# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1508 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1509 --- ## [Sharding Issue](https://discuss.elastic.co/t/sharding-issue/153593)
**Author:** [@abhinav.dwivedi](https://discuss.elastic.co/u/abhinav.dwivedi)\ **Replies:** 12\ **Last updated:** [October 23, 2018, 3:07pm UTC](https://discuss.elastic.co/t/sharding-issue/153593 "2018-10-23T15:07:11Z")
Team We are using the Dockerize ELK cluster and we are using logtrail pugin also in kibana.So we have 2 dashborad one is for discover and one is for logtrail But our shard limit is set as 1250 . So not we are facing is… --- ## [\[Tutorial\] Elasticsearch bucket aggregations and faceted navigation](https://discuss.elastic.co/t/tutorial-elasticsearch-bucket-aggregations-and-faceted-navigation/153625)
**Author:** [@iridakos](https://discuss.elastic.co/u/iridakos)\ **Replies:** 0\ **Last updated:** [October 23, 2018, 2:28pm UTC](https://discuss.elastic.co/t/tutorial-elasticsearch-bucket-aggregations-and-faceted-navigation/153625 "2018-10-23T14:28:28Z")
Hello everybody, I published a tutorial about using Elasticsearch Bucket aggregations for faceted navigation. https://iridakos.com/tutorials/2018/10/22/elasticsearch-bucket-aggregations Thank you --- ## [Multi-value multi-field tag search](https://discuss.elastic.co/t/multi-value-multi-field-tag-search/153627)
**Author:** [@Katja\_Abramova](https://discuss.elastic.co/u/Katja_Abramova)\ **Replies:** 0\ **Last updated:** [October 23, 2018, 2:34pm UTC](https://discuss.elastic.co/t/multi-value-multi-field-tag-search/153627 "2018-10-23T14:34:23Z")
Hi, I've just started with ES and studied master and reference guides but still can't figure out how to solve my particular use case. I have a set of FAQ type of documents with a number of fields that boil down to: { … --- ## [New template creation for shard value setup on elasticsearch](https://discuss.elastic.co/t/new-template-creation-for-shard-value-setup-on-elasticsearch/153611)
**Author:** [@Ganesh2303](https://discuss.elastic.co/u/Ganesh2303)\ **Replies:** 2\ **Last updated:** [October 23, 2018, 2:20pm UTC](https://discuss.elastic.co/t/new-template-creation-for-shard-value-setup-on-elasticsearch/153611 "2018-10-23T14:20:33Z")
HI, I'm trying to create own template to set shard value for my index, when i run shell script which contain template creation command i'm getting below error any one could help me on this, {"error":"Content-Type head… --- ## [Not able to add data node to a elasticsearch cluster](https://discuss.elastic.co/t/not-able-to-add-data-node-to-a-elasticsearch-cluster/153606)
**Author:** [@Loudone](https://discuss.elastic.co/u/Loudone)\ **Replies:** 3\ **Last updated:** [October 23, 2018, 1:32pm UTC](https://discuss.elastic.co/t/not-able-to-add-data-node-to-a-elasticsearch-cluster/153606 "2018-10-23T13:32:54Z")
Dear all, I'm currently trying to make the following elasticsearch cluster: My 3 master nodes are working fine, but my 3 others data nodes are not able to be connected to the masters: error: \[2018-10-23T14:59:41,28… --- ## [Architecture styles, patterns, documentation](https://discuss.elastic.co/t/architecture-styles-patterns-documentation/153303)
**Author:** [@15hawai15](https://discuss.elastic.co/u/15hawai15)\ **Replies:** 4\ **Last updated:** [October 23, 2018, 1:24pm UTC](https://discuss.elastic.co/t/architecture-styles-patterns-documentation/153303 "2018-10-23T13:24:51Z")
Can someone help me, where to find more information and diagrams about elasticsearch architectural styles and patterns ? --- ## [Filter request and score](https://discuss.elastic.co/t/filter-request-and-score/153554)
**Author:** [@HugoP](https://discuss.elastic.co/u/HugoP)\ **Replies:** 3\ **Last updated:** [October 23, 2018, 1:24pm UTC](https://discuss.elastic.co/t/filter-request-and-score/153554 "2018-10-23T13:24:01Z")
Hi all, I was running some test to understand the filter notion in ES: POST /index\_test/1 { "firstname":"John", "lastname": "Doe" } GET /index\_test/\_search { "query":{ "term": { "firstname.keyword… --- ## [ES 6.4.1: Almost empty cluster doesn't perform as expected](https://discuss.elastic.co/t/es-6-4-1-almost-empty-cluster-doesnt-perform-as-expected/150871)
**Author:** [@marten1](https://discuss.elastic.co/u/marten1)\ **Replies:** 7\ **Last updated:** [October 23, 2018, 1:06pm UTC](https://discuss.elastic.co/t/es-6-4-1-almost-empty-cluster-doesnt-perform-as-expected/150871 "2018-10-23T13:06:22Z")
Hi, I've set up a cluster consisting of 3 nodes. Each node has 128 GB RAM of which 30 GB is allocated by ES, so 90 GB in total. Disks are SSD. I have an index of about 5 mil documents, 2 primary shards and 2 replicas… --- ## [3 elasticsearch nodes and 1 kibana instance](https://discuss.elastic.co/t/3-elasticsearch-nodes-and-1-kibana-instance/153600)
**Author:** [@montuewed](https://discuss.elastic.co/u/montuewed)\ **Replies:** 0\ **Last updated:** [October 23, 2018, 12:57pm UTC](https://discuss.elastic.co/t/3-elasticsearch-nodes-and-1-kibana-instance/153600 "2018-10-23T12:57:15Z")
Hello all, I have a setup which includes 3 elasticsearch nodes(acting as master eligible with kibana installed on all 3) amongst other nodes (not important for my question). I would like to know if there is a way for al… --- ## [Unbalanced cluster nodes](https://discuss.elastic.co/t/unbalanced-cluster-nodes/152867)
**Author:** [@elk2](https://discuss.elastic.co/u/elk2)\ **Replies:** 11\ **Last updated:** [October 23, 2018, 12:36pm UTC](https://discuss.elastic.co/t/unbalanced-cluster-nodes/152867 "2018-10-23T12:36:31Z")
From some days I have this situation for my cluster: \[root@elk ~\]# curl -XGET 'localhost:9200/\_cat/nodes?v' host ip heap.percent ram.percent load node.role master name 192.168.0.51 192.168.0.51 … --- ## [Python Search POST request](https://discuss.elastic.co/t/python-search-post-request/153595)
**Author:** [@petrop](https://discuss.elastic.co/u/petrop)\ **Replies:** 0\ **Last updated:** [October 23, 2018, 12:16pm UTC](https://discuss.elastic.co/t/python-search-post-request/153595 "2018-10-23T12:16:46Z")
Hi all, I have been developing a script to query some particular data on Elasticsearch. When I run my query I need to use the scroll function because I receive too many results. Therefore, I pass the scroll\_id to the … --- ## [Searching over Multiple Index](https://discuss.elastic.co/t/searching-over-multiple-index/153264)
**Author:** [@han1](https://discuss.elastic.co/u/han1)\ **Replies:** 4\ **Last updated:** [October 23, 2018, 12:08pm UTC](https://discuss.elastic.co/t/searching-over-multiple-index/153264 "2018-10-23T12:08:41Z")
Hi everyone, Imaging you have 3 indexes: Index US has prices in US Dollars Index EU has prices in Euro Index UK has prices in Pound Sterling Now you want to search all of the indexes for docs that have a price of 1… --- ## [Query with calculated limit](https://discuss.elastic.co/t/query-with-calculated-limit/153514)
**Author:** [@BrikerMan](https://discuss.elastic.co/u/BrikerMan)\ **Replies:** 1\ **Last updated:** [October 23, 2018, 11:43am UTC](https://discuss.elastic.co/t/query-with-calculated-limit/153514 "2018-10-23T11:43:21Z")
I have video model and album model, Like, | video | title | album\_id | | ----- | --------- | -------- | | 1 | apple A 1 | 1 | | 2 | apple A 2 | 1 | | 3 | apple A 3 | 1 | | 4 | ap… --- ## [How do I specify a different analyzer than my index\_analyzer at query time?](https://discuss.elastic.co/t/how-do-i-specify-a-different-analyzer-than-my-index-analyzer-at-query-time/153432)
**Author:** [@qiulang](https://discuss.elastic.co/u/qiulang)\ **Replies:** 2\ **Last updated:** [October 23, 2018, 10:04am UTC](https://discuss.elastic.co/t/how-do-i-specify-a-different-analyzer-than-my-index-analyzer-at-query-time/153432 "2018-10-23T10:04:24Z")
I set multi-analyzers like this curl -X PUT "localhost:9200/sentences" -H 'Content-Type: application/json' -d' { "mappings": { "\_doc": { "properties": { "content": { … --- ## [Windows metric logs not showing](https://discuss.elastic.co/t/windows-metric-logs-not-showing/153580)
**Author:** [@dinesh2](https://discuss.elastic.co/u/dinesh2)\ **Replies:** 1\ **Last updated:** [October 23, 2018, 10:45am UTC](https://discuss.elastic.co/t/windows-metric-logs-not-showing/153580 "2018-10-23T10:45:14Z")
Hi , Metrics windows service dashboard is not showing. --- ## [Larger than the limit](https://discuss.elastic.co/t/larger-than-the-limit/151799)
**Author:** [@HARSHAL\_CHAUDHARI](https://discuss.elastic.co/u/HARSHAL_CHAUDHARI)\ **Replies:** 2\ **Last updated:** [October 23, 2018, 10:11am UTC](https://discuss.elastic.co/t/larger-than-the-limit/151799 "2018-10-23T10:11:59Z")
I am trying to aad 142 MB pdf file in Elasticsearch attachment using ingest. Error details as below FailureReason: BadResponse while attempting PUT on http://127.0.0.1:6379/index-stress-test-10oct2018-r1/document/b6091… --- ## [Failed to publish events: unavailable\_shards\_exception](https://discuss.elastic.co/t/failed-to-publish-events-unavailable-shards-exception/153393)
**Author:** [@elk11](https://discuss.elastic.co/u/elk11)\ **Replies:** 3\ **Last updated:** [October 23, 2018, 10:08am UTC](https://discuss.elastic.co/t/failed-to-publish-events-unavailable-shards-exception/153393 "2018-10-23T10:08:36Z")
Hi, I deployed filebeat on a host and seeing below errors: Filebeat container log: 2018/10/22 11:22:26.464563 logger.go:22: INFO retryer: send wait signal to consumer 2018/10/22 11:22:26.464592 logger.go:22: INFO do… --- ## [I have a log file in which i will search with a specific word which will give me that line but i need to get whole message. (started from "waiting for message" to another "waiting for message")](https://discuss.elastic.co/t/i-have-a-log-file-in-which-i-will-search-with-a-specific-word-which-will-give-me-that-line-but-i-need-to-get-whole-message-started-from-waiting-for-message-to-another-waiting-for-message/153379)
**Author:** [@osamaikhlas](https://discuss.elastic.co/u/osamaikhlas)\ **Replies:** 6\ **Last updated:** [October 23, 2018, 9:15am UTC](https://discuss.elastic.co/t/i-have-a-log-file-in-which-i-will-search-with-a-specific-word-which-will-give-me-that-line-but-i-need-to-get-whole-message-started-from-waiting-for-message-to-another-waiting-for-message/153379 "2018-10-23T09:15:32Z")
18/07/04 00:00:00 | main Waiting For A Message... 18/07/04 00:00:00 | main G\_GetMsg XLI-38159714: Message Length Received \[230\] 18/07/04 00:00:00 | main XLI-38159714: MessageSource \[0028\] 18/07/04 00:00:00 | main com… --- ## [ES.6 Node can't join master (Docker)](https://discuss.elastic.co/t/es-6-node-cant-join-master-docker/153430)
**Author:** [@cy\_lir](https://discuss.elastic.co/u/cy_lir)\ **Replies:** 1\ **Last updated:** [October 23, 2018, 8:44am UTC](https://discuss.elastic.co/t/es-6-node-cant-join-master-docker/153430 "2018-10-23T08:44:30Z")
Hi ! At first, here's my following architecture : 1 Docker swarm cluster running 2 Elasticsearch 6.4.2 nodes without troubles. They're called isbg01 and isbg02. IP : 10.11.0.10 1 Docker no-swarm in the same datacentre… --- ## [Performance issues in large bool filter query](https://discuss.elastic.co/t/performance-issues-in-large-bool-filter-query/153473)
**Author:** [@luise](https://discuss.elastic.co/u/luise)\ **Replies:** 1\ **Last updated:** [October 23, 2018, 8:29am UTC](https://discuss.elastic.co/t/performance-issues-in-large-bool-filter-query/153473 "2018-10-23T08:29:47Z")
I am trying to obtain a list of up to two million results through the following scrolled query, of each hit I only need a couple of fields: GET alerts-\*/\_search { "query": { "bool": { "filter": \[ { … --- ## [Licensing](https://discuss.elastic.co/t/licensing/153446)
**Author:** [@muthualagappan](https://discuss.elastic.co/u/muthualagappan)\ **Replies:** 3\ **Last updated:** [October 23, 2018, 8:22am UTC](https://discuss.elastic.co/t/licensing/153446 "2018-10-23T08:22:33Z")
Can I include the desktop version of elastic search in my desktop ( Linux / MAC / Windows) version of the product? Is there any licensing restriction of using elastic search (desktop version) in any kind of commercial / … --- ## [Improving performance of string id filtering and aggregation](https://discuss.elastic.co/t/improving-performance-of-string-id-filtering-and-aggregation/153237)
**Author:** [@Hen\_Gueta](https://discuss.elastic.co/u/Hen_Gueta)\ **Replies:** 4\ **Last updated:** [October 23, 2018, 8:17am UTC](https://discuss.elastic.co/t/improving-performance-of-string-id-filtering-and-aggregation/153237 "2018-10-23T08:17:29Z")
With the query i get a result of 900ms - 1200ms, this is not good enough. i want to improve it and i feel i got stuck. my SPEC: 3 nodes 8 ram (each node) 4 cpu (each node) - 2.90GHz, capacity: 4230MHz, width: 64 bit… --- ## [Not able to get log files daily for elasticsearch](https://discuss.elastic.co/t/not-able-to-get-log-files-daily-for-elasticsearch/153542)
**Author:** [@dharmesh](https://discuss.elastic.co/u/dharmesh)\ **Replies:** 0\ **Last updated:** [October 23, 2018, 8:16am UTC](https://discuss.elastic.co/t/not-able-to-get-log-files-daily-for-elasticsearch/153542 "2018-10-23T08:16:59Z")
OS: Centos ELaticsearch Version: 2.2.2 Content of logging.yml file: type: dailyRollingFile file: ${path.logs}/${cluster.name}.log datePattern: "'.'yyyy-MM-dd" layout: type: pattern conversionPattern: "\[%d{ISO860… --- ## [WinLogBeat usage](https://discuss.elastic.co/t/winlogbeat-usage/153539)
**Author:** [@roopeshetty](https://discuss.elastic.co/u/roopeshetty)\ **Replies:** 0\ **Last updated:** [October 23, 2018, 7:55am UTC](https://discuss.elastic.co/t/winlogbeat-usage/153539 "2018-10-23T07:55:07Z")
Hi , We are running a powershell script to monitor the expiry dates of around 200 certificates which will write the script output on the Appication event logs of one of our windows servers as below; Certificate=SERVER0… --- ## [ELK setup](https://discuss.elastic.co/t/elk-setup/152806)
**Author:** [@roopeshetty](https://discuss.elastic.co/u/roopeshetty)\ **Replies:** 2\ **Last updated:** [October 23, 2018, 7:51am UTC](https://discuss.elastic.co/t/elk-setup/152806 "2018-10-23T07:51:17Z")
Hi guys.. We have installed the ELK stack on one of our windows servers as per the instruction from https://ulyaoth.com/tutorials/how-to-install-elastic-stack-5-4-on-windows-server-2016/ and its successful and we can op… --- ## [ElasticSearch Watcher Painless script : illegal\_argument\_exception, reson: Extraneous for loop](https://discuss.elastic.co/t/elasticsearch-watcher-painless-script-illegal-argument-exception-reson-extraneous-for-loop/153508)
**Author:** [@tianshu\_Peng](https://discuss.elastic.co/u/tianshu_Peng)\ **Replies:** 1\ **Last updated:** [October 23, 2018, 7:49am UTC](https://discuss.elastic.co/t/elasticsearch-watcher-painless-script-illegal-argument-exception-reson-extraneous-for-loop/153508 "2018-10-23T07:49:48Z")
I'm running a applicaiton and I want to alert on apiName with different threshold here is my query result: { "took": 120, "timed\_out": false, "\_shards": { "total": 139, "successful": 139, "skipped": 1… --- ## [ECS and normalizing queries across indexes](https://discuss.elastic.co/t/ecs-and-normalizing-queries-across-indexes/153536)
**Author:** [@dss](https://discuss.elastic.co/u/dss)\ **Replies:** 0\ **Last updated:** [October 23, 2018, 7:43am UTC](https://discuss.elastic.co/t/ecs-and-normalizing-queries-across-indexes/153536 "2018-10-23T07:43:05Z")
Elasticsearch 6.3.2 Elastic Common Schema notes: A common schema helps you correlate data from sources like logs and metrics or IT operations analytics and security analytics. Assuming a case where a common schema i… --- ## [Step by step process of implementing security in ELK and XPack](https://discuss.elastic.co/t/step-by-step-process-of-implementing-security-in-elk-and-xpack/153534)
**Author:** [@Rifat\_Erdem\_Sahin](https://discuss.elastic.co/u/Rifat_Erdem_Sahin)\ **Replies:** 1\ **Last updated:** [October 23, 2018, 7:40am UTC](https://discuss.elastic.co/t/step-by-step-process-of-implementing-security-in-elk-and-xpack/153534 "2018-10-23T07:40:48Z")
Looking for a guide and a check list. Appreciate the references --- ## [How to stop score calculating?](https://discuss.elastic.co/t/how-to-stop-score-calculating/152398)
**Author:** [@hym](https://discuss.elastic.co/u/hym)\ **Replies:** 2\ **Last updated:** [October 23, 2018, 7:27am UTC](https://discuss.elastic.co/t/how-to-stop-score-calculating/152398 "2018-10-23T07:27:21Z")
I have a couple of questions in my mind regarding query tuning in Elastic search Sometimes score for result hits are null, though the query written in Query Context , why? Is there any configuration in Elastic search t… --- ## [How to define the query time range of advanced watches?](https://discuss.elastic.co/t/how-to-define-the-query-time-range-of-advanced-watches/153397)
**Author:** [@wujiaxin159](https://discuss.elastic.co/u/wujiaxin159)\ **Replies:** 2\ **Last updated:** [October 23, 2018, 7:22am UTC](https://discuss.elastic.co/t/how-to-define-the-query-time-range-of-advanced-watches/153397 "2018-10-23T07:22:51Z")
Elastic version: 6.3.0 How to define the query time range of advanced watches? For example, the last 5 minutes. { "trigger": { "schedule": { "interval": "15s" } }, "input": { "search": { … [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1507) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1509)