# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1510 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1511 --- ## [Watcher - webhook](https://discuss.elastic.co/t/watcher-webhook/153353)
**Author:** [@Kathir\_J](https://discuss.elastic.co/u/Kathir_J)\ **Replies:** 1\ **Last updated:** [October 22, 2018, 9:06am UTC](https://discuss.elastic.co/t/watcher-webhook/153353 "2018-10-22T09:06:21Z")
My watcher is not working when I simulate. Is there anything wrong here? I want to trigger restart from watcher using webhook. Here is my watcher config. { "trigger": { "schedule": { "interval": "30m" } }, "inpu… --- ## [Stats aggregation on a parent field within a children aggregation](https://discuss.elastic.co/t/stats-aggregation-on-a-parent-field-within-a-children-aggregation/150021)
**Author:** [@voharunado](https://discuss.elastic.co/u/voharunado)\ **Replies:** 1\ **Last updated:** [October 22, 2018, 9:05am UTC](https://discuss.elastic.co/t/stats-aggregation-on-a-parent-field-within-a-children-aggregation/150021 "2018-10-22T09:05:20Z")
Hi, I am using a Parent-Child structure and I need to aggregate some data from one to another. I need to use a Date Histogram aggregation first, on a field that's in the child. I've made a query on the parent (with som… --- ## [GET fired stats on watcher ID](https://discuss.elastic.co/t/get-fired-stats-on-watcher-id/153031)
**Author:** [@luksi1](https://discuss.elastic.co/u/luksi1)\ **Replies:** 1\ **Last updated:** [October 22, 2018, 9:02am UTC](https://discuss.elastic.co/t/get-fired-stats-on-watcher-id/153031 "2018-10-22T09:02:21Z")
Hi. I'm looking through the watcher stats API and I'm confused to which metric i'm looking for when trying to map a watcher ID to how many times it's fired. Is this under the current\_watches array of hashes in the watche… --- ## [Elasticsearch cloudazure plugin 2.4 with snapshot issue](https://discuss.elastic.co/t/elasticsearch-cloudazure-plugin-2-4-with-snapshot-issue/153161)
**Author:** [@sunilbisoyi](https://discuss.elastic.co/u/sunilbisoyi)\ **Replies:** 1\ **Last updated:** [October 22, 2018, 9:00am UTC](https://discuss.elastic.co/t/elasticsearch-cloudazure-plugin-2-4-with-snapshot-issue/153161 "2018-10-22T09:00:54Z")
HI , I am trying to take snapshot backup to azure blob storage. updated the storage account and key on yml file. but getting validation error during repo creation due to the end point suffix is different. on cloudazure… --- ## [Storing aggregated data results back into an index in Elasticsearch](https://discuss.elastic.co/t/storing-aggregated-data-results-back-into-an-index-in-elasticsearch/153093)
**Author:** [@dx123](https://discuss.elastic.co/u/dx123)\ **Replies:** 1\ **Last updated:** [October 22, 2018, 8:54am UTC](https://discuss.elastic.co/t/storing-aggregated-data-results-back-into-an-index-in-elasticsearch/153093 "2018-10-22T08:54:48Z")
This topic has been discussed over the years with no actual confirmed solution. The most prominent thread about this topic: https://stackoverflow.com/questions/36505459/insert-aggregation-results-into-an-index?rq=1 state… --- ## [Composite Aggregation - Document count](https://discuss.elastic.co/t/composite-aggregation-document-count/153322)
**Author:** [@kdh6429](https://discuss.elastic.co/u/kdh6429)\ **Replies:** 1\ **Last updated:** [October 22, 2018, 8:50am UTC](https://discuss.elastic.co/t/composite-aggregation-document-count/153322 "2018-10-22T08:50:37Z")
Does elasticsearch guarantee with exact document count in composite aggregation's result, unlike term aggregation? or is it approximate number just like terms aggregation? --- ## [Time range being ignored](https://discuss.elastic.co/t/time-range-being-ignored/153334)
**Author:** [@blueren](https://discuss.elastic.co/u/blueren)\ **Replies:** 2\ **Last updated:** [October 22, 2018, 8:40am UTC](https://discuss.elastic.co/t/time-range-being-ignored/153334 "2018-10-22T08:40:20Z")
I have mimicked how kibana does a query search and have come up with the below query. Basically I'm looking for the lat 6 days of data (including those days where there is no data, since I need to feed it to a graph). Bu… --- ## [Parent/User Relationship using Join type](https://discuss.elastic.co/t/parent-user-relationship-using-join-type/153346)
**Author:** [@ravituvar](https://discuss.elastic.co/u/ravituvar)\ **Replies:** 0\ **Last updated:** [October 22, 2018, 8:35am UTC](https://discuss.elastic.co/t/parent-user-relationship-using-join-type/153346 "2018-10-22T08:35:35Z")
I have list of users and there is one field called parent, some users might not have parents. I want to get the full parent hierarchy, full child hierarchy for given user id. What should by my mapping on that? Here is… --- ## [ElasticSearch installation stopped at indices into cluster\_state](https://discuss.elastic.co/t/elasticsearch-installation-stopped-at-indices-into-cluster-state/153333)
**Author:** [@minn](https://discuss.elastic.co/u/minn)\ **Replies:** 8\ **Last updated:** [October 22, 2018, 8:28am UTC](https://discuss.elastic.co/t/elasticsearch-installation-stopped-at-indices-into-cluster-state/153333 "2018-10-22T08:28:21Z")
I am facing same issue like (https://github.com/elastic/elasticsearch/issues/33075), any suggestion? $ ./elasticsearch \[2018-10-22T07:14:57,429\]\[INFO \]\[o.e.n.Node \] \[\] initializing ... \[2018-10-22T07:14:… --- ## [Stopword filter not working after reindex](https://discuss.elastic.co/t/stopword-filter-not-working-after-reindex/153150)
**Author:** [@newnewb](https://discuss.elastic.co/u/newnewb)\ **Replies:** 2\ **Last updated:** [October 22, 2018, 7:23am UTC](https://discuss.elastic.co/t/stopword-filter-not-working-after-reindex/153150 "2018-10-22T07:23:52Z")
Is there any reason a newly created index, which is exactly the same as the original one, wouldn't be filtering out stopwords? Reindexing locally like this: POST \_reindex { "source": {"index" : "data-live"}, "dest"… --- ## [Get the last , second last Document](https://discuss.elastic.co/t/get-the-last-second-last-document/153330)
**Author:** [@niraj\_pandey](https://discuss.elastic.co/u/niraj_pandey)\ **Replies:** 1\ **Last updated:** [October 22, 2018, 7:19am UTC](https://discuss.elastic.co/t/get-the-last-second-last-document/153330 "2018-10-22T07:19:37Z")
Hi , While using size = 1 we get the last document (@timestamp is in desc order) from ES cluster . Is there any way like the above get the second last , third last document from elastic cluster ? --- ## [Disk Available in Monitoring can be not correct data!](https://discuss.elastic.co/t/disk-available-in-monitoring-can-be-not-correct-data/153327)
**Author:** [@LuckyNemo](https://discuss.elastic.co/u/LuckyNemo)\ **Replies:** 0\ **Last updated:** [October 22, 2018, 6:33am UTC](https://discuss.elastic.co/t/disk-available-in-monitoring-can-be-not-correct-data/153327 "2018-10-22T06:33:44Z")
ES6.0.0 version! Disk available stats is not real data in my cluster.(acturally I have 4 es instance on each physical machine) In my eyes, the value of "Disk Available" \*4( exactly equal my real value) PS,Disk Usage… --- ## [Reindex Java API in 5.6.3](https://discuss.elastic.co/t/reindex-java-api-in-5-6-3/152763)
**Author:** [@RAM\_NATHAN](https://discuss.elastic.co/u/RAM_NATHAN)\ **Replies:** 5\ **Last updated:** [October 22, 2018, 6:07am UTC](https://discuss.elastic.co/t/reindex-java-api-in-5-6-3/152763 "2018-10-22T06:07:27Z")
Currently I'm using 1.x elastic search. I want to migrate the data to 5.6.3 directly. I saw reindex from remote is an option. But is there any java api to do reindex from remote in 5.6.3? or via curl is only way?? I'm un… --- ## [Update where condition in elasticsearch](https://discuss.elastic.co/t/update-where-condition-in-elasticsearch/151646)
**Author:** [@amit.patra](https://discuss.elastic.co/u/amit.patra)\ **Replies:** 4\ **Last updated:** [October 22, 2018, 5:04am UTC](https://discuss.elastic.co/t/update-where-condition-in-elasticsearch/151646 "2018-10-22T05:04:04Z")
Hi, We have thousand of records like below json. { "\_index": "commusat.mms\_cri", "\_type": "doc", "\_id": "pcolWGYBbjbfpczOv192", "\_version": 1, "\_score": null, "\_source": { "id": "236e66510e049b70", "case\_name"… --- ## [Sorting Followed by Aggregation](https://discuss.elastic.co/t/sorting-followed-by-aggregation/152937)
**Author:** [@vnitdeepak](https://discuss.elastic.co/u/vnitdeepak)\ **Replies:** 2\ **Last updated:** [October 22, 2018, 4:58am UTC](https://discuss.elastic.co/t/sorting-followed-by-aggregation/152937 "2018-10-22T04:58:59Z")
I want ten distinct values from category field but I don't want random distinct values. The ten distinct values must be latest (uploadedDate field sort desc). --- ## [Dash boards are giving errors](https://discuss.elastic.co/t/dash-boards-are-giving-errors/153313)
**Author:** [@ELK123](https://discuss.elastic.co/u/ELK123)\ **Replies:** 0\ **Last updated:** [October 22, 2018, 1:27am UTC](https://discuss.elastic.co/t/dash-boards-are-giving-errors/153313 "2018-10-22T01:27:34Z")
Could not locate that index-pattern-field (id: apache2.access.response\_code). I'm running 6.4 elk stack. I'm trying to get Dash boards for apache logs. so please assist here. I have logstash, elasticsearch ,kibana runn… --- ## [Ingest-attachment ingest local docs](https://discuss.elastic.co/t/ingest-attachment-ingest-local-docs/153215)
**Author:** [@alina.frey](https://discuss.elastic.co/u/alina.frey)\ **Replies:** 3\ **Last updated:** [October 21, 2018, 6:36pm UTC](https://discuss.elastic.co/t/ingest-attachment-ingest-local-docs/153215 "2018-10-21T18:36:00Z")
I am using ingets-attachment plugin of elasticsearch to parse documents, with the intention of doing a search for a word and retrieve the documents that contain that word. I created a pipeline: PUT: http://localhost:92… --- ## [Minimum master nodes in ES cluster](https://discuss.elastic.co/t/minimum-master-nodes-in-es-cluster/153283)
**Author:** [@Rupesh\_Ranjan](https://discuss.elastic.co/u/Rupesh_Ranjan)\ **Replies:** 8\ **Last updated:** [October 21, 2018, 1:48pm UTC](https://discuss.elastic.co/t/minimum-master-nodes-in-es-cluster/153283 "2018-10-21T13:48:13Z")
I have a ES cluster with nodes across data-centres with 1 coordinator node and 3 master+data nodes in each DC. I have 2 questions here: Is it any harm in using nodes which are acting as both master and data? For minim… --- ## [Exists query on numeric attributes with null\_value gives unexpected result](https://discuss.elastic.co/t/exists-query-on-numeric-attributes-with-null-value-gives-unexpected-result/153279)
**Author:** [@azulay7](https://discuss.elastic.co/u/azulay7)\ **Replies:** 0\ **Last updated:** [October 21, 2018, 10:15am UTC](https://discuss.elastic.co/t/exists-query-on-numeric-attributes-with-null-value-gives-unexpected-result/153279 "2018-10-21T10:15:40Z")
Hi all, I'm working with elastic 6.2.4. my index-mapping contains "null\_value". I've notice that exists query gives different result when working with numeric value. example: PUT person { "mappings": { "\_doc": { "pr… --- ## [Elasticsearch mutli-master setup](https://discuss.elastic.co/t/elasticsearch-mutli-master-setup/153223)
**Author:** [@rmadoori](https://discuss.elastic.co/u/rmadoori)\ **Replies:** 3\ **Last updated:** [October 21, 2018, 9:55am UTC](https://discuss.elastic.co/t/elasticsearch-mutli-master-setup/153223 "2018-10-21T09:55:57Z")
Hi, we have 1 coordinating-node 1 master-node 5 data-nodes and 1 kibana. we are planning to scale it up to 2 coordinating-nodes 3 master-node 30 data-nodes 2 kibana. Only coodrinating node is esposed to kibana and lo… --- ## [How to search/query on docs that have specific file size](https://discuss.elastic.co/t/how-to-search-query-on-docs-that-have-specific-file-size/153253)
**Author:** [@mohsen](https://discuss.elastic.co/u/mohsen)\ **Replies:** 3\ **Last updated:** [October 21, 2018, 7:55am UTC](https://discuss.elastic.co/t/how-to-search-query-on-docs-that-have-specific-file-size/153253 "2018-10-21T07:55:01Z")
hi, I'm new in elasticsearch and fscrawler. I want to search only files (docs) that have file size greater than n bytes and less than m byte. something like this: GET /\_search { "\_source": \[ "file.filename", "f… --- ## [Elastic won't start - Java Heap](https://discuss.elastic.co/t/elastic-wont-start-java-heap/153271)
**Author:** [@lowdmt](https://discuss.elastic.co/u/lowdmt)\ **Replies:** 0\ **Last updated:** [October 21, 2018, 6:58am UTC](https://discuss.elastic.co/t/elastic-wont-start-java-heap/153271 "2018-10-21T06:58:38Z")
Hi, Running ELK 6.4 with x-pack activated (trial licence) on a single Redhat server. First sign that something was going wrong was Kibana not letting me log in, I got to the logon screen but my password stopped working… --- ## [Elasticsearch output split problem](https://discuss.elastic.co/t/elasticsearch-output-split-problem/153268)
**Author:** [@abu.sayeed](https://discuss.elastic.co/u/abu.sayeed)\ **Replies:** 0\ **Last updated:** [October 21, 2018, 3:36am UTC](https://discuss.elastic.co/t/elasticsearch-output-split-problem/153268 "2018-10-21T03:36:39Z")
I have some custom grok in logstash conf.d directory. That grok split /home/local/example/example.log path data. I wish - /var/log/\*.log path data will be split via filebeat system module and /home/local/example/example.… --- ## [Only expose HTTPS](https://discuss.elastic.co/t/only-expose-https/153214)
**Author:** [@rossbeehler](https://discuss.elastic.co/u/rossbeehler)\ **Replies:** 5\ **Last updated:** [October 21, 2018, 3:18am UTC](https://discuss.elastic.co/t/only-expose-https/153214 "2018-10-21T03:18:29Z")
I am trialing the x-pack security feature through the docker.elastic.co/elasticsearch/elasticsearch:6.4.2 container image and have followed the Configuring TLS documentation, but after starting elasticsearch, I can only … --- ## [Cluster With Mulitple Indexes With Different Performance Requirements](https://discuss.elastic.co/t/cluster-with-mulitple-indexes-with-different-performance-requirements/152313)
**Author:** [@Johnnycc1](https://discuss.elastic.co/u/Johnnycc1)\ **Replies:** 2\ **Last updated:** [October 20, 2018, 8:56pm UTC](https://discuss.elastic.co/t/cluster-with-mulitple-indexes-with-different-performance-requirements/152313 "2018-10-20T20:56:04Z")
Heya All, Like everybody (I think) we have an elastic cluster with multiple indexes. Also like most people, some indexes need to have good consistent response times for searching, while others can be much slower. If yo… --- ## [Faster way to count maximum cardinality?](https://discuss.elastic.co/t/faster-way-to-count-maximum-cardinality/153199)
**Author:** [@klahnakoski](https://discuss.elastic.co/u/klahnakoski)\ **Replies:** 1\ **Last updated:** [October 20, 2018, 11:41am UTC](https://discuss.elastic.co/t/faster-way-to-count-maximum-cardinality/153199 "2018-10-20T11:41:59Z")
I am collecting metadata on properties: { "aggs":{ "card":{"cardinality":{"field":"task.dependencies"}}, "multi":{"max":{"script":"doc\[\\"task.dependencies\\"\].values.size()"}} }, "size":0 } The first is cardinali… --- ## [Aggregations of aggregations](https://discuss.elastic.co/t/aggregations-of-aggregations/153071)
**Author:** [@Stepane](https://discuss.elastic.co/u/Stepane)\ **Replies:** 5\ **Last updated:** [October 20, 2018, 11:16am UTC](https://discuss.elastic.co/t/aggregations-of-aggregations/153071 "2018-10-20T11:16:25Z")
Hi, I save all the connections of the different internal applications in an elasticsearch index. I have, for example, these recordings: { "host": "www.internal-app-1.com", "login": "user1", "time": "2018-1… --- ## [Object mapping for \[requestBody\] tried to parse field \[requestBody\] as object, but found a concrete value](https://discuss.elastic.co/t/object-mapping-for-requestbody-tried-to-parse-field-requestbody-as-object-but-found-a-concrete-value/153244)
**Author:** [@kimown](https://discuss.elastic.co/u/kimown)\ **Replies:** 0\ **Last updated:** [October 20, 2018, 9:12am UTC](https://discuss.elastic.co/t/object-mapping-for-requestbody-tried-to-parse-field-requestbody-as-object-but-found-a-concrete-value/153244 "2018-10-20T09:12:33Z")
ELK VERSION: 6.4.2 I am using filebeat, here is my config of filebeat.yml filebeat.prospectors: - type: log paths: - '/XXX/access.log' json.keys\_under\_root: true processors: - decode\_json\_fields: … --- ## [Configuration when running in virtualised hardware](https://discuss.elastic.co/t/configuration-when-running-in-virtualised-hardware/153238)
**Author:** [@jsmith1](https://discuss.elastic.co/u/jsmith1)\ **Replies:** 0\ **Last updated:** [October 20, 2018, 1:38am UTC](https://discuss.elastic.co/t/configuration-when-running-in-virtualised-hardware/153238 "2018-10-20T01:38:59Z")
Hi, I was just wondering if there are any particular issues or configuration settings I should be aware of when running my cluster oh VMs rather than bare metal. Currently running ES 6.4 in ESXi 6.5. A few people have… --- ## [Indexing source code using ES and interest in the line number](https://discuss.elastic.co/t/indexing-source-code-using-es-and-interest-in-the-line-number/153173)
**Author:** [@bearsmall](https://discuss.elastic.co/u/bearsmall)\ **Replies:** 1\ **Last updated:** [October 19, 2018, 7:58pm UTC](https://discuss.elastic.co/t/indexing-source-code-using-es-and-interest-in-the-line-number/153173 "2018-10-19T19:58:53Z")
I saw this post from 2014 Source Code Index using ES and I also saw this post from 2017 Indexing source code using ES and ingest attachment plugin so how about now？is there any way to get the line number from the sear… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1509) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1511)