at this in awhile and looks like its way out of control - need help/recommendations on tuning this before replicating to another node. I've got winlogbeat indices going back over a year, I've … --- ## [Accessing term frequency using function\_score query script\_score option to compute custom score](https://discuss.elastic.co/t/accessing-term-frequency-using-function-score-query-script-score-option-to-compute-custom-score/161805)
**Author:** [@ManasaP](https://discuss.elastic.co/u/ManasaP)\ **Replies:** 1\ **Last updated:** [December 21, 2018, 7:39pm UTC](https://discuss.elastic.co/t/accessing-term-frequency-using-function-score-query-script-score-option-to-compute-custom-score/161805 "2018-12-21T19:39:11Z")
Hi, I am planning to implement custom scoring using function score query. I want the scores to be based on term frequencies in the document. It was possible in earlier versions of elastic search to access the term frequ… --- ## [REST client to call external service in a Elasticsearch custom plugin](https://discuss.elastic.co/t/rest-client-to-call-external-service-in-a-elasticsearch-custom-plugin/161874)
**Author:** [@Uiidoi12](https://discuss.elastic.co/u/Uiidoi12)\ **Replies:** 1\ **Last updated:** [December 21, 2018, 7:35pm UTC](https://discuss.elastic.co/t/rest-client-to-call-external-service-in-a-elasticsearch-custom-plugin/161874 "2018-12-21T19:35:36Z")
Hi, I'm building an Elasticsearch plugin and need to call an external REST service from a class. What REST client could I use? Does Elasticsearch have any integrated not-Elasticsearch-based REST client? E.g. cxf-rt-rs… --- ## [Return all events between two events](https://discuss.elastic.co/t/return-all-events-between-two-events/161792)
**Author:** [@rage5474](https://discuss.elastic.co/u/rage5474)\ **Replies:** 3\ **Last updated:** [December 21, 2018, 6:11pm UTC](https://discuss.elastic.co/t/return-all-events-between-two-events/161792 "2018-12-21T18:11:27Z")
I have a lot of log messages in one ElasticSearch index. These log messages containing two special messages. One start message and one end message (simply having a field with the value 'START' and 'STOP'). Can I create… --- ## [Not possible to increase node count on ES Cloud](https://discuss.elastic.co/t/not-possible-to-increase-node-count-on-es-cloud/161876)
**Author:** [@val](https://discuss.elastic.co/u/val)\ **Replies:** 2\ **Last updated:** [December 21, 2018, 5:38pm UTC](https://discuss.elastic.co/t/not-possible-to-increase-node-count-on-es-cloud/161876 "2018-12-21T17:38:39Z")
While configuring a cluster on ES Cloud (aws.data.highio.i3, I/O optimized Elasticsearch instance running on an AWS i3), I noticed that it is not possible to increase the node count unless reaching the maximum amount of … --- ## [How high availability of elasticsearch cluster?](https://discuss.elastic.co/t/how-high-availability-of-elasticsearch-cluster/161664)
**Author:** [@aymenoss](https://discuss.elastic.co/u/aymenoss)\ **Replies:** 2\ **Last updated:** [December 21, 2018, 4:25pm UTC](https://discuss.elastic.co/t/how-high-availability-of-elasticsearch-cluster/161664 "2018-12-21T16:25:32Z")
I am going to install elasticsearch 3 node cluster, 2 masters and one node for haut disponibility, my question is I can use the master as data node also or not master.node: true master.data: true and what is the probl… --- ## [Bulk indexing with java high level rest client gives error "Unable to parse response body"](https://discuss.elastic.co/t/bulk-indexing-with-java-high-level-rest-client-gives-error-unable-to-parse-response-body/161696)
**Author:** [@ivanqwam](https://discuss.elastic.co/u/ivanqwam)\ **Replies:** 2\ **Last updated:** [December 21, 2018, 3:54pm UTC](https://discuss.elastic.co/t/bulk-indexing-with-java-high-level-rest-client-gives-error-unable-to-parse-response-body/161696 "2018-12-21T15:54:03Z")
We are trying to switch from Java Transport Client to Java high level client but we get error "Unable to parse response body" with bulk batches over 10000 documents using high level client. We had this with many configu… --- ## [ES long field has string value indexed](https://discuss.elastic.co/t/es-long-field-has-string-value-indexed/161744)
**Author:** [@shrridevi\_sreedharan](https://discuss.elastic.co/u/shrridevi_sreedharan)\ **Replies:** 3\ **Last updated:** [December 21, 2018, 2:55pm UTC](https://discuss.elastic.co/t/es-long-field-has-string-value-indexed/161744 "2018-12-21T14:55:16Z")
I am using ES 1.7 version and have a field mapped as long. But I see the data for that field however is stored as string. How can i query the data for such mismatched types. I need to search for that field with a specifi… --- ## [Elastic Search Load Testing With Apache Benchmark](https://discuss.elastic.co/t/elastic-search-load-testing-with-apache-benchmark/161838)
**Author:** [@surajdalvi](https://discuss.elastic.co/u/surajdalvi)\ **Replies:** 1\ **Last updated:** [December 21, 2018, 1:09pm UTC](https://discuss.elastic.co/t/elastic-search-load-testing-with-apache-benchmark/161838 "2018-12-21T13:09:32Z")
I am using the elastic cloud to store my data. My index having 13Lac documents and I am using apache benchmark to perform load testing on my elastic search index. I am using the following command to perform load testing: … --- ## [/\_cluster/reroute automatically reroute and rebalance all primary shards](https://discuss.elastic.co/t/cluster-reroute-automatically-reroute-and-rebalance-all-primary-shards/161757)
**Author:** [@raulk89](https://discuss.elastic.co/u/raulk89)\ **Replies:** 5\ **Last updated:** [December 21, 2018, 2:47pm UTC](https://discuss.elastic.co/t/cluster-reroute-automatically-reroute-and-rebalance-all-primary-shards/161757 "2018-12-21T14:47:22Z")
Elasticsearch 6.5.4 I was wondering, if there is possibility that elasticsearch automatically rebalances shards on nodes. For example, when I have 2 or 3 or or more node cluster, and I restart single node, then after s… --- ## [Multiple indexes break elasticsearch (2.3.1) cluster replication?](https://discuss.elastic.co/t/multiple-indexes-break-elasticsearch-2-3-1-cluster-replication/161689)
**Author:** [@patadaptive](https://discuss.elastic.co/u/patadaptive)\ **Replies:** 4\ **Last updated:** [December 21, 2018, 2:25pm UTC](https://discuss.elastic.co/t/multiple-indexes-break-elasticsearch-2-3-1-cluster-replication/161689 "2018-12-21T14:25:58Z")
I have a 3 node Elasticsearch cluster (2 data nodes). My solution needs to support full replication if any 1 of the 3 nodes goes down or simply shutdown. I've been turning the ES server processes off and on and the repl… --- ## [Unable to find a field mapper for field \[popularity\]. No 'missing' value defined](https://discuss.elastic.co/t/unable-to-find-a-field-mapper-for-field-popularity-no-missing-value-defined/161854)
**Author:** [@amulyakashyap09](https://discuss.elastic.co/u/amulyakashyap09)\ **Replies:** 0\ **Last updated:** [December 21, 2018, 1:58pm UTC](https://discuss.elastic.co/t/unable-to-find-a-field-mapper-for-field-popularity-no-missing-value-defined/161854 "2018-12-21T13:58:39Z")
I'm getting this error in query. Idk what's wrong here. Can anyone explain. Or can anyone suggest how to set default value for missing field. --- ## [How to add default @timestamp to my elastic search data](https://discuss.elastic.co/t/how-to-add-default-timestamp-to-my-elastic-search-data/161840)
**Author:** [@Nusrath](https://discuss.elastic.co/u/Nusrath)\ **Replies:** 5\ **Last updated:** [December 21, 2018, 1:39pm UTC](https://discuss.elastic.co/t/how-to-add-default-timestamp-to-my-elastic-search-data/161840 "2018-12-21T13:39:56Z")
I am trying to populate dashboard in kibana with Elasticsearch data on date fields . I have log file with dates and i find that i don't have @timestamp in it. Here is mapping : PUT test2 { "settings": { "index.map… --- ## [How do I search for non-ASCII characters?](https://discuss.elastic.co/t/how-do-i-search-for-non-ascii-characters/161852)
**Author:** [@TimWard](https://discuss.elastic.co/u/TimWard)\ **Replies:** 0\ **Last updated:** [December 21, 2018, 1:37pm UTC](https://discuss.elastic.co/t/how-do-i-search-for-non-ascii-characters/161852 "2018-12-21T13:37:27Z")
I've got a load of log data in Elasticsearch. Most of it is in ASCII, but very occasionally there's a non-ASCII character ... which breaks a downstream naive Python application. What query can I use to find the document… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1443) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1445)