# Elasticsearch

**URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1459

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 1460

---

## [Why snapshot to HDFS is 20 times slower than restore from HFS?](https://discuss.elastic.co/t/why-snapshot-to-hdfs-is-20-times-slower-than-restore-from-hfs/156791)

<div class="topic-metadata">

**Author:** [@Daniel1222](https://discuss.elastic.co/u/Daniel1222)\
**Replies:** 3\
**Last updated:** [December 7, 2018, 4:43pm UTC](https://discuss.elastic.co/t/why-snapshot-to-hdfs-is-20-times-slower-than-restore-from-hfs/156791 "2018-12-07T16:43:47Z")

</div>

I am trying to snapshot and restore big index with repository-hdfs-5.4.2 plugin. I got 33.3 mb/s on snapshot and got 640 mb/s on restore. Is it normal that snapshot is about 20 times slower than restore? Is there any wa…

---

## [Strange issue - in flight request estimated size](https://discuss.elastic.co/t/strange-issue-in-flight-request-estimated-size/159964)

<div class="topic-metadata">

**Author:** [@ttdata](https://discuss.elastic.co/u/ttdata)\
**Replies:** 1\
**Last updated:** [December 7, 2018, 4:30pm UTC](https://discuss.elastic.co/t/strange-issue-in-flight-request-estimated-size/159964 "2018-12-07T16:30:28Z")

</div>

Hey guys, My setup : ES 6.5.1 JDK 1.8 Centos 7 I have had strange issue yesterday with two nodes of my ES cluster when only two nodes get write\_queue full and increase until i restart my node(because node was crashed…

---

## [Upgrade JDK 8 to 11 on ES5.1](https://discuss.elastic.co/t/upgrade-jdk-8-to-11-on-es5-1/159963)

<div class="topic-metadata">

**Author:** [@ttdata](https://discuss.elastic.co/u/ttdata)\
**Replies:** 0\
**Last updated:** [December 7, 2018, 4:23pm UTC](https://discuss.elastic.co/t/upgrade-jdk-8-to-11-on-es5-1/159963 "2018-12-07T16:23:58Z")

</div>

Hey guys ! I have an ES cluster in 6.5.1 with JDK 8 and i'd like to move to JDK11. Any recommandations ? Can i just upgrade JDK8 to JDK11 and restart one by one my ES node ? Regards,

---

## [High recovering time during rolling restart of Elasticsearch 6.2](https://discuss.elastic.co/t/high-recovering-time-during-rolling-restart-of-elasticsearch-6-2/159388)

<div class="topic-metadata">

**Author:** [@rdevgamer](https://discuss.elastic.co/u/rdevgamer)\
**Replies:** 1\
**Last updated:** [December 7, 2018, 3:36pm UTC](https://discuss.elastic.co/t/high-recovering-time-during-rolling-restart-of-elasticsearch-6-2/159388 "2018-12-07T15:36:16Z")

</div>

Hi Team. We have 6 elasticsearch server and all of them are data and 3 of them are marked as master eligible. Currently we have 5TB of data stored across these nodes, All of the 6 nodes are Load balanced using HAProxy. …

---

## [Cross Cluster Search gives strange results when remote nodes become unavailable](https://discuss.elastic.co/t/cross-cluster-search-gives-strange-results-when-remote-nodes-become-unavailable/159616)

<div class="topic-metadata">

**Author:** [@nma](https://discuss.elastic.co/u/nma)\
**Replies:** 2\
**Last updated:** [December 7, 2018, 3:32pm UTC](https://discuss.elastic.co/t/cross-cluster-search-gives-strange-results-when-remote-nodes-become-unavailable/159616 "2018-12-07T15:32:34Z")

</div>

Hi. The problem I've configured elasticsearch for Cross Cluster Search (CCS). It works well in most cases. But I can't get a correct behaviour in a situation when a remote node becomes unavailable \[by pulling a network…

---

## [Bulk index is so faster with single data node!](https://discuss.elastic.co/t/bulk-index-is-so-faster-with-single-data-node/159018)

<div class="topic-metadata">

**Author:** [@behi\_1370](https://discuss.elastic.co/u/behi_1370)\
**Replies:** 1\
**Last updated:** [December 7, 2018, 3:30pm UTC](https://discuss.elastic.co/t/bulk-index-is-so-faster-with-single-data-node/159018 "2018-12-07T15:30:28Z")

</div>

Hi I am trying to index some docs in my Elasticsearch cluster with bulk API and I face something strange. indexing 19k docs with one bulk API request on a cluster containing 3 master nodes and a single data node, takes…

---

## [How should I update the specific field](https://discuss.elastic.co/t/how-should-i-update-the-specific-field/158970)

<div class="topic-metadata">

**Author:** [@Wei\_W](https://discuss.elastic.co/u/Wei_W)\
**Replies:** 1\
**Last updated:** [December 7, 2018, 3:27pm UTC](https://discuss.elastic.co/t/how-should-i-update-the-specific-field/158970 "2018-12-07T15:27:38Z")

</div>

There is my index document structure: POST org\_3888/org/doctor-1/\_update?pretty { "doc": { "doctor\_gender": "F", "doctor\_languages": \[ { "language": "English" }, { "language":…

---

## [ElasticSearch + Sprinboot - IllegalArgumentException: node settings must not contain any index level settings](https://discuss.elastic.co/t/elasticsearch-sprinboot-illegalargumentexception-node-settings-must-not-contain-any-index-level-settings/159943)

<div class="topic-metadata">

**Author:** [@raghu\_d.r](https://discuss.elastic.co/u/raghu_d.r)\
**Replies:** 0\
**Last updated:** [December 7, 2018, 2:32pm UTC](https://discuss.elastic.co/t/elasticsearch-sprinboot-illegalargumentexception-node-settings-must-not-contain-any-index-level-settings/159943 "2018-12-07T14:32:53Z")

</div>

Currently migrating to elasticsearch 2.x to 6.x . In order to do so I need to change to springbootversion from 1.x to 2.x because of spring data elastic search 3.x supports elasticsearch 6.x which is available in springb…

---

## [Automatically delete 1 month old documents(without deleting index) in elastic search](https://discuss.elastic.co/t/automatically-delete-1-month-old-documents-without-deleting-index-in-elastic-search/159844)

<div class="topic-metadata">

**Author:** [@sid\_nikhil](https://discuss.elastic.co/u/sid_nikhil)\
**Replies:** 3\
**Last updated:** [December 7, 2018, 2:16pm UTC](https://discuss.elastic.co/t/automatically-delete-1-month-old-documents-without-deleting-index-in-elastic-search/159844 "2018-12-07T14:16:06Z")

</div>

I am new to Elastic Search & I need to delete documents older than 1 month (in all indices) in the elastic search . I know how to delete a single document by id / deleting an index , but not able to figure out how to a…

---

## [Elastic Search query building logic](https://discuss.elastic.co/t/elastic-search-query-building-logic/156693)

<div class="topic-metadata">

**Author:** [@W.anjum](https://discuss.elastic.co/u/W.anjum)\
**Replies:** 12\
**Last updated:** [December 7, 2018, 1:58pm UTC](https://discuss.elastic.co/t/elastic-search-query-building-logic/156693 "2018-12-07T13:58:23Z")

</div>

I am working on building a report based on indexed documents. Following is the scenario of the report: Status field that contains two types of values (ERROR, OK) Destination field containing all the destination pho…

---

## [Elastic Search Custom Plugin](https://discuss.elastic.co/t/elastic-search-custom-plugin/159539)

<div class="topic-metadata">

**Author:** [@RITESH\_AGARWAL](https://discuss.elastic.co/u/RITESH_AGARWAL)\
**Replies:** 2\
**Last updated:** [December 7, 2018, 1:23pm UTC](https://discuss.elastic.co/t/elastic-search-custom-plugin/159539 "2018-12-07T13:23:54Z")

</div>

How can we redeploy Elastic Search Plugin without restarting cluster ? Out Of Memory Exception, how can we check before executing the query weather it will execute or not? In Term aggregation, how can we set limi…

---

## [Aggregation with nested fields. Newbie problem](https://discuss.elastic.co/t/aggregation-with-nested-fields-newbie-problem/159828)

<div class="topic-metadata">

**Author:** [@rxtx](https://discuss.elastic.co/u/rxtx)\
**Replies:** 2\
**Last updated:** [December 7, 2018, 1:16pm UTC](https://discuss.elastic.co/t/aggregation-with-nested-fields-newbie-problem/159828 "2018-12-07T13:16:19Z")

</div>

Hi, I'm still quite new to elasticsearch and have found myself needing to use a nested index. I've tried to distill the problem into something simple that I could post here. This comes from a database where each record…

---

## [Querystring to search nested objects](https://discuss.elastic.co/t/querystring-to-search-nested-objects/159931)

<div class="topic-metadata">

**Author:** [@Vishnu\_P\_S](https://discuss.elastic.co/u/Vishnu_P_S)\
**Replies:** 0\
**Last updated:** [December 7, 2018, 12:48pm UTC](https://discuss.elastic.co/t/querystring-to-search-nested-objects/159931 "2018-12-07T12:48:11Z")

</div>

I have the following mapping "schema": { "type": "nested", "properties": { "description": { "type": "text", "fields": { "keyword": { …

---

## [Top N records](https://discuss.elastic.co/t/top-n-records/159860)

<div class="topic-metadata">

**Author:** [@Rashmi\_Nagpal](https://discuss.elastic.co/u/Rashmi_Nagpal)\
**Replies:** 3\
**Last updated:** [December 7, 2018, 10:57am UTC](https://discuss.elastic.co/t/top-n-records/159860 "2018-12-07T10:57:48Z")

</div>

Hi there, Can someone guide me how to extract top five records from elasticsearch,I've used size query as well, but it returns all the documents. Goal is to get data in json format after sorting on basis of store size …

---

## [High JVM Heap usage in ES load balancer node and Connection Timeout from Client to ElasticSearch load balancer node](https://discuss.elastic.co/t/high-jvm-heap-usage-in-es-load-balancer-node-and-connection-timeout-from-client-to-elasticsearch-load-balancer-node/159864)

<div class="topic-metadata">

**Author:** [@dhanasg](https://discuss.elastic.co/u/dhanasg)\
**Replies:** 4\
**Last updated:** [December 7, 2018, 10:09am UTC](https://discuss.elastic.co/t/high-jvm-heap-usage-in-es-load-balancer-node-and-connection-timeout-from-client-to-elasticsearch-load-balancer-node/159864 "2018-12-07T10:09:13Z")

</div>

Search Guard and Elasticsearch version - 5.6.9 32GB of max heap configured Installed and used enterprise modules, if any - No JVM version and operating system version - 1.8, CentOS Other installed Elasticsearch or Kiban…

---

## [Index\_already\_exists\_exception - kafka to ES sink connector(SSL)](https://discuss.elastic.co/t/index-already-exists-exception-kafka-to-es-sink-connector-ssl/159729)

<div class="topic-metadata">

**Author:** [@Janardhan](https://discuss.elastic.co/u/Janardhan)\
**Replies:** 0\
**Last updated:** [December 6, 2018, 1:01pm UTC](https://discuss.elastic.co/t/index-already-exists-exception-kafka-to-es-sink-connector-ssl/159729 "2018-12-06T13:01:31Z")

</div>

We've kafka elastic search sink connector transporting data to Elastic search(v 5.6.3 ). The connector configuration is as follows : { "name":"elasticsearch\_topic", "config": { "connector.class":"io.confluent.connect.el…

---

## [Slack action illegal\_argument](https://discuss.elastic.co/t/slack-action-illegal-argument/159749)

<div class="topic-metadata">

**Author:** [@jall](https://discuss.elastic.co/u/jall)\
**Replies:** 1\
**Last updated:** [December 7, 2018, 9:30am UTC](https://discuss.elastic.co/t/slack-action-illegal-argument/159749 "2018-12-07T09:30:09Z")

</div>

Hi, Im having problems simulating a slack notification for an existing watcher \`\[illegal\_argument\_exception\] no account found for name: \[monitoring\]\` My watcher config is { "trigger": { "schedule": { "int…

---

## [Log rotation for Elasticsearch "access.log"](https://discuss.elastic.co/t/log-rotation-for-elasticsearch-access-log/159893)

<div class="topic-metadata">

**Author:** [@sukeshss](https://discuss.elastic.co/u/sukeshss)\
**Replies:** 0\
**Last updated:** [December 7, 2018, 9:28am UTC](https://discuss.elastic.co/t/log-rotation-for-elasticsearch-access-log/159893 "2018-12-07T09:28:19Z")

</div>

How I can enable log rotation for elasticsearch access.log. Currently I am using the following "log4j2.properties" file for the other elasticsearch log files. status = error # log action execution errors for easier deb…

---

## [How does ES perform if the query does boolean operation on nested types](https://discuss.elastic.co/t/how-does-es-perform-if-the-query-does-boolean-operation-on-nested-types/157142)

<div class="topic-metadata">

**Author:** [@deepak643](https://discuss.elastic.co/u/deepak643)\
**Replies:** 2\
**Last updated:** [December 7, 2018, 9:26am UTC](https://discuss.elastic.co/t/how-does-es-perform-if-the-query-does-boolean-operation-on-nested-types/157142 "2018-12-07T09:26:40Z")

</div>

I would like to know, if there will be any difference in performance between these queries? Both queries brings up the same result. OR operation in a nested type between two fields. nested { path : "blah" should : { …

---

## [Java High Level REST Client : How to remove \_type,\_id,\_index from hits\[\]](https://discuss.elastic.co/t/java-high-level-rest-client-how-to-remove-type-id-index-from-hits/159727)

<div class="topic-metadata">

**Author:** [@smidev11](https://discuss.elastic.co/u/smidev11)\
**Replies:** 4\
**Last updated:** [December 7, 2018, 9:14am UTC](https://discuss.elastic.co/t/java-high-level-rest-client-how-to-remove-type-id-index-from-hits/159727 "2018-12-07T09:14:46Z")

</div>

Hi, I am using Java High Level REST Client to get the data. I used the Search api to get the response. My response has hits arrays. and each hit contains the \_type,\_id,\_index,\_score fields.Actually I don't want these …

---

## [Access control about the watcher](https://discuss.elastic.co/t/access-control-about-the-watcher/159315)

<div class="topic-metadata">

**Author:** [@talon](https://discuss.elastic.co/u/talon)\
**Replies:** 1\
**Last updated:** [December 7, 2018, 9:08am UTC](https://discuss.elastic.co/t/access-control-about-the-watcher/159315 "2018-12-07T09:08:44Z")

</div>

HI I want to assign user the permission to create watcher and read watcher, and have no permission to delete it. can you tell me how to configure the roles. below is my configuration, but the user not only can create th…

---

## [How to populate body.html with multiple lines in watcher](https://discuss.elastic.co/t/how-to-populate-body-html-with-multiple-lines-in-watcher/159392)

<div class="topic-metadata">

**Author:** [@chaita30](https://discuss.elastic.co/u/chaita30)\
**Replies:** 1\
**Last updated:** [December 7, 2018, 9:05am UTC](https://discuss.elastic.co/t/how-to-populate-body-html-with-multiple-lines-in-watcher/159392 "2018-12-07T09:05:43Z")

</div>

Hi, I am trying to populate an email with embedded CSS and is spread across multiple lines. Watcher allows html body to be populated in one line. e.g. \</\>"body": { "html": " Email Text" }\</\> I cannot present actual …

---

## [Is it possible to write a json/painless script that ignores some values?](https://discuss.elastic.co/t/is-it-possible-to-write-a-json-painless-script-that-ignores-some-values/159637)

<div class="topic-metadata">

**Author:** [@gyau](https://discuss.elastic.co/u/gyau)\
**Replies:** 1\
**Last updated:** [December 7, 2018, 9:01am UTC](https://discuss.elastic.co/t/is-it-possible-to-write-a-json-painless-script-that-ignores-some-values/159637 "2018-12-07T09:01:18Z")

</div>

I thought of using a scripted field or just inputting a json script when visualizing data. For example, if I wanted to calculate the average of a field named 'time', but I don't want to take into account the docs with th…

---

## [Edgengram remove first letter - no results](https://discuss.elastic.co/t/edgengram-remove-first-letter-no-results/159883)

<div class="topic-metadata">

**Author:** [@ktb](https://discuss.elastic.co/u/ktb)\
**Replies:** 2\
**Last updated:** [December 7, 2018, 9:00am UTC](https://discuss.elastic.co/t/edgengram-remove-first-letter-no-results/159883 "2018-12-07T09:00:25Z")

</div>

Hello, i use an analyzer with the edgengram tokenizer. The problem is, when i remove the first letter from a searchquery, the result is empty. Its clear that the edgengram creates only terms from the beginning of a ph…

---

## [TermsQuery(TermInSetQuery) Performance](https://discuss.elastic.co/t/termsquery-terminsetquery-performance/159879)

<div class="topic-metadata">

**Author:** [@ananth](https://discuss.elastic.co/u/ananth)\
**Replies:** 0\
**Last updated:** [December 7, 2018, 8:27am UTC](https://discuss.elastic.co/t/termsquery-terminsetquery-performance/159879 "2018-12-07T08:27:10Z")

</div>

My field value is a random id and there is no place for prefix coding of query terms and my index having large of matching documents for each values in the termsquery . I would like to know whether memory usage is linear…

---

## [Design and Query Question](https://discuss.elastic.co/t/design-and-query-question/159876)

<div class="topic-metadata">

**Author:** [@sternze](https://discuss.elastic.co/u/sternze)\
**Replies:** 0\
**Last updated:** [December 7, 2018, 8:06am UTC](https://discuss.elastic.co/t/design-and-query-question/159876 "2018-12-07T08:06:31Z")

</div>

Hi! As I'm pretty new to ES, can you please help me out regarding a design question for the indices inside ES? I want to accomplish the following: There is a central repository of issues inside my system. Once in a wh…

---

## [Range Query with % symbol](https://discuss.elastic.co/t/range-query-with-symbol/159699)

<div class="topic-metadata">

**Author:** [@infor.aldrin](https://discuss.elastic.co/u/infor.aldrin)\
**Replies:** 2\
**Last updated:** [December 7, 2018, 7:45am UTC](https://discuss.elastic.co/t/range-query-with-symbol/159699 "2018-12-07T07:45:48Z")

</div>

We would like to clarify regarding one of the functions of elastic search. https://www.elastic.co/guide/en/elasticsearch/reference/6.2/query-dsl-query-string-query.html#\_ranges According to the documentation, by using …

---

## [Cluster turns to red after reboot](https://discuss.elastic.co/t/cluster-turns-to-red-after-reboot/158298)

<div class="topic-metadata">

**Author:** [@Yogesh\_BG](https://discuss.elastic.co/u/Yogesh_BG)\
**Replies:** 28\
**Last updated:** [December 7, 2018, 6:57am UTC](https://discuss.elastic.co/t/cluster-turns-to-red-after-reboot/158298 "2018-12-07T06:57:53Z")

</div>

Hi I have a ES two node setup as below \[root@metrics-datastore-0 esutilities\]# sh check\_cluster.sh { "cluster\_name" : "metrics-datastore", "status" : "red", "timed\_out" : false, "number\_of\_nodes" : 2, "number\_of\_…

---

## [Data ignores datatype!](https://discuss.elastic.co/t/data-ignores-datatype/159849)

<div class="topic-metadata">

**Author:** [@inandi](https://discuss.elastic.co/u/inandi)\
**Replies:** 2\
**Last updated:** [December 7, 2018, 6:33am UTC](https://discuss.elastic.co/t/data-ignores-datatype/159849 "2018-12-07T06:33:43Z")

</div>

I am trying to insert data to ES using logstash template. Data is inserting fine but I have an issue with the data type. I have set datatype date for a particular data (in example reviewId), but it is also letting insert…

---

## [Timestamp want to store in index as date datatype](https://discuss.elastic.co/t/timestamp-want-to-store-in-index-as-date-datatype/159653)

<div class="topic-metadata">

**Author:** [@Sanchit\_Gupta](https://discuss.elastic.co/u/Sanchit_Gupta)\
**Replies:** 6\
**Last updated:** [December 7, 2018, 4:57am UTC](https://discuss.elastic.co/t/timestamp-want-to-store-in-index-as-date-datatype/159653 "2018-12-07T04:57:52Z")

</div>

Hi Experts, i am using filebeat to read the soa logs and want msg\_timestamp value store in index as date datatype. Please help me how to create the index on msg\_timestamp. Below is my machine description: OS : Linux 7 …

[Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1458)

[Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1460)
