# Elasticsearch

**URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1470

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 1471

---

## [Term Query is not working](https://discuss.elastic.co/t/term-query-is-not-working/158470)

<div class="topic-metadata">

**Author:** [@Giorgi\_Kharchenko](https://discuss.elastic.co/u/Giorgi_Kharchenko)\
**Replies:** 7\
**Last updated:** [November 28, 2018, 7:55am UTC](https://discuss.elastic.co/t/term-query-is-not-working/158470 "2018-11-28T07:55:19Z")

</div>

Hi, I tried to run this query. but this query is not working. I changed term with match\_phrase so it is working. Can you tell me what the problem is? GET index/\_search { "query": { "bool": { …

---

## [How to monitor the performance of query by java High-Level Rest Client?](https://discuss.elastic.co/t/how-to-monitor-the-performance-of-query-by-java-high-level-rest-client/158441)

<div class="topic-metadata">

**Author:** [@enum](https://discuss.elastic.co/u/enum)\
**Replies:** 1\
**Last updated:** [November 28, 2018, 7:39am UTC](https://discuss.elastic.co/t/how-to-monitor-the-performance-of-query-by-java-high-level-rest-client/158441 "2018-11-28T07:39:44Z")

</div>

I want to implement a search bar in my application by java client.But the performance is disappointing and we need to find the problem. How i do it? Thanks

---

## [Match Query - Can you help me?](https://discuss.elastic.co/t/match-query-can-you-help-me/158457)

<div class="topic-metadata">

**Author:** [@Giorgi\_Kharchenko](https://discuss.elastic.co/u/Giorgi_Kharchenko)\
**Replies:** 5\
**Last updated:** [November 28, 2018, 7:35am UTC](https://discuss.elastic.co/t/match-query-can-you-help-me/158457 "2018-11-28T07:35:22Z")

</div>

Hi, I want to search this kind of thing. I have fields like this. identifiers:\[{key: "list1", value:"My name is Giorgi"}, {key:"list2", value:"Giorgi"}, {key:"list3", value:"Giorgi Kharchenko"}\] { "query" :{ "bool…

---

## [Search within differnt indices get same amount of documents](https://discuss.elastic.co/t/search-within-differnt-indices-get-same-amount-of-documents/158323)

<div class="topic-metadata">

**Author:** [@super\_yang](https://discuss.elastic.co/u/super_yang)\
**Replies:** 3\
**Last updated:** [November 28, 2018, 7:18am UTC](https://discuss.elastic.co/t/search-within-differnt-indices-get-same-amount-of-documents/158323 "2018-11-28T07:18:04Z")

</div>

Hello I want to got the same amount of documents from different indices within one query For Examples: two indices Company / Person, both have a field called "name" And I want to search all name match "smart", but I…

---

## [Need help to create the Delta (Incremental) load for Data extraction](https://discuss.elastic.co/t/need-help-to-create-the-delta-incremental-load-for-data-extraction/158483)

<div class="topic-metadata">

**Author:** [@vinay.rao](https://discuss.elastic.co/u/vinay.rao)\
**Replies:** 0\
**Last updated:** [November 28, 2018, 7:05am UTC](https://discuss.elastic.co/t/need-help-to-create-the-delta-incremental-load-for-data-extraction/158483 "2018-11-28T07:05:55Z")

</div>

Dear All, Am extracting the data through Rest API. Everytime when i extract the data whole complete data is getting extracted everytime and disc size is reaching saturation and its impacting performance. Please help me…

---

## [How could I search an array of terms using wildcard](https://discuss.elastic.co/t/how-could-i-search-an-array-of-terms-using-wildcard/158397)

<div class="topic-metadata">

**Author:** [@Gabriel\_Pellegrini\_M](https://discuss.elastic.co/u/Gabriel_Pellegrini_M)\
**Replies:** 1\
**Last updated:** [November 28, 2018, 7:05am UTC](https://discuss.elastic.co/t/how-could-i-search-an-array-of-terms-using-wildcard/158397 "2018-11-28T07:05:53Z")

</div>

I'm looking for a way to search an array of items where should have wildcards in their extremities. I tried to use query\_string, but this search does not allow an array search. {"query": { "bool": { …

---

## [MultiPhraseQuery in Elastic using NEST](https://discuss.elastic.co/t/multiphrasequery-in-elastic-using-nest/157218)

<div class="topic-metadata">

**Author:** [@omri.suissa](https://discuss.elastic.co/u/omri.suissa)\
**Replies:** 6\
**Last updated:** [November 28, 2018, 6:48am UTC](https://discuss.elastic.co/t/multiphrasequery-in-elastic-using-nest/157218 "2018-11-28T06:48:49Z")

</div>

Hi, I'm migrating from Lucene to Elastic (6.2.4). Today we use Lucene's MultiPhraseQuery to set phrase queries in the same position. Elastic (and NEST) comes with a "MatchPhrase" query that can get only one phrase (str…

---

## [Switching to Big Data Architecture](https://discuss.elastic.co/t/switching-to-big-data-architecture/158478)

<div class="topic-metadata">

**Author:** [@josephmanalo](https://discuss.elastic.co/u/josephmanalo)\
**Replies:** 0\
**Last updated:** [November 28, 2018, 6:45am UTC](https://discuss.elastic.co/t/switching-to-big-data-architecture/158478 "2018-11-28T06:45:38Z")

</div>

Hi guys. I would like to ask for some advice. Currently this is what our system architecture looks like. Current Process: Store data to Elasticsearch Transform data using Python Save the data using Postgres Visualize…

---

## [ElasticSearch Join Data Type Issue?](https://discuss.elastic.co/t/elasticsearch-join-data-type-issue/158469)

<div class="topic-metadata">

**Author:** [@kartheek91](https://discuss.elastic.co/u/kartheek91)\
**Replies:** 0\
**Last updated:** [November 28, 2018, 6:10am UTC](https://discuss.elastic.co/t/elasticsearch-join-data-type-issue/158469 "2018-11-28T06:10:12Z")

</div>

Hi I'm using elasticsearch join data type and I need to retrieve parent document based on child document condition based.Like I need to pass 10k ids of child and need to fetch parent documents.How I need to pass 10k ids …

---

## [Term Query issue](https://discuss.elastic.co/t/term-query-issue/158464)

<div class="topic-metadata">

**Author:** [@Giorgi\_Kharchenko](https://discuss.elastic.co/u/Giorgi_Kharchenko)\
**Replies:** 0\
**Last updated:** [November 28, 2018, 5:51am UTC](https://discuss.elastic.co/t/term-query-issue/158464 "2018-11-28T05:51:35Z")

</div>

Hi, all { "query": { "bool": { "must": \[ { "nested": { "path": "identifiers", "query": { "bool": { "must": \[ { "term": { "identifiers.value": "PERSONAS" } } \] } } } } \] } } } I am not sure why th…

---

## [How to send data from elasticsearch to another elasticsearch?](https://discuss.elastic.co/t/how-to-send-data-from-elasticsearch-to-another-elasticsearch/158215)

<div class="topic-metadata">

**Author:** [@hama97](https://discuss.elastic.co/u/hama97)\
**Replies:** 3\
**Last updated:** [November 28, 2018, 1:36am UTC](https://discuss.elastic.co/t/how-to-send-data-from-elasticsearch-to-another-elasticsearch/158215 "2018-11-28T01:36:34Z")

</div>

i use elasticsearch for wazuh and I need to send data from my local elasticsearch to another elasticseatch. I want to send only the data that have the level field of a given threshold. how i do it? Thanks, Hama

---

## [Elasticsearch 6.5.1 does not start on ubuntu 16.04](https://discuss.elastic.co/t/elasticsearch-6-5-1-does-not-start-on-ubuntu-16-04/158424)

<div class="topic-metadata">

**Author:** [@zozo6015](https://discuss.elastic.co/u/zozo6015)\
**Replies:** 0\
**Last updated:** [November 27, 2018, 9:53pm UTC](https://discuss.elastic.co/t/elasticsearch-6-5-1-does-not-start-on-ubuntu-16-04/158424 "2018-11-27T21:53:19Z")

</div>

Hello, I have a newly installed elasticsearch 6.5.1 on an ubuntu 16.04 system. One of the nodes does not want to start. However if I start the process manually by running /usr/share/elasticsearch/bin/elasticsearch it do…

---

## [Referencing a simple input from a different input in a watcher](https://discuss.elastic.co/t/referencing-a-simple-input-from-a-different-input-in-a-watcher/157401)

<div class="topic-metadata">

**Author:** [@yesman](https://discuss.elastic.co/u/yesman)\
**Replies:** 2\
**Last updated:** [November 27, 2018, 9:42pm UTC](https://discuss.elastic.co/t/referencing-a-simple-input-from-a-different-input-in-a-watcher/157401 "2018-11-27T21:42:27Z")

</div>

Howdy Y'all, My team is trying to construct a watcher that uses the strings defined in the simple input section and places them into the search input section so I can rapidly create multiple watchers by only having to m…

---

## [Stemming not working as expected](https://discuss.elastic.co/t/stemming-not-working-as-expected/158409)

<div class="topic-metadata">

**Author:** [@rayl7786](https://discuss.elastic.co/u/rayl7786)\
**Replies:** 0\
**Last updated:** [November 27, 2018, 8:06pm UTC](https://discuss.elastic.co/t/stemming-not-working-as-expected/158409 "2018-11-27T20:06:08Z")

</div>

Using the analyze API, I get "fold" and "knife" because of the synonym, using the "default"; analyzer. That's working as expected, however, we're not getting the correct results returned when using the search API. get …

---

## [Sizing ELK cluster for 12GB daily logs](https://discuss.elastic.co/t/sizing-elk-cluster-for-12gb-daily-logs/158176)

<div class="topic-metadata">

**Author:** [@gerasimos](https://discuss.elastic.co/u/gerasimos)\
**Replies:** 2\
**Last updated:** [November 27, 2018, 7:46pm UTC](https://discuss.elastic.co/t/sizing-elk-cluster-for-12gb-daily-logs/158176 "2018-11-27T19:46:40Z")

</div>

Hello, I am moving an ELK demo deployment (FileBeats -\> Logstash cluster -\> ElasticSearch cluster) to a production one. I am expecting ~12GB of daily logs to be fed into ElasticSearch, with a retention period of 1 year.…

---

## [Best practices for monitoring curator snapshot (failures)](https://discuss.elastic.co/t/best-practices-for-monitoring-curator-snapshot-failures/158386)

<div class="topic-metadata">

**Author:** [@jonassteinberg1](https://discuss.elastic.co/u/jonassteinberg1)\
**Replies:** 5\
**Last updated:** [November 27, 2018, 6:40pm UTC](https://discuss.elastic.co/t/best-practices-for-monitoring-curator-snapshot-failures/158386 "2018-11-27T18:40:17Z")

</div>

@theuntergeek I have a nice curator --\> AWS S3 snapshot pipeline for backing up my clusters, but from time-to-time a snapshot will fail and thus I'm wondering what the best way to monitor snapshot failures is? Right no…

---

## [Puppet-elastic module and elasticsearch.yml](https://discuss.elastic.co/t/puppet-elastic-module-and-elasticsearch-yml/157941)

<div class="topic-metadata">

**Author:** [@xzhou](https://discuss.elastic.co/u/xzhou)\
**Replies:** 3\
**Last updated:** [November 27, 2018, 6:24pm UTC](https://discuss.elastic.co/t/puppet-elastic-module-and-elasticsearch-yml/157941 "2018-11-27T18:24:30Z")

</div>

Hi In the puppet templates, what we defined is as follow. .... group\_search =\> { base\_dn =\> 'OU=X,OU=Y,OU=Enterprise Services,DC=A,DC=B,DC=C', scope =\> 'one\_level', }, .... The following is what we get in the gen…

---

## [Scripts may be no longer than 16384 characters](https://discuss.elastic.co/t/scripts-may-be-no-longer-than-16384-characters/158178)

<div class="topic-metadata">

**Author:** [@bfcshop](https://discuss.elastic.co/u/bfcshop)\
**Replies:** 3\
**Last updated:** [November 27, 2018, 5:15pm UTC](https://discuss.elastic.co/t/scripts-may-be-no-longer-than-16384-characters/158178 "2018-11-27T17:15:53Z")

</div>

I am using Elasticsearch on my Magento store and I found a problem when searching for product, but only for some search strings Here is the error log: {"0":"{"error":{"root\_cause":\[{"type":"script\_exception","reason":"…

---

## [Issue with elastic cluster after upgrade to 6.5.0](https://discuss.elastic.co/t/issue-with-elastic-cluster-after-upgrade-to-6-5-0/157768)

<div class="topic-metadata">

**Author:** [@planetvortex](https://discuss.elastic.co/u/planetvortex)\
**Replies:** 6\
**Last updated:** [November 27, 2018, 5:06pm UTC](https://discuss.elastic.co/t/issue-with-elastic-cluster-after-upgrade-to-6-5-0/157768 "2018-11-27T17:06:29Z")

</div>

My master node is reporting the following error "role retrieval failed from \[native roles store\]" \[2018-11-21T18:27:50,739\]\[WARN \]\[o.e.x.s.a.s.CompositeRolesStore\] \[elk-master-2.mydomain.net\] role retrieval failed from…

---

## [Which security index do I keep?](https://discuss.elastic.co/t/which-security-index-do-i-keep/157771)

<div class="topic-metadata">

**Author:** [@planetvortex](https://discuss.elastic.co/u/planetvortex)\
**Replies:** 2\
**Last updated:** [November 27, 2018, 5:04pm UTC](https://discuss.elastic.co/t/which-security-index-do-i-keep/157771 "2018-11-27T17:04:31Z")

</div>

which .security index does the elastic stack use in 6.5? I have some that may be old legacy ones. Is there a way to see which is the main one? for example, I have .security-6 and .security If .security is the main on…

---

## [Search with pagination](https://discuss.elastic.co/t/search-with-pagination/158384)

<div class="topic-metadata">

**Author:** [@pablo\_rufat](https://discuss.elastic.co/u/pablo_rufat)\
**Replies:** 0\
**Last updated:** [November 27, 2018, 4:46pm UTC](https://discuss.elastic.co/t/search-with-pagination/158384 "2018-11-27T16:46:04Z")

</div>

Hi! I'm trying to find a way to combine pagination and search over a resultset of an aggregation. I have a sorted aggregation that returns 20 buckets per page (I'm doing it with composite aggregation and after attribut…

---

## [Issues getting search results](https://discuss.elastic.co/t/issues-getting-search-results/156929)

<div class="topic-metadata">

**Author:** [@HockeyFan0000](https://discuss.elastic.co/u/HockeyFan0000)\
**Replies:** 2\
**Last updated:** [November 27, 2018, 4:31pm UTC](https://discuss.elastic.co/t/issues-getting-search-results/156929 "2018-11-27T16:31:22Z")

</div>

I'm trying to do a query for server logs. The search is returning results but there are a couple of issues. I'm specifying the server name, yet I'm getting results back for other servers in the same domain. Even t…

---

## [Unable to create an update script](https://discuss.elastic.co/t/unable-to-create-an-update-script/158146)

<div class="topic-metadata">

**Author:** [@markmevans](https://discuss.elastic.co/u/markmevans)\
**Replies:** 3\
**Last updated:** [November 27, 2018, 4:26pm UTC](https://discuss.elastic.co/t/unable-to-create-an-update-script/158146 "2018-11-27T16:26:38Z")

</div>

We are running 2 instances of ElasticCloud version 5.6 - One for production and another for dev/test. I have run the following simple script successfully in in Kibana for the non-production instance POST \_scripts/updat…

---

## [Super basic indexing of all content for only fulltext search](https://discuss.elastic.co/t/super-basic-indexing-of-all-content-for-only-fulltext-search/158374)

<div class="topic-metadata">

**Author:** [@mriegler](https://discuss.elastic.co/u/mriegler)\
**Replies:** 1\
**Last updated:** [November 27, 2018, 4:21pm UTC](https://discuss.elastic.co/t/super-basic-indexing-of-all-content-for-only-fulltext-search/158374 "2018-11-27T16:21:06Z")

</div>

For a simple site search, we want to use ES. We have multiple document types in our CMS, but we only want to search everything via fulltext search. We don't care about treating any fields special. My naive approach woul…

---

## [Hive Runtime Error while processing row Caused by: org.elasticsearch.hadoop.serialization.EsHadoopSerializationException:](https://discuss.elastic.co/t/hive-runtime-error-while-processing-row-caused-by-org-elasticsearch-hadoop-serialization-eshadoopserializationexception/156098)

<div class="topic-metadata">

**Author:** [@praga](https://discuss.elastic.co/u/praga)\
**Replies:** 1\
**Last updated:** [November 27, 2018, 4:07pm UTC](https://discuss.elastic.co/t/hive-runtime-error-while-processing-row-caused-by-org-elasticsearch-hadoop-serialization-eshadoopserializationexception/156098 "2018-11-27T16:07:15Z")

</div>

Hi, I have been trying to create Hive Table with elastic index .Ended up with an issue.Please find the followed procedure below Employee table from Employee database - MySQL sample imported into Hadoop via Sqoop /user/…

---

## [Aggregate over multiple keys in the document, without knowing the key details](https://discuss.elastic.co/t/aggregate-over-multiple-keys-in-the-document-without-knowing-the-key-details/158238)

<div class="topic-metadata">

**Author:** [@User\_User](https://discuss.elastic.co/u/User_User)\
**Replies:** 6\
**Last updated:** [November 27, 2018, 3:37pm UTC](https://discuss.elastic.co/t/aggregate-over-multiple-keys-in-the-document-without-knowing-the-key-details/158238 "2018-11-27T15:37:42Z")

</div>

I am new to Elastic Search and was exploring aggregation query. The documents I have are in the format - {"name":"A", "class":"10th", "subjects":{ "S1":92, "S2":92, "S3":92, } }…

---

## [Issue with query on not indexed field](https://discuss.elastic.co/t/issue-with-query-on-not-indexed-field/158363)

<div class="topic-metadata">

**Author:** [@Thomas-11](https://discuss.elastic.co/u/Thomas-11)\
**Replies:** 0\
**Last updated:** [November 27, 2018, 2:55pm UTC](https://discuss.elastic.co/t/issue-with-query-on-not-indexed-field/158363 "2018-11-27T14:55:57Z")

</div>

Hello, I have a mapping where the field "payload" is not indexed. But I would like to build this kind of query: { "size": 0, "query": { "bool": { "must": \[ { "term": { "type": "hr-training" } }, { "match": { …

---

## [Can I know that inserted data is consistent for all shards / nodes?](https://discuss.elastic.co/t/can-i-know-that-inserted-data-is-consistent-for-all-shards-nodes/158334)

<div class="topic-metadata">

**Author:** [@genichm](https://discuss.elastic.co/u/genichm)\
**Replies:** 1\
**Last updated:** [November 27, 2018, 2:18pm UTC](https://discuss.elastic.co/t/can-i-know-that-inserted-data-is-consistent-for-all-shards-nodes/158334 "2018-11-27T14:18:35Z")

</div>

I want to make aggregations over inserted in Elasticsearch data but it means that inserted data should be consistent for all shards. Can I ensure consistency of inserted data or to know that data that was stored in ES be…

---

## [Events correlation best practice](https://discuss.elastic.co/t/events-correlation-best-practice/156285)

<div class="topic-metadata">

**Author:** [@mruthyu](https://discuss.elastic.co/u/mruthyu)\
**Replies:** 2\
**Last updated:** [November 27, 2018, 2:03pm UTC](https://discuss.elastic.co/t/events-correlation-best-practice/156285 "2018-11-27T14:03:07Z")

</div>

How to do a event correlation in Elasticsearch when the logs are from different technology layers. (Gateway, API, Business...etc layers)

---

## [Elastic query through browser](https://discuss.elastic.co/t/elastic-query-through-browser/158352)

<div class="topic-metadata">

**Author:** [@bejagammahesh](https://discuss.elastic.co/u/bejagammahesh)\
**Replies:** 0\
**Last updated:** [November 27, 2018, 1:53pm UTC](https://discuss.elastic.co/t/elastic-query-through-browser/158352 "2018-11-27T13:53:00Z")

</div>

HI Guys, I am trying to prepare elastic inner property query\[list\] through browser. But i am not getting the results. Please let me know how to prepare elastic query for below case index:test-item name: abcde pric…

[Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1469)

[Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1471)
