# Elasticsearch

**URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1465

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 1466

---

## [Unable to add MongoDB River Plugin for ElasticSearch](https://discuss.elastic.co/t/unable-to-add-mongodb-river-plugin-for-elasticsearch/159149)

<div class="topic-metadata">

**Author:** [@charan\_teja](https://discuss.elastic.co/u/charan_teja)\
**Replies:** 2\
**Last updated:** [December 3, 2018, 11:28am UTC](https://discuss.elastic.co/t/unable-to-add-mongodb-river-plugin-for-elasticsearch/159149 "2018-12-03T11:28:41Z")

</div>

I have downloaded the plugin from GitHub. Plz, help me out. Thanks! \[ org.elasticsearch.bootstrap.StartupException: java.lang.IllegalStateException: Could not load plugin descript…

---

## [Incorrect attachment field names after indexing](https://discuss.elastic.co/t/incorrect-attachment-field-names-after-indexing/159142)

<div class="topic-metadata">

**Author:** [@7ca884569f2642e2c488](https://discuss.elastic.co/u/7ca884569f2642e2c488)\
**Replies:** 0\
**Last updated:** [December 3, 2018, 10:26am UTC](https://discuss.elastic.co/t/incorrect-attachment-field-names-after-indexing/159142 "2018-12-03T10:26:11Z")

</div>

NEST/Elasticsearch.Net version: 6.4.0 Elasticsearch version: 6.5.1 Description of the problem including expected versus actual behavior: I am reindexing some document from 5.0 ES index to 6.5.1 using NEST client and bu…

---

## [DROP processor does not appear to work in elastic search 6.5.0 with GROK](https://discuss.elastic.co/t/drop-processor-does-not-appear-to-work-in-elastic-search-6-5-0-with-grok/158914)

<div class="topic-metadata">

**Author:** [@ajazam1](https://discuss.elastic.co/u/ajazam1)\
**Replies:** 1\
**Last updated:** [December 3, 2018, 10:23am UTC](https://discuss.elastic.co/t/drop-processor-does-not-appear-to-work-in-elastic-search-6-5-0-with-grok/158914 "2018-12-03T10:23:17Z")

</div>

Hello, I have been trying to get the DROP processor to work in our Elastic Cloud. We are running v6.5.0. I am using the following pipeline PUT \_ingest/pipeline/pipeline1 { "description" : "logs", "processors" : \[ …

---

## [How to get number from value field that is set as string and range it](https://discuss.elastic.co/t/how-to-get-number-from-value-field-that-is-set-as-string-and-range-it/159046)

<div class="topic-metadata">

**Author:** [@assaf\_elgov](https://discuss.elastic.co/u/assaf_elgov)\
**Replies:** 4\
**Last updated:** [December 3, 2018, 10:06am UTC](https://discuss.elastic.co/t/how-to-get-number-from-value-field-that-is-set-as-string-and-range-it/159046 "2018-12-03T10:06:44Z")

</div>

Hi, This is the content of one of the fields I get: \*\*\*\*\* System health report \*\*\*\*\* Available processors (cores): 2 Free memory: 63 MB Maximum memory: 247 MB Total memory: 247 MB Operating System Architecture: ar…

---

## [Can I dynamically extract fields from a document?](https://discuss.elastic.co/t/can-i-dynamically-extract-fields-from-a-document/158986)

<div class="topic-metadata">

**Author:** [@Jeffrey\_Pinyan](https://discuss.elastic.co/u/Jeffrey_Pinyan)\
**Replies:** 1\
**Last updated:** [December 3, 2018, 9:57am UTC](https://discuss.elastic.co/t/can-i-dynamically-extract-fields-from-a-document/158986 "2018-12-03T09:57:52Z")

</div>

Can I dynamically select fields from my document to return, based on a query? Say I have a document like so: {"name":"jeff","friends":\[{"name":"chad","age":29},{"name":"damian","age":23},{"name":"chris","age":21}\]} I w…

---

## [How to Add Data into Existing Index in Elasticsearch 6.4.3 using Olivere Package in Golang](https://discuss.elastic.co/t/how-to-add-data-into-existing-index-in-elasticsearch-6-4-3-using-olivere-package-in-golang/159078)

<div class="topic-metadata">

**Author:** [@thejuniordevops](https://discuss.elastic.co/u/thejuniordevops)\
**Replies:** 1\
**Last updated:** [December 3, 2018, 9:55am UTC](https://discuss.elastic.co/t/how-to-add-data-into-existing-index-in-elasticsearch-6-4-3-using-olivere-package-in-golang/159078 "2018-12-03T09:55:28Z")

</div>

I am not sure whether it is correct or not. But I think that if I want to add new data or document into existing index in elasticsearch using olivere in golang, the only option available is to delete the index and re ind…

---

## [Elasticsearch config watcher problem](https://discuss.elastic.co/t/elasticsearch-config-watcher-problem/159124)

<div class="topic-metadata">

**Author:** [@zoux](https://discuss.elastic.co/u/zoux)\
**Replies:** 1\
**Last updated:** [December 3, 2018, 9:45am UTC](https://discuss.elastic.co/t/elasticsearch-config-watcher-problem/159124 "2018-12-03T09:45:00Z")

</div>

I add watcher to elasticsearch ,bui doesnt work here is the error log: org.elasticsearch.bootstrap.StartupException: java.lang.IllegalArgumentException: unknown setting \[watcher.actions.email.service.account.work.smtp.…

---

## [Filebeat to elasticsearch's ingest node in Kubernetes](https://discuss.elastic.co/t/filebeat-to-elasticsearchs-ingest-node-in-kubernetes/159103)

<div class="topic-metadata">

**Author:** [@zeusro](https://discuss.elastic.co/u/zeusro)\
**Replies:** 0\
**Last updated:** [December 3, 2018, 7:25am UTC](https://discuss.elastic.co/t/filebeat-to-elasticsearchs-ingest-node-in-kubernetes/159103 "2018-12-03T07:25:20Z")

</div>

I followed the guide as running-on-kubernetes say,everything worked fine,but one day I would like to spilt the message field by using ES's ingrest node.So I created three pipelines to handle the original docker's contai…

---

## [How to define document count for metricAgg](https://discuss.elastic.co/t/how-to-define-document-count-for-metricagg/159102)

<div class="topic-metadata">

**Author:** [@gayathri](https://discuss.elastic.co/u/gayathri)\
**Replies:** 0\
**Last updated:** [December 3, 2018, 7:16am UTC](https://discuss.elastic.co/t/how-to-define-document-count-for-metricagg/159102 "2018-12-03T07:16:44Z")

</div>

Hi Team, Kindly let me know how redefine the size of documents for avg calculation while using metricAgg in Watcher query. tried the below, still it is counting for only 10 documents: "aggs": { "bucketAgg": { "terms…

---

## [Geo distance query order by distance](https://discuss.elastic.co/t/geo-distance-query-order-by-distance/159066)

<div class="topic-metadata">

**Author:** [@michaelnguyen](https://discuss.elastic.co/u/michaelnguyen)\
**Replies:** 1\
**Last updated:** [December 3, 2018, 6:40am UTC](https://discuss.elastic.co/t/geo-distance-query-order-by-distance/159066 "2018-12-03T06:40:20Z")

</div>

I can search geo point that within distance raidus (e.g. \< 10 km) with Geo Distance Query(https://www.elastic.co/guide/en/elasticsearch/reference/6.5/query-dsl-geo-distance-query.html#query-dsl-geo-distance-query). I wa…

---

## [Is there a way to check a specific field belong to which indices?](https://discuss.elastic.co/t/is-there-a-way-to-check-a-specific-field-belong-to-which-indices/159094)

<div class="topic-metadata">

**Author:** [@af615dbd55cac2cacf32](https://discuss.elastic.co/u/af615dbd55cac2cacf32)\
**Replies:** 1\
**Last updated:** [December 3, 2018, 6:20am UTC](https://discuss.elastic.co/t/is-there-a-way-to-check-a-specific-field-belong-to-which-indices/159094 "2018-12-03T06:20:22Z")

</div>

hello, my elasticsearch has more than 500 indices and each index has many fields. i wonder if there is a API/query to check a specific field name belong to which indices. e.g. "abc" field belongs to which index. i gues…

---

## [NEST: Why all my text fields in the index have keyword type?](https://discuss.elastic.co/t/nest-why-all-my-text-fields-in-the-index-have-keyword-type/159084)

<div class="topic-metadata">

**Author:** [@Neu](https://discuss.elastic.co/u/Neu)\
**Replies:** 1\
**Last updated:** [December 3, 2018, 4:39am UTC](https://discuss.elastic.co/t/nest-why-all-my-text-fields-in-the-index-have-keyword-type/159084 "2018-12-03T04:39:28Z")

</div>

I pushing new documents using NEST in pair with class with attributes. Here is how I define a class: public class PatientNestModel { \[Text\] public string FirstName { get; set; } \[Text\] …

---

## [Peer certificate cannot be authenticated with known CA certificates](https://discuss.elastic.co/t/peer-certificate-cannot-be-authenticated-with-known-ca-certificates/158832)

<div class="topic-metadata">

**Author:** [@squad](https://discuss.elastic.co/u/squad)\
**Replies:** 3\
**Last updated:** [December 3, 2018, 3:31am UTC](https://discuss.elastic.co/t/peer-certificate-cannot-be-authenticated-with-known-ca-certificates/158832 "2018-12-03T03:31:51Z")

</div>

Hi, I'm working on encrypting a dev ELK 5.6 stack on CentOs 6. I have followed the documents and was able to issue certificates and got the communication set between two elasticsearch nodes and kibana. However, I se…

---

## [Sort is out of order - using Nested Filter](https://discuss.elastic.co/t/sort-is-out-of-order-using-nested-filter/159070)

<div class="topic-metadata">

**Author:** [@sagar.buddhi](https://discuss.elastic.co/u/sagar.buddhi)\
**Replies:** 0\
**Last updated:** [December 3, 2018, 1:28am UTC](https://discuss.elastic.co/t/sort-is-out-of-order-using-nested-filter/159070 "2018-12-03T01:28:32Z")

</div>

Hi All, I am trying to implement sorting by nested fields using this as reference (https://www.elastic.co/guide/en/elasticsearch/guide/current/nested-sorting.html) . but the results returned are not in sorted order. Cou…

---

## [Need help in - TLS in elastic cluster settings](https://discuss.elastic.co/t/need-help-in-tls-in-elastic-cluster-settings/158502)

<div class="topic-metadata">

**Author:** [@sl1729](https://discuss.elastic.co/u/sl1729)\
**Replies:** 1\
**Last updated:** [December 2, 2018, 11:56pm UTC](https://discuss.elastic.co/t/need-help-in-tls-in-elastic-cluster-settings/158502 "2018-12-02T23:56:08Z")

</div>

I am setting up a three node cluster currently, Got it working successfully without security, which I am trying currently, From the organization I got a signed certificate on the DNS name which is load balanced external…

---

## [Security\_exception creating snapshot with Python client](https://discuss.elastic.co/t/security-exception-creating-snapshot-with-python-client/158183)

<div class="topic-metadata">

**Author:** [@rschirin](https://discuss.elastic.co/u/rschirin)\
**Replies:** 1\
**Last updated:** [December 2, 2018, 11:42pm UTC](https://discuss.elastic.co/t/security-exception-creating-snapshot-with-python-client/158183 "2018-12-02T23:42:06Z")

</div>

hi all, I'm trying to use the Python client to create and manage snapshot on my ELK cluster 5.6.x. A lot of time I face this error: elasticsearch.exceptions.AuthenticationException: AuthenticationException(401, 'secur…

---

## [ES Cluster Health in yellow due to some Replica shards in Unassigned state](https://discuss.elastic.co/t/es-cluster-health-in-yellow-due-to-some-replica-shards-in-unassigned-state/157836)

<div class="topic-metadata">

**Author:** [@damvinod](https://discuss.elastic.co/u/damvinod)\
**Replies:** 1\
**Last updated:** [December 2, 2018, 11:25pm UTC](https://discuss.elastic.co/t/es-cluster-health-in-yellow-due-to-some-replica-shards-in-unassigned-state/157836 "2018-12-02T23:25:32Z")

</div>

We have elastic search Production cluster environment with 4 nodes Node 1: node.master: true Node 2: node.master: true node.data: true Node 3: node.master: true node.data: true Node 4: Coordinating node node.ma…

---

## [TLS/SSL enabled cluster , SSL is working TSL not working with p12 cert password protected](https://discuss.elastic.co/t/tls-ssl-enabled-cluster-ssl-is-working-tsl-not-working-with-p12-cert-password-protected/157956)

<div class="topic-metadata">

**Author:** [@rijinmp](https://discuss.elastic.co/u/rijinmp)\
**Replies:** 21\
**Last updated:** [December 2, 2018, 11:02pm UTC](https://discuss.elastic.co/t/tls-ssl-enabled-cluster-ssl-is-working-tsl-not-working-with-p12-cert-password-protected/157956 "2018-12-02T23:02:54Z")

</div>

Hi All , My ES Cluster is 3 maser and 2 data nodes. In my elastic and kibana conf when i am using SSL conf only its working. i can connect from kibana to ES data node with url http://ip:9200 In the same conf if I …

---

## [ElasticSearch query using Top\_Hits aggregation returns additional information than required](https://discuss.elastic.co/t/elasticsearch-query-using-top-hits-aggregation-returns-additional-information-than-required/158427)

<div class="topic-metadata">

**Author:** [@Pradeep\_ES](https://discuss.elastic.co/u/Pradeep_ES)\
**Replies:** 4\
**Last updated:** [December 2, 2018, 9:44pm UTC](https://discuss.elastic.co/t/elasticsearch-query-using-top-hits-aggregation-returns-additional-information-than-required/158427 "2018-12-02T21:44:54Z")

</div>

A search\_term can have multiple list of synonyms and I want Elasticsearch to group synonyms by search\_term and it appears that top\_hits aggregation is the right solution. But the only issue I have is that it returns addi…

---

## [Disable re-replicate](https://discuss.elastic.co/t/disable-re-replicate/158992)

<div class="topic-metadata">

**Author:** [@arp220](https://discuss.elastic.co/u/arp220)\
**Replies:** 3\
**Last updated:** [December 2, 2018, 4:33pm UTC](https://discuss.elastic.co/t/disable-re-replicate/158992 "2018-12-02T16:33:13Z")

</div>

Hi all. i have two question. 1: is it possible to disable re-replicate in elasticsearch? and 2: Is the search performed on the replicate or just on the primary shard?

---

## [Min\_bucket date format does not work](https://discuss.elastic.co/t/min-bucket-date-format-does-not-work/159052)

<div class="topic-metadata">

**Author:** [@gabor.toth](https://discuss.elastic.co/u/gabor.toth)\
**Replies:** 0\
**Last updated:** [December 2, 2018, 4:10pm UTC](https://discuss.elastic.co/t/min-bucket-date-format-does-not-work/159052 "2018-12-02T16:10:38Z")

</div>

Hi, I am trying to format of a result of a min\_bucket. (I want to get the minimum of maximum date by datasource, which is working well.) GET my-index/\_search { "size": 0, "aggs": { "source": { "terms":…

---

## [Using Elasticsearch client 6.4 with a 5.6 server?](https://discuss.elastic.co/t/using-elasticsearch-client-6-4-with-a-5-6-server/159034)

<div class="topic-metadata">

**Author:** [@salamander](https://discuss.elastic.co/u/salamander)\
**Replies:** 1\
**Last updated:** [December 2, 2018, 11:32am UTC](https://discuss.elastic.co/t/using-elasticsearch-client-6-4-with-a-5-6-server/159034 "2018-12-02T11:32:38Z")

</div>

Hey, I have a little question regarding the use of a new client (6.4) with an older server (5.6). Due to some technical limitations, I'm not able to upgrade the server right now, However - I am able to upgrade the cli…

---

## [Logstash sprintf formatting for elasticsearch output plugin does not seem to resolve](https://discuss.elastic.co/t/logstash-sprintf-formatting-for-elasticsearch-output-plugin-does-not-seem-to-resolve/159025)

<div class="topic-metadata">

**Author:** [@houdinisparks](https://discuss.elastic.co/u/houdinisparks)\
**Replies:** 1\
**Last updated:** [December 2, 2018, 10:38am UTC](https://discuss.elastic.co/t/logstash-sprintf-formatting-for-elasticsearch-output-plugin-does-not-seem-to-resolve/159025 "2018-12-02T10:38:45Z")

</div>

I am having trouble using sprintf to reference the event fields in the elasticsearch output plugin and I'm not sure why. Below is the event received from Filebeat and sent to Elasticsearch after filtering is complete: …

---

## [Problem with dynamic fields](https://discuss.elastic.co/t/problem-with-dynamic-fields/159029)

<div class="topic-metadata">

**Author:** [@mhsankar](https://discuss.elastic.co/u/mhsankar)\
**Replies:** 0\
**Last updated:** [December 2, 2018, 6:24am UTC](https://discuss.elastic.co/t/problem-with-dynamic-fields/159029 "2018-12-02T06:24:41Z")

</div>

Hi i am running Packet-beat in my server. in index mapping i set disabled dynamic. it mean if new data coming . don't create new fields. in my mapping there is not extra field but when i send a request from postman . …

---

## [Elasticsearch Cluster Performance Tuning Help required](https://discuss.elastic.co/t/elasticsearch-cluster-performance-tuning-help-required/157867)

<div class="topic-metadata">

**Author:** [@nuwancs](https://discuss.elastic.co/u/nuwancs)\
**Replies:** 14\
**Last updated:** [December 2, 2018, 5:28am UTC](https://discuss.elastic.co/t/elasticsearch-cluster-performance-tuning-help-required/157867 "2018-12-02T05:28:43Z")

</div>

Hi All, I have 3 nodes elastic cluster each node assigned with 1Tb hard disk, 15GB Ram and 4 CPU Elastic version using is 6.3.0. At the moment I have 3,304,624,313 documents using 2.1 TB disk space This data is colle…

---

## [Nondeterministic error for scripted fields](https://discuss.elastic.co/t/nondeterministic-error-for-scripted-fields/159006)

<div class="topic-metadata">

**Author:** [@toughrogrammer](https://discuss.elastic.co/u/toughrogrammer)\
**Replies:** 1\
**Last updated:** [December 1, 2018, 4:50pm UTC](https://discuss.elastic.co/t/nondeterministic-error-for-scripted-fields/159006 "2018-12-01T16:50:22Z")

</div>

Please watch my video: https://www.useloom.com/share/78ab63ad1bc94250beab6a490d24fffc As you can see in video, I query scripted value. Sometimes there is exception, and sometimes there isn't. Why there is this weird s…

---

## [FS crawler should be used in the same server where elasticsearch is installed](https://discuss.elastic.co/t/fs-crawler-should-be-used-in-the-same-server-where-elasticsearch-is-installed/159003)

<div class="topic-metadata">

**Author:** [@Edu](https://discuss.elastic.co/u/Edu)\
**Replies:** 1\
**Last updated:** [December 1, 2018, 3:27pm UTC](https://discuss.elastic.co/t/fs-crawler-should-be-used-in-the-same-server-where-elasticsearch-is-installed/159003 "2018-12-01T15:27:35Z")

</div>

Dear All, I have started to work with elasticsearch last week. I apologize if I am asking something too obvious. I have to develop a fast solution for users to search inside MS-Office files. I have two docker contain…

---

## [How to make a template for a document which has too many fields?](https://discuss.elastic.co/t/how-to-make-a-template-for-a-document-which-has-too-many-fields/158822)

<div class="topic-metadata">

**Author:** [@kazu1049jp](https://discuss.elastic.co/u/kazu1049jp)\
**Replies:** 2\
**Last updated:** [December 1, 2018, 8:09am UTC](https://discuss.elastic.co/t/how-to-make-a-template-for-a-document-which-has-too-many-fields/158822 "2018-12-01T08:09:56Z")

</div>

Hello. I want to make an index template for a document which has over 1000 fileds. But, I can't understand how to set a valid type for each field because making such template is too terrible... Can I make an index t…

---

## [Try to recover \[test-20181128\]\[2\] from primary shard with sync id but number of docs differ: 59432 (10.1.1.189, primary) vs 60034(10.1.1.190)](https://discuss.elastic.co/t/try-to-recover-test-20181128-2-from-primary-shard-with-sync-id-but-number-of-docs-differ-59432-10-1-1-189-primary-vs-60034-10-1-1-190/158983)

<div class="topic-metadata">

**Author:** [@jiankunking](https://discuss.elastic.co/u/jiankunking)\
**Replies:** 1\
**Last updated:** [December 1, 2018, 7:49am UTC](https://discuss.elastic.co/t/try-to-recover-test-20181128-2-from-primary-shard-with-sync-id-but-number-of-docs-differ-59432-10-1-1-189-primary-vs-60034-10-1-1-190/158983 "2018-12-01T07:49:05Z")

</div>

We use three ES data nodes with setting -Xmx30g -Xms30g. The three ES servers have 128G physical memory and 32 CPU cores. the ES version is 5.4.1. The following exception was found in the log today: Caused by: java.la…

---

## [Elasticsearch + MySQL](https://discuss.elastic.co/t/elasticsearch-mysql/158211)

<div class="topic-metadata">

**Author:** [@Marcos\_Felix](https://discuss.elastic.co/u/Marcos_Felix)\
**Replies:** 7\
**Last updated:** [December 1, 2018, 3:56am UTC](https://discuss.elastic.co/t/elasticsearch-mysql/158211 "2018-12-01T03:56:43Z")

</div>

Hello, Getting logs from ntopng - was thinking sending it to MySQL and then using Elasticsearch to query it and obviously visualize it in Kibana. Is this ideal? Im looking to keep 1 year worth of logs. On top of ntopng…

[Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1464)

[Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1466)
