# Elasticsearch

**URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1494

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 1495

---

## [How many nodes can ES handle?](https://discuss.elastic.co/t/how-many-nodes-can-es-handle/155333)

<div class="topic-metadata">

**Author:** [@klahnakoski](https://discuss.elastic.co/u/klahnakoski)\
**Replies:** 3\
**Last updated:** [November 5, 2018, 8:23pm UTC](https://discuss.elastic.co/t/how-many-nodes-can-es-handle/155333 "2018-11-05T20:23:42Z")

</div>

I have a few machines that provide web services, and they use ES as a backend. Specifically, I install a node on the service machine (node.master: false, node.data: false, node.ingest: true) so I need not worry about w…

---

## [How to start with fscrawler?](https://discuss.elastic.co/t/how-to-start-with-fscrawler/154293)

<div class="topic-metadata">

**Author:** [@Technical\_Stuffer\_S](https://discuss.elastic.co/u/Technical_Stuffer_S)\
**Replies:** 12\
**Last updated:** [November 5, 2018, 6:08pm UTC](https://discuss.elastic.co/t/how-to-start-with-fscrawler/154293 "2018-11-05T18:08:10Z")

</div>

actually i have installed fscrawler 2.5 zipped file and after unzipping it ,when i opened the (.bat) file it could not opened and from there i am unable to understand whats going wron.....

---

## [Pipelines - Losing values with Foreach and Grok](https://discuss.elastic.co/t/pipelines-losing-values-with-foreach-and-grok/155234)

<div class="topic-metadata">

**Author:** [@Josiah\_Raiche](https://discuss.elastic.co/u/Josiah_Raiche)\
**Replies:** 1\
**Last updated:** [November 5, 2018, 5:36pm UTC](https://discuss.elastic.co/t/pipelines-losing-values-with-foreach-and-grok/155234 "2018-11-05T17:36:39Z")

</div>

Similar to this unanswered question: Ingest: foreach + grok processor - how to write result into an array? I'm trying to parse a multiline document. Each line is a step in trace route and I'd like to process each line i…

---

## [Elasticsearch Nested Queries](https://discuss.elastic.co/t/elasticsearch-nested-queries/155274)

<div class="topic-metadata">

**Author:** [@arosner](https://discuss.elastic.co/u/arosner)\
**Replies:** 1\
**Last updated:** [November 5, 2018, 4:49pm UTC](https://discuss.elastic.co/t/elasticsearch-nested-queries/155274 "2018-11-05T16:49:22Z")

</div>

Complete newbie here. I have some documents stored in ES, where each document looks like: { "\_index": "index1", "\_type": "type1", "\_id": "1\_1", "\_score": 2, "\_source": { "agencyid": 1, …

---

## [Automation administration tasks, how to](https://discuss.elastic.co/t/automation-administration-tasks-how-to/155427)

<div class="topic-metadata">

**Author:** [@jacobot](https://discuss.elastic.co/u/jacobot)\
**Replies:** 2\
**Last updated:** [November 5, 2018, 4:30pm UTC](https://discuss.elastic.co/t/automation-administration-tasks-how-to/155427 "2018-11-05T16:30:40Z")

</div>

I have read about the "curotor" I see it is a python applicartion to do adminstration task would it be possible to do these task in automated way, as far as i can see there is no scheduler in the "curator" and ppl use c…

---

## [Index size growth](https://discuss.elastic.co/t/index-size-growth/155212)

<div class="topic-metadata">

**Author:** [@fionamacd](https://discuss.elastic.co/u/fionamacd)\
**Replies:** 2\
**Last updated:** [November 5, 2018, 4:14pm UTC](https://discuss.elastic.co/t/index-size-growth/155212 "2018-11-05T16:14:28Z")

</div>

I am trying to figure out how best to plan for disk space/EBS volume size for AWS ES. When I get the weekly index details back like this: |green|open|filebeat-test-2018.42|hpJXziswRh-iGY1FOZnqNw|5|1|1309774|0|2.3gb|1.…

---

## [Missing Authentication for REST request](https://discuss.elastic.co/t/missing-authentication-for-rest-request/154807)

<div class="topic-metadata">

**Author:** [@Calvin-J-Scott](https://discuss.elastic.co/u/Calvin-J-Scott)\
**Replies:** 23\
**Last updated:** [November 5, 2018, 3:58pm UTC](https://discuss.elastic.co/t/missing-authentication-for-rest-request/154807 "2018-11-05T15:58:47Z")

</div>

Hi Everyone, So am currently using a basic version of ES and just activated Xpack to start using security on my requests but am now receiving ElasticSearch exception \[type= security\_exception, reason missing authenticat…

---

## [Is a way : to take on acount missing value buckets with Rollup search](https://discuss.elastic.co/t/is-a-way-to-take-on-acount-missing-value-buckets-with-rollup-search/152772)

<div class="topic-metadata">

**Author:** [@Rollup\_eval](https://discuss.elastic.co/u/Rollup_eval)\
**Replies:** 2\
**Last updated:** [November 5, 2018, 3:38pm UTC](https://discuss.elastic.co/t/is-a-way-to-take-on-acount-missing-value-buckets-with-rollup-search/152772 "2018-11-05T15:38:54Z")

</div>

Hi, I am using the Rollup plugin 6.3.2 with es. In my "source index", some field values may be null or missing. Using elasticsearch request : on the "rollup index" there is no problem using "missing": "missing" in t…

---

## [Aggregations Percentiles ES 6.2.4 VS ES 6.3.2](https://discuss.elastic.co/t/aggregations-percentiles-es-6-2-4-vs-es-6-3-2/155134)

<div class="topic-metadata">

**Author:** [@p365labs](https://discuss.elastic.co/u/p365labs)\
**Replies:** 1\
**Last updated:** [November 5, 2018, 3:24pm UTC](https://discuss.elastic.co/t/aggregations-percentiles-es-6-2-4-vs-es-6-3-2/155134 "2018-11-05T15:24:02Z")

</div>

Hi I have a problems with Percentiles aggregations or better I would like to understand a different behaviour between two different minor versions of Elasticsearch : Problems : find percentiles of this series (10 elemen…

---

## [Exceptions from Elastic search during heavy publishing from logstash](https://discuss.elastic.co/t/exceptions-from-elastic-search-during-heavy-publishing-from-logstash/155272)

<div class="topic-metadata">

**Author:** [@Maddy\_M](https://discuss.elastic.co/u/Maddy_M)\
**Replies:** 4\
**Last updated:** [November 5, 2018, 1:39pm UTC](https://discuss.elastic.co/t/exceptions-from-elastic-search-during-heavy-publishing-from-logstash/155272 "2018-11-05T13:39:24Z")

</div>

Hi, I am running Elastic cluster with 3 nodes( with 3 masters \[ 2 data only nodes\] ) The version is 6.4. Each instance of ES is running with 8GB as Heap. I see following exceptions in ES and Logstash Exceptions from E…

---

## [Curator 5.5.4 Environment variable HowTo?](https://discuss.elastic.co/t/curator-5-5-4-environment-variable-howto/154286)

<div class="topic-metadata">

**Author:** [@arberg](https://discuss.elastic.co/u/arberg)\
**Replies:** 2\
**Last updated:** [November 5, 2018, 2:51pm UTC](https://discuss.elastic.co/t/curator-5-5-4-environment-variable-howto/154286 "2018-11-05T14:51:06Z")

</div>

I'm trying to reindex with environment variable. I have many indexes like service1- and service2- and want to reindex into monthly index, without having 10 near-identical actions. I understood that i need to have entire…

---

## [\[SOLVED\] All elasticsearch repos down](https://discuss.elastic.co/t/solved-all-elasticsearch-repos-down/155198)

<div class="topic-metadata">

**Author:** [@zeldor](https://discuss.elastic.co/u/zeldor)\
**Replies:** 0\
**Last updated:** [November 2, 2018, 3:55pm UTC](https://discuss.elastic.co/t/solved-all-elasticsearch-repos-down/155198 "2018-11-02T15:55:52Z")

</div>

Hey comunity, we have just noticed, that all elasticsearch repositories are down: https://artifacts.elastic.co/packages/5.x/yum https://artifacts.elastic.co/packages/6.x/yum In the repo-documentation, are still the s…

---

## [DETETE snapshot using DATE MATH](https://discuss.elastic.co/t/detete-snapshot-using-date-math/155406)

<div class="topic-metadata">

**Author:** [@hzarrabi](https://discuss.elastic.co/u/hzarrabi)\
**Replies:** 1\
**Last updated:** [November 5, 2018, 2:01pm UTC](https://discuss.elastic.co/t/detete-snapshot-using-date-math/155406 "2018-11-05T14:01:13Z")

</div>

Hello, I'm trying to DELETE snapshots using DATE MATH. After creating daily snapshot by using DATE MATH descriptors PUT /\_snapshot/ES\_Backup/%3Csnapshot-%7Bnow%2Fd%7D%3E I would like to delete those older then 7 day…

---

## ["illegal\_state\_exception" occurs top\_hits aggregator is used](https://discuss.elastic.co/t/illegal-state-exception-occurs-top-hits-aggregator-is-used/155267)

<div class="topic-metadata">

**Author:** [@3ms1](https://discuss.elastic.co/u/3ms1)\
**Replies:** 2\
**Last updated:** [November 5, 2018, 1:59pm UTC](https://discuss.elastic.co/t/illegal-state-exception-occurs-top-hits-aggregator-is-used/155267 "2018-11-05T13:59:11Z")

</div>

Hi, I am having a trouble to find out the actual problem why "illegal\_state\_exception" occurs when top\_hits is used in Elasticsearch 6.4.2 even though same query and aggregations work in the same version but on another m…

---

## [Date Range queries not working with must\_not in nested context](https://discuss.elastic.co/t/date-range-queries-not-working-with-must-not-in-nested-context/154231)

<div class="topic-metadata">

**Author:** [@titani0us](https://discuss.elastic.co/u/titani0us)\
**Replies:** 4\
**Last updated:** [November 5, 2018, 1:58pm UTC](https://discuss.elastic.co/t/date-range-queries-not-working-with-must-not-in-nested-context/154231 "2018-11-05T13:58:38Z")

</div>

Hello, Running a must\_not bool query on a nested object with dates returns values within the range even though the must\_not operator was used. Here is the example query: { "query" : { "bool" : { "must" : { "matc…

---

## [Get all results at once in Elasticsearch SQL syntax](https://discuss.elastic.co/t/get-all-results-at-once-in-elasticsearch-sql-syntax/153935)

<div class="topic-metadata">

**Author:** [@legendu](https://discuss.elastic.co/u/legendu)\
**Replies:** 11\
**Last updated:** [November 5, 2018, 1:56pm UTC](https://discuss.elastic.co/t/get-all-results-at-once-in-elasticsearch-sql-syntax/153935 "2018-11-05T13:56:14Z")

</div>

I have a simple SQL query in Elasticsearch which I know returns less than 100 rows of results. How can I get all these results at once (i.e., without using scroll)? I tried the limit n clause but it works when n is less …

---

## [Disk usage: tags vs fields](https://discuss.elastic.co/t/disk-usage-tags-vs-fields/154531)

<div class="topic-metadata">

**Author:** [@YvorL](https://discuss.elastic.co/u/YvorL)\
**Replies:** 3\
**Last updated:** [November 5, 2018, 1:48pm UTC](https://discuss.elastic.co/t/disk-usage-tags-vs-fields/154531 "2018-11-05T13:48:09Z")

</div>

Hi! Is there a significant disk usage difference between keeping some data in an array or in an individual field? The data won't be frequently queried but sometimes may act as a filter. So I'm not concerned about search…

---

## [2.x cluster upgraded to 5.x won't start - "failed to read local state, exiting..." on all nodes](https://discuss.elastic.co/t/2-x-cluster-upgraded-to-5-x-wont-start-failed-to-read-local-state-exiting-on-all-nodes/154865)

<div class="topic-metadata">

**Author:** [@vidarno](https://discuss.elastic.co/u/vidarno)\
**Replies:** 1\
**Last updated:** [November 5, 2018, 1:41pm UTC](https://discuss.elastic.co/t/2-x-cluster-upgraded-to-5-x-wont-start-failed-to-read-local-state-exiting-on-all-nodes/154865 "2018-11-05T13:41:44Z")

</div>

Upgraded a 4-node Elasticsearch 2.x cluster to 5.6.12 - after rebooting all the nodes I get the following similar log-entries on all nodes; \[2018-10-31T14:59:39,530\]\[WARN \]\[o.e.c.l.LogConfigurator \] ignoring unsupport…

---

## [ElasticSearch creates an empty plugins folder, why?](https://discuss.elastic.co/t/elasticsearch-creates-an-empty-plugins-folder-why/154253)

<div class="topic-metadata">

**Author:** [@shabtaisharon](https://discuss.elastic.co/u/shabtaisharon)\
**Replies:** 1\
**Last updated:** [November 5, 2018, 1:31pm UTC](https://discuss.elastic.co/t/elasticsearch-creates-an-empty-plugins-folder-why/154253 "2018-11-05T13:31:21Z")

</div>

Hi, I'm using elastic search 6.4.2 and i notised that when i run it without any plugins configuted elastic still creates an empty plugins folder and wonders why? and if that is something that can be removed? Thanks, S…

---

## [How do i cancel an ongoing reindex operation?](https://discuss.elastic.co/t/how-do-i-cancel-an-ongoing-reindex-operation/155383)

<div class="topic-metadata">

**Author:** [@jacobot](https://discuss.elastic.co/u/jacobot)\
**Replies:** 6\
**Last updated:** [November 5, 2018, 12:11pm UTC](https://discuss.elastic.co/t/how-do-i-cancel-an-ongoing-reindex-operation/155383 "2018-11-05T12:11:37Z")

</div>

How do i cancel an ongoing re-index operation? I am reindexing it seems 118million documents (at 5000 doc/sec) this would take 6 hours in hindsight How can i cancel this operation? Cheers Jacob

---

## [Search & Scroll using python](https://discuss.elastic.co/t/search-scroll-using-python/154841)

<div class="topic-metadata">

**Author:** [@Moshe\_Hayun](https://discuss.elastic.co/u/Moshe_Hayun)\
**Replies:** 1\
**Last updated:** [November 5, 2018, 12:05pm UTC](https://discuss.elastic.co/t/search-scroll-using-python/154841 "2018-11-05T12:05:00Z")

</div>

Hi, I have an issue where I am trying to use the search & scroll mechanism to query large amount of information. https://elasticsearch-py.readthedocs.io/en/master/api.html#elasticsearch.Elasticsearch.search From time …

---

## [Search request not returning documents anymore](https://discuss.elastic.co/t/search-request-not-returning-documents-anymore/155138)

<div class="topic-metadata">

**Author:** [@Eric\_DUAULT](https://discuss.elastic.co/u/Eric_DUAULT)\
**Replies:** 5\
**Last updated:** [November 5, 2018, 11:49am UTC](https://discuss.elastic.co/t/search-request-not-returning-documents-anymore/155138 "2018-11-05T11:49:24Z")

</div>

I'm not able any more to find some documents in the indices. There are some documents having this field and value : "source" : "spectre\_supEvt". But a query in ElasticSearch filtering on the field and value return noth…

---

## [Connecting ElasticSearch with Intellij](https://discuss.elastic.co/t/connecting-elasticsearch-with-intellij/155038)

<div class="topic-metadata">

**Author:** [@eri](https://discuss.elastic.co/u/eri)\
**Replies:** 2\
**Last updated:** [November 5, 2018, 11:32am UTC](https://discuss.elastic.co/t/connecting-elasticsearch-with-intellij/155038 "2018-11-05T11:32:58Z")

</div>

Hello everyone! I am new to ElasticSearch so I have a 'beginner question'... I have created an index and populated it with data. So I am using ElasticSearch only to store data. Now I need to somehow make a connection w…

---

## [Backup on Windows share](https://discuss.elastic.co/t/backup-on-windows-share/155386)

<div class="topic-metadata">

**Author:** [@Jack37](https://discuss.elastic.co/u/Jack37)\
**Replies:** 0\
**Last updated:** [November 5, 2018, 11:06am UTC](https://discuss.elastic.co/t/backup-on-windows-share/155386 "2018-11-05T11:06:17Z")

</div>

Hi guys, I need to backup my elasticsearch indices on a shared folder on Windows My Elastic istance is a single node that run on a Ubuntu Server machine. I've created the share on Windows with "Everyone Full Control" p…

---

## [Technical details about ElasticSearch and Kibana](https://discuss.elastic.co/t/technical-details-about-elasticsearch-and-kibana/155254)

<div class="topic-metadata">

**Author:** [@Dragos\_Moruz](https://discuss.elastic.co/u/Dragos_Moruz)\
**Replies:** 2\
**Last updated:** [November 5, 2018, 11:02am UTC](https://discuss.elastic.co/t/technical-details-about-elasticsearch-and-kibana/155254 "2018-11-05T11:02:45Z")

</div>

Hi everyone my name is Dragos, our team is developing novel wearable technology and will soon introduce a product to the HSE market to help monitor hazardous exposure in the working environment. We would like to move ou…

---

## [Basic question about closed indices](https://discuss.elastic.co/t/basic-question-about-closed-indices/155372)

<div class="topic-metadata">

**Author:** [@Juanma\_Nieto](https://discuss.elastic.co/u/Juanma_Nieto)\
**Replies:** 2\
**Last updated:** [November 5, 2018, 10:07am UTC](https://discuss.elastic.co/t/basic-question-about-closed-indices/155372 "2018-11-05T10:07:35Z")

</div>

Hello I have a simple question about index replication when an index is closed, I have notice that after close an index when I reopen it after some time (ex: some weeks), the index start to relocate the replicas. So I …

---

## [Low performance on bulk insert with custom mapping](https://discuss.elastic.co/t/low-performance-on-bulk-insert-with-custom-mapping/154899)

<div class="topic-metadata">

**Author:** [@0011001011](https://discuss.elastic.co/u/0011001011)\
**Replies:** 8\
**Last updated:** [November 5, 2018, 9:28am UTC](https://discuss.elastic.co/t/low-performance-on-bulk-insert-with-custom-mapping/154899 "2018-11-05T09:28:52Z")

</div>

Hi all, I encountered a strange problem with ES 6.2.4. I try to bulk insert data into my ES nodes, which run fine, but which is also slow (~10s per 1000 insert). I run it on 4go of RAM, the CPU is used at ~24%, with 3 …

---

## [Alphanumeric sort on child field](https://discuss.elastic.co/t/alphanumeric-sort-on-child-field/155356)

<div class="topic-metadata">

**Author:** [@andyhoang](https://discuss.elastic.co/u/andyhoang)\
**Replies:** 0\
**Last updated:** [November 5, 2018, 8:04am UTC](https://discuss.elastic.co/t/alphanumeric-sort-on-child-field/155356 "2018-11-05T08:04:46Z")

</div>

Hi guys, I'm using es5. I currently have a child-parent relations ship in same indice: prod parent { "prod": { "mappings": { "Parcel": { "properties": { "imported\_date": { "ty…

---

## [Query to show gaps between multiple date ranges](https://discuss.elastic.co/t/query-to-show-gaps-between-multiple-date-ranges/155352)

<div class="topic-metadata">

**Author:** [@tony-dillon](https://discuss.elastic.co/u/tony-dillon)\
**Replies:** 0\
**Last updated:** [November 5, 2018, 7:42am UTC](https://discuss.elastic.co/t/query-to-show-gaps-between-multiple-date-ranges/155352 "2018-11-05T07:42:33Z")

</div>

We have a nested field which is used to store date ranges that represent the occupancy of rooms. Is there any way to formulate a query which can identify gaps in room occupancy? The concrete example is that we would li…

---

## [elasticsearch-DSL aggregation of part of query result. like select \* from (select \* from table limit 100)](https://discuss.elastic.co/t/elasticsearch-dsl-aggregation-of-part-of-query-result-like-select-from-select-from-table-limit-100/155351)

<div class="topic-metadata">

**Author:** [@jacksonxie](https://discuss.elastic.co/u/jacksonxie)\
**Replies:** 0\
**Last updated:** [November 5, 2018, 7:35am UTC](https://discuss.elastic.co/t/elasticsearch-dsl-aggregation-of-part-of-query-result-like-select-from-select-from-table-limit-100/155351 "2018-11-05T07:35:00Z")

</div>

Hi, ES version: 5.5.2 System: win7 problem: For SQL: if I want to statistic part of the query result. I can use the SQL with two "select" like: select count(distinct col\_name) from (select \* from table limit 100) A …

[Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1493)

[Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1495)
