# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1488 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1489 --- ## [Exporting Bulk data to CSV](https://discuss.elastic.co/t/exporting-bulk-data-to-csv/156190)
**Author:** [@surajsrinivasa](https://discuss.elastic.co/u/surajsrinivasa)\ **Replies:** 1\ **Last updated:** [November 11, 2018, 1:16pm UTC](https://discuss.elastic.co/t/exporting-bulk-data-to-csv/156190 "2018-11-11T13:16:21Z")
We are using Elasticsearch version 6.4.2. to save access logs for our website. The logs are very heavy in nature, and take up almost 3-4 GB of storage per day. Sometime these logs are required by our IR team to investiga… --- ## [License basic inactive](https://discuss.elastic.co/t/license-basic-inactive/156163)
**Author:** [@epchelkin](https://discuss.elastic.co/u/epchelkin)\ **Replies:** 2\ **Last updated:** [November 11, 2018, 12:37pm UTC](https://discuss.elastic.co/t/license-basic-inactive/156163 "2018-11-11T12:37:57Z")
Hello! After today upgrade of elastic and kibana i've got that basic license is inactive and I cannot re-activate it even through api below is screenshot when tried to activate basic, I've got the following: Block… --- ## [Failed to authenticate user \[elastic\] on Kibana v.6.4.0](https://discuss.elastic.co/t/failed-to-authenticate-user-elastic-on-kibana-v-6-4-0/156195)
**Author:** [@Okay\_SK](https://discuss.elastic.co/u/Okay_SK)\ **Replies:** 1\ **Last updated:** [November 11, 2018, 12:14pm UTC](https://discuss.elastic.co/t/failed-to-authenticate-user-elastic-on-kibana-v-6-4-0/156195 "2018-11-11T12:14:09Z")
$ curl -XPUT -u elastic 'localhost:9200/\_xpack/security/user/elastic/\_password' -H "Content-Type: application/json" -d '{ "password" : “1234” }' Enter host password for user 'elastic': {"error":{"root\_cause":\[{"type"… --- ## [Rally tests on a running cluster](https://discuss.elastic.co/t/rally-tests-on-a-running-cluster/156188)
**Author:** [@yossib](https://discuss.elastic.co/u/yossib)\ **Replies:** 4\ **Last updated:** [November 11, 2018, 10:57am UTC](https://discuss.elastic.co/t/rally-tests-on-a-running-cluster/156188 "2018-11-11T10:57:26Z")
hi, I have a 3 node cluster, it is in production... how can I test it with rally without damaging it's performance? --- ## [Return all results where field is missing or false](https://discuss.elastic.co/t/return-all-results-where-field-is-missing-or-false/156162)
**Author:** [@i333](https://discuss.elastic.co/u/i333)\ **Replies:** 3\ **Last updated:** [November 11, 2018, 9:55am UTC](https://discuss.elastic.co/t/return-all-results-where-field-is-missing-or-false/156162 "2018-11-11T09:55:19Z")
How could I return all results where myboolean field below is either missing or false? I want it to be under filter because I don't want it to contribute to the store, it should just remove all results where myboolean is… --- ## [How many nodes can a cluster have?](https://discuss.elastic.co/t/how-many-nodes-can-a-cluster-have/156187)
**Author:** [@jae.won](https://discuss.elastic.co/u/jae.won)\ **Replies:** 3\ **Last updated:** [November 11, 2018, 9:47am UTC](https://discuss.elastic.co/t/how-many-nodes-can-a-cluster-have/156187 "2018-11-11T09:47:54Z")
Hi guys, Is it possible for a cluster to have about hundreds (or thousands) of nodes at one time? I heard that there is a kind of "soft limit" in the size of a cluster due to the gossip performance, so 150 or thereabou… --- ## [Configure GCP bucket for snapshot](https://discuss.elastic.co/t/configure-gcp-bucket-for-snapshot/156150)
**Author:** [@Nikhilpawar1985](https://discuss.elastic.co/u/Nikhilpawar1985)\ **Replies:** 3\ **Last updated:** [November 11, 2018, 8:31am UTC](https://discuss.elastic.co/t/configure-gcp-bucket-for-snapshot/156150 "2018-11-11T08:31:13Z")
Hi , I have ES cluster running on GCP instances. I am trying to configure GCP bucket for snapshots but unable to add gcp service-account.json (credential file to ES keystore ) can someone advise on this , how to add it … --- ## [Import .log file in elasticsearch and Kibana](https://discuss.elastic.co/t/import-log-file-in-elasticsearch-and-kibana/156181)
**Author:** [@matthiashaefeli](https://discuss.elastic.co/u/matthiashaefeli)\ **Replies:** 3\ **Last updated:** [November 11, 2018, 7:11am UTC](https://discuss.elastic.co/t/import-log-file-in-elasticsearch-and-kibana/156181 "2018-11-11T07:11:37Z")
I have this .log file with JSON and it looks like this {"method":"GET","path":"/public/index","format":"html","controller":"public","action":"index","status":200,"duration":84.59,"view":33.7,"db":47.45,"ip":"127.0.0.1… --- ## [Convert SearchSourceBuilder to Json](https://discuss.elastic.co/t/convert-searchsourcebuilder-to-json/156118)
**Author:** [@deepak643](https://discuss.elastic.co/u/deepak643)\ **Replies:** 5\ **Last updated:** [November 10, 2018, 6:19pm UTC](https://discuss.elastic.co/t/convert-searchsourcebuilder-to-json/156118 "2018-11-10T18:19:33Z")
Hi all, May be this question was asked before See actual JSON from SearchRequestBuilder but I am completely new to the elastic search. I am trying to find a way to convert the queryBuilder/searchSourceBuilder to a Json… --- ## [Synonyms result scoring](https://discuss.elastic.co/t/synonyms-result-scoring/152523)
**Author:** [@Bilal](https://discuss.elastic.co/u/Bilal)\ **Replies:** 4\ **Last updated:** [November 10, 2018, 2:02pm UTC](https://discuss.elastic.co/t/synonyms-result-scoring/152523 "2018-11-10T14:02:53Z")
I'm reading this article about Patterns for Synonyms in Elasticsearch and I have some questions about the results that I got, here is the mappings and settings I used: PUT wheat\_syn { "mappings": { "wheat": { … --- ## [AWS streaming multi-line log files from CloudWatch to ELK](https://discuss.elastic.co/t/aws-streaming-multi-line-log-files-from-cloudwatch-to-elk/156135)
**Author:** [@0b3d953a632983bedb48](https://discuss.elastic.co/u/0b3d953a632983bedb48)\ **Replies:** 0\ **Last updated:** [November 10, 2018, 12:28pm UTC](https://discuss.elastic.co/t/aws-streaming-multi-line-log-files-from-cloudwatch-to-elk/156135 "2018-11-10T12:28:42Z")
We are streaming app logs from CloudWatch to AWS ELK. Our microservices are written in Java and so I am only concentrating on those. A typical java exception stack trace when logged looks like this: Exception in thread … --- ## [Query String Search format to return strings starting with search term](https://discuss.elastic.co/t/query-string-search-format-to-return-strings-starting-with-search-term/154494)
**Author:** [@gutiago](https://discuss.elastic.co/u/gutiago)\ **Replies:** 2\ **Last updated:** [November 10, 2018, 12:12pm UTC](https://discuss.elastic.co/t/query-string-search-format-to-return-strings-starting-with-search-term/154494 "2018-11-10T12:12:16Z")
Hello! I'm using query\_string to perform search on my index and retrieve the documents that have a partial match of the search term. So, before I introduce my question, I'll tell a little about the search environment. I… --- ## [Writing query for customer acquisition funnel analysis](https://discuss.elastic.co/t/writing-query-for-customer-acquisition-funnel-analysis/156132)
**Author:** [@burakkilic](https://discuss.elastic.co/u/burakkilic)\ **Replies:** 0\ **Last updated:** [November 10, 2018, 12:02pm UTC](https://discuss.elastic.co/t/writing-query-for-customer-acquisition-funnel-analysis/156132 "2018-11-10T12:02:47Z")
Hi, We have an event-event based index and we want to do funnel analysis for the users. GETevents/\_search { "size": 0, "aggs": { "funnel": { "filters": { "filters": { "totalInteractions": { "query\_string": { "quer… --- ## [Setting total shard per node](https://discuss.elastic.co/t/setting-total-shard-per-node/156120)
**Author:** [@Rizal\_Trenggono](https://discuss.elastic.co/u/Rizal_Trenggono)\ **Replies:** 11\ **Last updated:** [November 10, 2018, 9:10am UTC](https://discuss.elastic.co/t/setting-total-shard-per-node/156120 "2018-11-10T09:10:13Z")
Hi, i have 30 data node,3 master node and 1 coordinator node, i want to create 1 index with 30k shard (each node gets 1k shard). i try put mapping shard on coordinator node, response from node is error "Failed to parse… --- ## [Max Documents in a Segment](https://discuss.elastic.co/t/max-documents-in-a-segment/156117)
**Author:** [@djtecha](https://discuss.elastic.co/u/djtecha)\ **Replies:** 2\ **Last updated:** [November 10, 2018, 9:02am UTC](https://discuss.elastic.co/t/max-documents-in-a-segment/156117 "2018-11-10T09:02:13Z")
I'm curious if anyone knows lucene enough to explain what the max number of documents or data size should exist in a segment. As in at what point does forcemerging an index have diminishing returns? If I have a 50GB inde… --- ## [Unassigned shards and api call error](https://discuss.elastic.co/t/unassigned-shards-and-api-call-error/156128)
**Author:** [@matthew\_maclean](https://discuss.elastic.co/u/matthew_maclean)\ **Replies:** 1\ **Last updated:** [November 10, 2018, 8:57am UTC](https://discuss.elastic.co/t/unassigned-shards-and-api-call-error/156128 "2018-11-10T08:57:44Z")
Hi there, I'm having some problems with unnasigned shards... I've got a lot of shards but some replicas arent being assigned and not sure why as others are. I tried the explain API but I get: \[root@alpha matt\]# curl h… --- ## [Unable to reset the ELK password](https://discuss.elastic.co/t/unable-to-reset-the-elk-password/155675)
**Author:** [@Ganesh2303](https://discuss.elastic.co/u/Ganesh2303)\ **Replies:** 21\ **Last updated:** [November 10, 2018, 8:17am UTC](https://discuss.elastic.co/t/unable-to-reset-the-elk-password/155675 "2018-11-10T08:17:16Z")
HI, I'm trying to reset my ELK password, but im facing below issue, Please find my step one by one. Enabled "xpack.security.enabled: true" on both kibana and Elasticsearch Using "./setup-passwords auto/interactive" t… --- ## [ES 6.0 snapshot index UUIDs](https://discuss.elastic.co/t/es-6-0-snapshot-index-uuids/156047)
**Author:** [@arunachala](https://discuss.elastic.co/u/arunachala)\ **Replies:** 4\ **Last updated:** [November 10, 2018, 6:51am UTC](https://discuss.elastic.co/t/es-6-0-snapshot-index-uuids/156047 "2018-11-10T06:51:11Z")
Hi All, In ES 2.x, on creation of a snapshot, the directories created in the repository under the 'indices' directory contained the indices names as it is. Given a snapshot name, it was very easy to get all the files (… --- ## [Does search really work in ES?](https://discuss.elastic.co/t/does-search-really-work-in-es/155306)
**Author:** [@Gosforth](https://discuss.elastic.co/u/Gosforth)\ **Replies:** 12\ **Last updated:** [November 9, 2018, 10:23pm UTC](https://discuss.elastic.co/t/does-search-really-work-in-es/155306 "2018-11-09T22:23:02Z")
I test different queries and the results are terrible. I run query: GET /printers/\_search { "query": { "bool": { "must": { "match": { "product\_description": { "query": "LaserJet Pro M275", "minimum\_should\_matc… --- ## [Connection timeout to master for new nodes](https://discuss.elastic.co/t/connection-timeout-to-master-for-new-nodes/156059)
**Author:** [@jazz](https://discuss.elastic.co/u/jazz)\ **Replies:** 10\ **Last updated:** [November 9, 2018, 8:46pm UTC](https://discuss.elastic.co/t/connection-timeout-to-master-for-new-nodes/156059 "2018-11-09T20:46:24Z")
I have a cluster on version 2.4.1, and some nodes cannot connect to the master. The error log is: \[WARN \]\[discovery.zen \] \[...\] failed to connect to master \[...\] retrying... org.elasticsearch.transport.Conne… --- ## [Deleted indice from Kibana console mistakenly](https://discuss.elastic.co/t/deleted-indice-from-kibana-console-mistakenly/156065)
**Author:** [@Shahid\_Chaudhary](https://discuss.elastic.co/u/Shahid_Chaudhary)\ **Replies:** 1\ **Last updated:** [November 9, 2018, 7:50pm UTC](https://discuss.elastic.co/t/deleted-indice-from-kibana-console-mistakenly/156065 "2018-11-09T19:50:07Z")
Hi Team, I have ELK on single server. I deleted the my filebeat-6xxx indice from the kibana console mistaken. Now i am unable to create the index on kibana with name filebeat-\* I am getting the warning message " The … --- ## [Java rest client : how to retry, if network blinking?](https://discuss.elastic.co/t/java-rest-client-how-to-retry-if-network-blinking/156073)
**Author:** [@Nikolay.Bolobanov](https://discuss.elastic.co/u/Nikolay.Bolobanov)\ **Replies:** 0\ **Last updated:** [November 9, 2018, 3:13pm UTC](https://discuss.elastic.co/t/java-rest-client-how-to-retry-if-network-blinking/156073 "2018-11-09T15:13:30Z")
Hi! Low level rest client retry only case 502, 503 or 504 response statuses. I can't change retry logic when in java.net.ConnectException the request was sent to other nodes ? Do I understand correctly ? Could you poi… --- ## [Couldn't find any elasticsearch data -- logstash not show up](https://discuss.elastic.co/t/couldnt-find-any-elasticsearch-data-logstash-not-show-up/156093)
**Author:** [@George\_Smiley](https://discuss.elastic.co/u/George_Smiley)\ **Replies:** 1\ **Last updated:** [November 9, 2018, 7:15pm UTC](https://discuss.elastic.co/t/couldnt-find-any-elasticsearch-data-logstash-not-show-up/156093 "2018-11-09T19:15:04Z")
Hi Everyone, I am new to elk stack. I am trying to configure it base on https://www.itzgeek.com/how-tos/linux/centos-how-tos/updated-install-elasticsearch-logstash-and-kibana-elk-stack-on-centos-7-rhel-7.html this instr… --- ## [Watcher condition script throws an null pointer exception](https://discuss.elastic.co/t/watcher-condition-script-throws-an-null-pointer-exception/156092)
**Author:** [@shiv94](https://discuss.elastic.co/u/shiv94)\ **Replies:** 1\ **Last updated:** [November 9, 2018, 6:35pm UTC](https://discuss.elastic.co/t/watcher-condition-script-throws-an-null-pointer-exception/156092 "2018-11-09T18:35:05Z")
I am trying to access the ctx fields in the condition script "result": { "execution\_time": "2018-11-09T16:42:43.944Z", "execution\_duration": 84, "input": { "type": "search", "status": "success", "payload": { "\_sh… --- ## [How to add Multiple analyzers to a field](https://discuss.elastic.co/t/how-to-add-multiple-analyzers-to-a-field/155938)
**Author:** [@anveshdd](https://discuss.elastic.co/u/anveshdd)\ **Replies:** 2\ **Last updated:** [November 9, 2018, 5:32pm UTC](https://discuss.elastic.co/t/how-to-add-multiple-analyzers-to-a-field/155938 "2018-11-09T17:32:52Z")
I am working on ES 6.4.2, want to apply multiple analyzers to a field. I am looking to apply snowball and stop word. I tried thie below mapping is this the correct apporach. PUT /some-index { "settings": { … --- ## [Master and Coordinating Nodes crashing with "fatal error on the network layer" and Heap OOM](https://discuss.elastic.co/t/master-and-coordinating-nodes-crashing-with-fatal-error-on-the-network-layer-and-heap-oom/155615)
**Author:** [@vijay.sangha](https://discuss.elastic.co/u/vijay.sangha)\ **Replies:** 8\ **Last updated:** [November 9, 2018, 5:22pm UTC](https://discuss.elastic.co/t/master-and-coordinating-nodes-crashing-with-fatal-error-on-the-network-layer-and-heap-oom/155615 "2018-11-09T17:22:46Z")
All was well until the recent reboot of the VM. Nothing changes except the OS patching. Somwhow the network connection between the nodes is dropping but they are not stayinh up for more than 15 minutes. Here is my setup … --- ## [Cluster Docker "not enough master nodes discovered during pinging"](https://discuss.elastic.co/t/cluster-docker-not-enough-master-nodes-discovered-during-pinging/155955)
**Author:** [@mcosta29](https://discuss.elastic.co/u/mcosta29)\ **Replies:** 9\ **Last updated:** [November 9, 2018, 5:21pm UTC](https://discuss.elastic.co/t/cluster-docker-not-enough-master-nodes-discovered-during-pinging/155955 "2018-11-09T17:21:02Z")
I'm trying up 1 cluster of elastic (with 3 nodes) in docker on 3 hosts differents, I up 2 nodes and return the error when i access IP:9200/\_cluster/health?pretty : { "error" : { "root\_cause" : \[ { "type" : "master\_… --- ## [Delete\_by\_query? , gateway timeout](https://discuss.elastic.co/t/delete-by-query-gateway-timeout/155430)
**Author:** [@Roque\_Moyano](https://discuss.elastic.co/u/Roque_Moyano)\ **Replies:** 13\ **Last updated:** [November 9, 2018, 4:23pm UTC](https://discuss.elastic.co/t/delete-by-query-gateway-timeout/155430 "2018-11-09T16:23:55Z")
Hi , I have a problem , I have some huge indexes , and I want to delete some documents but only if they have some value , I have tried it: POST docker-2018.07.05/\_delete\_by\_query?conflicts=proceed&timeout=10m { "query… --- ## [Failed shard after OOMing, corrupt index](https://discuss.elastic.co/t/failed-shard-after-ooming-corrupt-index/155612)
**Author:** [@jtalmi](https://discuss.elastic.co/u/jtalmi)\ **Replies:** 5\ **Last updated:** [November 9, 2018, 3:44pm UTC](https://discuss.elastic.co/t/failed-shard-after-ooming-corrupt-index/155612 "2018-11-09T15:44:15Z")
My server took on too much load and crashed ES. After I retarted, my index showed up as corrupt. The output of the shard allocation explain API is here: curl -XGET localhost:9200/\_cluster/allocation/explain?pretty … --- ## [Curator: possible to exclude nodes by attr?](https://discuss.elastic.co/t/curator-possible-to-exclude-nodes-by-attr/156079)
**Author:** [@Thomas\_Tomski](https://discuss.elastic.co/u/Thomas_Tomski)\ **Replies:** 0\ **Last updated:** [November 9, 2018, 3:42pm UTC](https://discuss.elastic.co/t/curator-possible-to-exclude-nodes-by-attr/156079 "2018-11-09T15:42:52Z")
Hi All! I need to extend our els cluster with 4 nodes on which only old and shrinked data should be stored. This should be done with Curator, indecies older than 8 days should be shrinked, and stored with the prefix "-… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1487) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1489)