# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1451 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1452 --- ## [Is it me or is docker.elastic.co unavailable?](https://discuss.elastic.co/t/is-it-me-or-is-docker-elastic-co-unavailable/161052)
**Author:** [@JesperSJ](https://discuss.elastic.co/u/JesperSJ)\ **Replies:** 2\ **Last updated:** [December 16, 2018, 9:11pm UTC](https://discuss.elastic.co/t/is-it-me-or-is-docker-elastic-co-unavailable/161052 "2018-12-16T21:11:04Z")
Sorry if this is the wrong place to write this but... I don't see any announcements/news about it anywhere, so I thought I would mention it here. To me http://docker.elastic.co has been down for at least a few days now.… --- ## [ML for unusual name detection](https://discuss.elastic.co/t/ml-for-unusual-name-detection/160951)
**Author:** [@Kim-Kruse-Hansen](https://discuss.elastic.co/u/Kim-Kruse-Hansen)\ **Replies:** 3\ **Last updated:** [December 16, 2018, 7:15pm UTC](https://discuss.elastic.co/t/ml-for-unusual-name-detection/160951 "2018-12-16T19:15:41Z")
Hi We are trying to find hostnames in the DHCP logs, that are roque in the sense that the hostname is not following current naming standards. So I have been trying to figure out, how to do that with ML. So I came up w… --- ## [Curator API returns None](https://discuss.elastic.co/t/curator-api-returns-none/161039)
**Author:** [@tomerl](https://discuss.elastic.co/u/tomerl)\ **Replies:** 4\ **Last updated:** [December 16, 2018, 6:59pm UTC](https://discuss.elastic.co/t/curator-api-returns-none/161039 "2018-12-16T18:59:32Z")
Hi there, I'm attempting to write a python code that will perform the actions that I'm currently doing in the curator-cli. The goal is to have Lambda that will perform several actions that are related but not restricted… --- ## [The parsing of the log4j2 configuration file](https://discuss.elastic.co/t/the-parsing-of-the-log4j2-configuration-file/161023)
**Author:** [@li\_jessen2016](https://discuss.elastic.co/u/li_jessen2016)\ **Replies:** 1\ **Last updated:** [December 16, 2018, 1:56pm UTC](https://discuss.elastic.co/t/the-parsing-of-the-log4j2-configuration-file/161023 "2018-12-16T13:56:51Z")
I am not familiar with xml. When I read the document about the log configuration, it writes that "appender.rolling.layout.pattern = \[%d{ISO8601}\]\[%-5p\]\[%-25c{1.}\] \[%node\_name\]%marker %.-10000m%n " What's the meaning of … --- ## [How to search query in main and nested doc along with some filters in elasticsearch](https://discuss.elastic.co/t/how-to-search-query-in-main-and-nested-doc-along-with-some-filters-in-elasticsearch/161032)
**Author:** [@Amit\_Gupta1](https://discuss.elastic.co/u/Amit_Gupta1)\ **Replies:** 0\ **Last updated:** [December 16, 2018, 1:40pm UTC](https://discuss.elastic.co/t/how-to-search-query-in-main-and-nested-doc-along-with-some-filters-in-elasticsearch/161032 "2018-12-16T13:40:00Z")
I have the following mapping for colleges in elasticsearch: { "properties": { "name": { "type": "text" }, "city": { "type": "keyword" }, "programs": { "type": "nested", "pro… --- ## [Elasticsearch cluster status is red. Allocate missing primary shards and replica shards](https://discuss.elastic.co/t/elasticsearch-cluster-status-is-red-allocate-missing-primary-shards-and-replica-shards/160987)
**Author:** [@samwzm](https://discuss.elastic.co/u/samwzm)\ **Replies:** 1\ **Last updated:** [December 16, 2018, 9:07am UTC](https://discuss.elastic.co/t/elasticsearch-cluster-status-is-red-allocate-missing-primary-shards-and-replica-shards/160987 "2018-12-16T09:07:04Z")
Hi, there, We just upgrade ES from 6.3.2 to 6.5.1. Our cluster includes 3 master and 2 hot data nodes. At first it works fine, until recently got restarted. The only change is the data location (we uses docker image). S… --- ## [Infinity setMaxRetryTimeoutMillis()](https://discuss.elastic.co/t/infinity-setmaxretrytimeoutmillis/161007)
**Author:** [@madhan3396](https://discuss.elastic.co/u/madhan3396)\ **Replies:** 0\ **Last updated:** [December 15, 2018, 6:13pm UTC](https://discuss.elastic.co/t/infinity-setmaxretrytimeoutmillis/161007 "2018-12-15T18:13:26Z")
Hi, Is there any way to set setMaxRetryTimeoutMillis() as infinity? I'm using Elasticsearch and RestHighLevelClient version 6.4. The indices that we are maintaining ranges from 50 to 60GB. The terms aggregation and bo… --- ## [Interactive Upgrade Guide](https://discuss.elastic.co/t/interactive-upgrade-guide/158658)
**Author:** [@orivera](https://discuss.elastic.co/u/orivera)\ **Replies:** 1\ **Last updated:** [December 15, 2018, 5:09pm UTC](https://discuss.elastic.co/t/interactive-upgrade-guide/158658 "2018-12-15T17:09:03Z")
Interactive Upgrade Guide https://www.elastic.co/products/upgrade\_guide only includes to 6.3 at this moment, does this steps apply for 6.4 and 6.5 as well? --- ## [Ways to purge deleted documents in 4TB indice](https://discuss.elastic.co/t/ways-to-purge-deleted-documents-in-4tb-indice/158988)
**Author:** [@orivera](https://discuss.elastic.co/u/orivera)\ **Replies:** 5\ **Last updated:** [December 15, 2018, 5:07pm UTC](https://discuss.elastic.co/t/ways-to-purge-deleted-documents-in-4tb-indice/158988 "2018-12-15T17:07:08Z")
Looking for an advice on how to get rid of all deleted documents in 4TB indice on a monthly basis. This indice is not a time series and it has lots deletes and writes all day long. These are the number of docs from \_sta… --- ## [Multiple tasks causing huge disk load](https://discuss.elastic.co/t/multiple-tasks-causing-huge-disk-load/160886)
**Author:** [@mhernik](https://discuss.elastic.co/u/mhernik)\ **Replies:** 2\ **Last updated:** [December 15, 2018, 12:31pm UTC](https://discuss.elastic.co/t/multiple-tasks-causing-huge-disk-load/160886 "2018-12-15T12:31:42Z")
Recently I've experienced a huge performance drop and disk load. I've checked what's running in the background and I saw multiple tasks with "action": "indices:data/read/scroll" Here is one of 50 examples: "z6S1B-p3S2W… --- ## [Is the X-Pack ca.cert sensitive data?](https://discuss.elastic.co/t/is-the-x-pack-ca-cert-sensitive-data/160952)
**Author:** [@arisbanach](https://discuss.elastic.co/u/arisbanach)\ **Replies:** 2\ **Last updated:** [December 15, 2018, 11:34am UTC](https://discuss.elastic.co/t/is-the-x-pack-ca-cert-sensitive-data/160952 "2018-12-15T11:34:06Z")
Stupid question, but I'm new to this stuff and just want to be 100% sure. I used certutil to create a PKI for Elasticsearch. I have the CA public and private keys. Is there any reason I should treat the public key as sen… --- ## [SQL statement too large](https://discuss.elastic.co/t/sql-statement-too-large/160719)
**Author:** [@Amr\_Abdeldayem](https://discuss.elastic.co/u/Amr_Abdeldayem)\ **Replies:** 4\ **Last updated:** [December 15, 2018, 9:00am UTC](https://discuss.elastic.co/t/sql-statement-too-large/160719 "2018-12-15T09:00:12Z")
Caused by: java.sql.SQLSyntaxErrorException: line 7:51: SQL statement too large; halt parsing to prevent memory errors (stopped at depth 200) Method is JDBC driver and Sql query request: select count(\*) as count,mainBu… --- ## [Api to find the long running query](https://discuss.elastic.co/t/api-to-find-the-long-running-query/160854)
**Author:** [@Adil](https://discuss.elastic.co/u/Adil)\ **Replies:** 0\ **Last updated:** [December 14, 2018, 7:17am UTC](https://discuss.elastic.co/t/api-to-find-the-long-running-query/160854 "2018-12-14T07:17:21Z")
Can someone help me with an api to get the long-running query? It is very difficult to read the log as it is huge in gigs and filled with all the queries. --- ## [Is it possible to set the precision\_threshold for an entire index?](https://discuss.elastic.co/t/is-it-possible-to-set-the-precision-threshold-for-an-entire-index/160973)
**Author:** [@Matt\_Vasquez](https://discuss.elastic.co/u/Matt_Vasquez)\ **Replies:** 1\ **Last updated:** [December 14, 2018, 10:10pm UTC](https://discuss.elastic.co/t/is-it-possible-to-set-the-precision-threshold-for-an-entire-index/160973 "2018-12-14T22:10:47Z")
I am using Elastic Stack for Business Intelligence purposes, because of this I need absolute accuracy. I know I can apply the precision\_threshold on a individual basis, but is there a way to provide the precision\_thresho… --- ## [Issues after upgrading from 5.6.13 to 5.6.14](https://discuss.elastic.co/t/issues-after-upgrading-from-5-6-13-to-5-6-14/160773)
**Author:** [@greeksearch](https://discuss.elastic.co/u/greeksearch)\ **Replies:** 1\ **Last updated:** [December 14, 2018, 10:02pm UTC](https://discuss.elastic.co/t/issues-after-upgrading-from-5-6-13-to-5-6-14/160773 "2018-12-14T22:02:27Z")
I use Elasticsearch for Mediawiki (MW 1.31, CentOS 7.6) and the system autoupgraded Elasticsearch from 5.6.13 to 5.6.14. I upgraded the the plugins to same versions, reindexed, appeared to complete successfully, but the … --- ## [Updating/Editing field in ES index using Watcher](https://discuss.elastic.co/t/updating-editing-field-in-es-index-using-watcher/160789)
**Author:** [@ehou1000](https://discuss.elastic.co/u/ehou1000)\ **Replies:** 0\ **Last updated:** [December 13, 2018, 5:22pm UTC](https://discuss.elastic.co/t/updating-editing-field-in-es-index-using-watcher/160789 "2018-12-13T17:22:29Z")
I am trying to update an existing field in an ES index using a watcher query (to schedule watches to update this field every so often), specifically trying to change a field "status" to have the value "CLOSED" if it sati… --- ## [Elasticsearch read operations very high](https://discuss.elastic.co/t/elasticsearch-read-operations-very-high/160964)
**Author:** [@ramzey1981](https://discuss.elastic.co/u/ramzey1981)\ **Replies:** 0\ **Last updated:** [December 14, 2018, 7:45pm UTC](https://discuss.elastic.co/t/elasticsearch-read-operations-very-high/160964 "2018-12-14T19:45:20Z")
issue: our cluster is observing high read operations elasticsearch version: elasticsearch-6.2.1 5 nodes each with 2 cpus and 7GB or ram the data volume for elasticsearch uses a zfs pool mounted using an ssd drive and … --- ## [Snapshot failed with partial state](https://discuss.elastic.co/t/snapshot-failed-with-partial-state/160613)
**Author:** [@Mouglou](https://discuss.elastic.co/u/Mouglou)\ **Replies:** 6\ **Last updated:** [December 14, 2018, 7:24pm UTC](https://discuss.elastic.co/t/snapshot-failed-with-partial-state/160613 "2018-12-14T19:24:54Z")
Hi all ! We are using elasticsearch for a long time now and we get an error during a snapshot. These snapshot storing metrics (1 indice by day / 12 shards), so they are pretty big: ~180G / 900M of documents. Until now… --- ## [Input chains, watchers, and multiple hits](https://discuss.elastic.co/t/input-chains-watchers-and-multiple-hits/159972)
**Author:** [@luksi1](https://discuss.elastic.co/u/luksi1)\ **Replies:** 2\ **Last updated:** [December 14, 2018, 6:21pm UTC](https://discuss.elastic.co/t/input-chains-watchers-and-multiple-hits/159972 "2018-12-14T18:21:17Z")
Hi, We need to create alarms based on matches, where only certain criteria will be available in a log, but the complimenting information will reside in additional logs that have the same ID. For instance, take 10 logs,… --- ## [ElasticSearch timeouts after upgrade to 6.5.1](https://discuss.elastic.co/t/elasticsearch-timeouts-after-upgrade-to-6-5-1/160235)
**Author:** [@devops\_mike](https://discuss.elastic.co/u/devops_mike)\ **Replies:** 18\ **Last updated:** [December 14, 2018, 6:18pm UTC](https://discuss.elastic.co/t/elasticsearch-timeouts-after-upgrade-to-6-5-1/160235 "2018-12-14T18:18:15Z")
Last week I upgraded my ELK stack from 6.4 to 6.5.1. Since then, performance has been declining. Elastic is running on a single server, cluster consists of one node. I have 3 beats (winlogbeat, metricbeat, filebeat) run… --- ## [Can i use \_score in sort with script?](https://discuss.elastic.co/t/can-i-use-score-in-sort-with-script/159993)
**Author:** [@GumpCode](https://discuss.elastic.co/u/GumpCode)\ **Replies:** 1\ **Last updated:** [December 14, 2018, 5:18pm UTC](https://discuss.elastic.co/t/can-i-use-score-in-sort-with-script/159993 "2018-12-14T17:18:53Z")
hi, i wanna use script in sort, but can i use \_score like GET /\_search { "query" : { "term" : { "user" : "kimchy" } }, "sort" : { "\_script" : { "type" : "number", "script" : { "lang": "painless", "source": "\_s… --- ## [Difference between one big and many small indices](https://discuss.elastic.co/t/difference-between-one-big-and-many-small-indices/160909)
**Author:** [@Zerobot](https://discuss.elastic.co/u/Zerobot)\ **Replies:** 2\ **Last updated:** [December 14, 2018, 5:11pm UTC](https://discuss.elastic.co/t/difference-between-one-big-and-many-small-indices/160909 "2018-12-14T17:11:07Z")
Hello, what would be the main difference (performance and resource usage) between 1 x 100 GB index compared to 100 x 1 GB indices? 4 shards, no replicas. --- ## [Case insensitive phrase suggester?](https://discuss.elastic.co/t/case-insensitive-phrase-suggester/160946)
**Author:** [@boeingx](https://discuss.elastic.co/u/boeingx)\ **Replies:** 0\ **Last updated:** [December 14, 2018, 5:00pm UTC](https://discuss.elastic.co/t/case-insensitive-phrase-suggester/160946 "2018-12-14T17:00:10Z")
Hi! Is it possible to perform case insensitive match with phrase suggester? Follow the example in the documentation, if we do PUT test { "settings": { "index": { "number\_of\_shards": 1, "analysis": { … --- ## [Unclear usage of es.read.field.as.array.exclude](https://discuss.elastic.co/t/unclear-usage-of-es-read-field-as-array-exclude/159959)
**Author:** [@markoutso](https://discuss.elastic.co/u/markoutso)\ **Replies:** 2\ **Last updated:** [December 14, 2018, 4:22pm UTC](https://discuss.elastic.co/t/unclear-usage-of-es-read-field-as-array-exclude/159959 "2018-12-14T16:22:42Z")
Hello, I am trying to use the setting es.read.field.as.array.exclude From the name of it, I understand that it must produce the opposite result of es.read.field.as.array.include. es.read.field.as.array.include transfor… --- ## [Condition doesn't trigger even if true](https://discuss.elastic.co/t/condition-doesnt-trigger-even-if-true/160944)
**Author:** [@draganadz](https://discuss.elastic.co/u/draganadz)\ **Replies:** 0\ **Last updated:** [December 14, 2018, 4:53pm UTC](https://discuss.elastic.co/t/condition-doesnt-trigger-even-if-true/160944 "2018-12-14T16:53:07Z")
Hello, I'm making a watcher that should alert if some value is null. So I get several hits and for each hit I check whether the result is empty. When I do a search query I can see that there are such results but my con… --- ## [Strange behavior on inserting/reindexing float and int](https://discuss.elastic.co/t/strange-behavior-on-inserting-reindexing-float-and-int/160941)
**Author:** [@pdesgarets](https://discuss.elastic.co/u/pdesgarets)\ **Replies:** 0\ **Last updated:** [December 14, 2018, 4:40pm UTC](https://discuss.elastic.co/t/strange-behavior-on-inserting-reindexing-float-and-int/160941 "2018-12-14T16:40:46Z")
Hi, I'm observing a strange behavior regarding mapping. I use dynamic mapping. I insert both int and floats. First observation : Why does Elasticsearch allow those insertions ? Shouldn't it forbid it if the dynamic map… --- ## [Error in Parsing logs](https://discuss.elastic.co/t/error-in-parsing-logs/160906)
**Author:** [@shruti51](https://discuss.elastic.co/u/shruti51)\ **Replies:** 1\ **Last updated:** [December 14, 2018, 4:30pm UTC](https://discuss.elastic.co/t/error-in-parsing-logs/160906 "2018-12-14T16:30:50Z")
HI, My logstash configuration is: input { file { path =\> "/opt/XXX/\*.txt" start\_position =\> "beginning" add\_field =\> \[ "log\_type","xyz" \] } } The filter part of this file is commented out to indicate that it is … --- ## [Beginner: How to index json file into Elasticsearch](https://discuss.elastic.co/t/beginner-how-to-index-json-file-into-elasticsearch/160917)
**Author:** [@ESBeginner](https://discuss.elastic.co/u/ESBeginner)\ **Replies:** 1\ **Last updated:** [December 14, 2018, 4:21pm UTC](https://discuss.elastic.co/t/beginner-how-to-index-json-file-into-elasticsearch/160917 "2018-12-14T16:21:17Z")
Hello, I have a json file with about 1000 documents and I want to index this file, but I really do not understand how I should do it. I already googled and saw things about the Bulk API but it does not work out for me o… --- ## [Having grandchildren in index with multiple shards](https://discuss.elastic.co/t/having-grandchildren-in-index-with-multiple-shards/160878)
**Author:** [@3ms1](https://discuss.elastic.co/u/3ms1)\ **Replies:** 3\ **Last updated:** [December 14, 2018, 2:36pm UTC](https://discuss.elastic.co/t/having-grandchildren-in-index-with-multiple-shards/160878 "2018-12-14T14:36:33Z")
Hi, I have following relation in mapping grandparent -\> parent -\> children. Currently, queries work but if the number of shards is increased to 5 (from 1) then the query below is not returning all result. { "query": … --- ## [Notification for SW changes](https://discuss.elastic.co/t/notification-for-sw-changes/160927)
**Author:** [@mruthyu](https://discuss.elastic.co/u/mruthyu)\ **Replies:** 0\ **Last updated:** [December 14, 2018, 3:14pm UTC](https://discuss.elastic.co/t/notification-for-sw-changes/160927 "2018-12-14T15:14:19Z")
Is it possible to get the regular notification whenever there is a change to the Elastic Stack - Major/Minor/Patch releases? [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1450) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1452)