# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1517 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1518 --- ## [Monitor Microsoft Exchange Server 2013 logs](https://discuss.elastic.co/t/monitor-microsoft-exchange-server-2013-logs/152428)
**Author:** [@zen.xen](https://discuss.elastic.co/u/zen.xen)\ **Replies:** 4\ **Last updated:** [October 15, 2018, 11:19am UTC](https://discuss.elastic.co/t/monitor-microsoft-exchange-server-2013-logs/152428 "2018-10-15T11:19:25Z")
Hello, I have installed ELK 6.4.0 in Windows environment, I configured winlogbeat for Windows logs and it works fine. Now I'd like to collect Exchange logs, so I have used filebeat but it is a little bit difficult to s… --- ## [Wildcard query no results, but wildcard in query\_string works OK](https://discuss.elastic.co/t/wildcard-query-no-results-but-wildcard-in-query-string-works-ok/152471)
**Author:** [@tomekit](https://discuss.elastic.co/u/tomekit)\ **Replies:** 1\ **Last updated:** [October 15, 2018, 11:11am UTC](https://discuss.elastic.co/t/wildcard-query-no-results-but-wildcard-in-query-string-works-ok/152471 "2018-10-15T11:11:53Z")
I am running ES 5.3.3. I've got a document field name, value: L-tryp-something which I am trying to find. This query gives no result: "wildcard" : { "name" : { "wildcard" : "L-tryp\*", "boost" : 2.0 } } However this w… --- ## [Updating documents in an index with nested types](https://discuss.elastic.co/t/updating-documents-in-an-index-with-nested-types/152122)
**Author:** [@spanackel](https://discuss.elastic.co/u/spanackel)\ **Replies:** 1\ **Last updated:** [October 15, 2018, 11:11am UTC](https://discuss.elastic.co/t/updating-documents-in-an-index-with-nested-types/152122 "2018-10-15T11:11:25Z")
I am using an index with has nested types. Noticed that some updates to these documents taking over 30 mins to show up on the search results. Is this expected? There were multiple updates to the document, but the last up… --- ## [Is it possible to do a date histogram aggregation and get percent totals?](https://discuss.elastic.co/t/is-it-possible-to-do-a-date-histogram-aggregation-and-get-percent-totals/152143)
**Author:** [@Jason\_Baumgartner](https://discuss.elastic.co/u/Jason_Baumgartner)\ **Replies:** 1\ **Last updated:** [October 15, 2018, 11:08am UTC](https://discuss.elastic.co/t/is-it-possible-to-do-a-date-histogram-aggregation-and-get-percent-totals/152143 "2018-10-15T11:08:27Z")
I have an Elasticsearch query that creates aggregations based on specific search terms. Within each bucket of the date histogram aggregation, the doc\_count gives the total number of documents matching the search criteria… --- ## [Watcher permissions](https://discuss.elastic.co/t/watcher-permissions/152261)
**Author:** [@luksi1](https://discuss.elastic.co/u/luksi1)\ **Replies:** 2\ **Last updated:** [October 15, 2018, 11:02am UTC](https://discuss.elastic.co/t/watcher-permissions/152261 "2018-10-15T11:02:04Z")
I would think this role would access to everything. Unfortunately though, I'm receiving an access denied when attempting to view our watchers. Is there something I'm missing? --- ## [Replicate whole data to a specific node](https://discuss.elastic.co/t/replicate-whole-data-to-a-specific-node/152476)
**Author:** [@mosmanmix](https://discuss.elastic.co/u/mosmanmix)\ **Replies:** 0\ **Last updated:** [October 15, 2018, 10:57am UTC](https://discuss.elastic.co/t/replicate-whole-data-to-a-specific-node/152476 "2018-10-15T10:57:42Z")
Hi, we have a production cluster based on 4 data nodes used by our frontend application. We have recently developed a feature that consumes a lot of resource from this cluster, and when one is using this feature, the o… --- ## [Is it possible to access to a different document by ID in script?](https://discuss.elastic.co/t/is-it-possible-to-access-to-a-different-document-by-id-in-script/152329)
**Author:** [@yyz1989](https://discuss.elastic.co/u/yyz1989)\ **Replies:** 1\ **Last updated:** [October 15, 2018, 10:57am UTC](https://discuss.elastic.co/t/is-it-possible-to-access-to-a-different-document-by-id-in-script/152329 "2018-10-15T10:57:18Z")
Dear friends, Assume I have three documents in three indexes referencing each other through some attributes: { "\_index": "a", "\_id": "a:0", "\_source": { "child": "b:0" } } { "\_index": "b", "\_id": "b:0"… --- ## ["Did you mean" feature using elasticsearch](https://discuss.elastic.co/t/did-you-mean-feature-using-elasticsearch/150886)
**Author:** [@Nikesh](https://discuss.elastic.co/u/Nikesh)\ **Replies:** 2\ **Last updated:** [October 15, 2018, 10:42am UTC](https://discuss.elastic.co/t/did-you-mean-feature-using-elasticsearch/150886 "2018-10-15T10:42:35Z")
Hi all, I am implementing "did you mean" technology using Elasticsearch. After doing some research I found out, phrase suggesters is designed only for this purpose. But I am facing some issues with it. My mapping doc… --- ## [Must XPack be installed on ALL nodes in a cluster if only some nodes need a subset of XPack features?](https://discuss.elastic.co/t/must-xpack-be-installed-on-all-nodes-in-a-cluster-if-only-some-nodes-need-a-subset-of-xpack-features/151617)
**Author:** [@kodo65](https://discuss.elastic.co/u/kodo65)\ **Replies:** 2\ **Last updated:** [October 15, 2018, 10:34am UTC](https://discuss.elastic.co/t/must-xpack-be-installed-on-all-nodes-in-a-cluster-if-only-some-nodes-need-a-subset-of-xpack-features/151617 "2018-10-15T10:34:31Z")
I assume the answer is "yes" but is it so? Cheers --- ## [Can't update disk space watermarks via API](https://discuss.elastic.co/t/cant-update-disk-space-watermarks-via-api/148793)
**Author:** [@74db36a597f21b891b3f](https://discuss.elastic.co/u/74db36a597f21b891b3f)\ **Replies:** 6\ **Last updated:** [October 15, 2018, 10:15am UTC](https://discuss.elastic.co/t/cant-update-disk-space-watermarks-via-api/148793 "2018-10-15T10:15:21Z")
Hello there. I'm trying to update thresholds of disk space in my ES cluster but can't do this due to error. \[admin@client1 ~\]$ curl -X PUT "10.xxx.xxx.xxx:9200/\_cluster/settings?flat\_settings=true" -H 'Content- Type: … --- ## [Doubt about document structure](https://discuss.elastic.co/t/doubt-about-document-structure/152410)
**Author:** [@paulohperes](https://discuss.elastic.co/u/paulohperes)\ **Replies:** 1\ **Last updated:** [October 15, 2018, 9:56am UTC](https://discuss.elastic.co/t/doubt-about-document-structure/152410 "2018-10-15T09:56:34Z")
I need to set up a document structure to store information about network equipment. A network device has information about its type, its manufacturer, cards (slots) and their network interfaces. My question is with reg… --- ## [Question: ES response size limitations | 502 bad gateway](https://discuss.elastic.co/t/question-es-response-size-limitations-502-bad-gateway/152447)
**Author:** [@omurbekjk](https://discuss.elastic.co/u/omurbekjk)\ **Replies:** 1\ **Last updated:** [October 15, 2018, 8:42am UTC](https://discuss.elastic.co/t/question-es-response-size-limitations-502-bad-gateway/152447 "2018-10-15T08:42:29Z")
We have large data in ES, we send request with the size limit: 1,000 and we do pagination to get remaining results. Sometimes we get 502 bad gateway, hard to debug what went wrong. I assumed if the response size is too… --- ## [Query nested Document with all equal](https://discuss.elastic.co/t/query-nested-document-with-all-equal/152450)
**Author:** [@vishal1918es](https://discuss.elastic.co/u/vishal1918es)\ **Replies:** 0\ **Last updated:** [October 15, 2018, 8:29am UTC](https://discuss.elastic.co/t/query-nested-document-with-all-equal/152450 "2018-10-15T08:29:02Z")
Hello I have a document with nested fields as array. Is there a simple way to get the search result of "All child equal" and "All child not equal" Kind of operations? For example I have below Document - { "objectId":"… --- ## [Smart rebalancing over date based indices](https://discuss.elastic.co/t/smart-rebalancing-over-date-based-indices/152413)
**Author:** [@idanhagai](https://discuss.elastic.co/u/idanhagai)\ **Replies:** 2\ **Last updated:** [October 15, 2018, 8:28am UTC](https://discuss.elastic.co/t/smart-rebalancing-over-date-based-indices/152413 "2018-10-15T08:28:14Z")
ES 5.2 2 types of date based indices (e.g X-2018-10-10, y-2018-10-10) 20 shards per index. 30 indices from each index type (with 1 replica) 50 nodes. Any suggestions how to spread all shards for best performance ? … --- ## [Delete some snapshots on S3](https://discuss.elastic.co/t/delete-some-snapshots-on-s3/151482)
**Author:** [@dao](https://discuss.elastic.co/u/dao)\ **Replies:** 11\ **Last updated:** [October 15, 2018, 7:45am UTC](https://discuss.elastic.co/t/delete-some-snapshots-on-s3/151482 "2018-10-15T07:45:41Z")
Hello, I have created a snapshot automation to s3 with a crontab 0 \*/3 \* \* \* curl -XPUT -u elastic:aaaaaa "http://localhost:9200/\_snapshot/s3\_repository/snapshot\_$(date +\\%Y\\%m\\%d\_\\%H)" I can see my S3 billing going u… --- ## [Advanced Threshold Watch with webhook](https://discuss.elastic.co/t/advanced-threshold-watch-with-webhook/152070)
**Author:** [@sasha](https://discuss.elastic.co/u/sasha)\ **Replies:** 1\ **Last updated:** [October 15, 2018, 7:17am UTC](https://discuss.elastic.co/t/advanced-threshold-watch-with-webhook/152070 "2018-10-15T07:17:37Z")
I want to make just a simple threshold watch that alerts if a certain field is greater than a certain value. But I want to send the alert via a webhook so the basic threshold watch is not an option. How would I set up th… --- ## [Kibana cannot access Elasticsearch](https://discuss.elastic.co/t/kibana-cannot-access-elasticsearch/151241)
**Author:** [@vnallamothu](https://discuss.elastic.co/u/vnallamothu)\ **Replies:** 2\ **Last updated:** [October 15, 2018, 6:46am UTC](https://discuss.elastic.co/t/kibana-cannot-access-elasticsearch/151241 "2018-10-15T06:46:59Z")
I installed Kibana and elasticsearch version 5.5.3 on the same server. I was able to install both of them and access them on their respective ports. But, I would like to see monitoring so, I tried to install x-pack 5.5.3… --- ## [Elastic Search 6.4.2 Primary shards on same node](https://discuss.elastic.co/t/elastic-search-6-4-2-primary-shards-on-same-node/152391)
**Author:** [@Neha\_Sharma1](https://discuss.elastic.co/u/Neha_Sharma1)\ **Replies:** 2\ **Last updated:** [October 15, 2018, 5:30am UTC](https://discuss.elastic.co/t/elastic-search-6-4-2-primary-shards-on-same-node/152391 "2018-10-15T05:30:46Z")
We have 15 Tb data for approx. 100 indexes (with multiple shards and 1 replica). We have 6 data nodes. The problem we are facing is that sometimes a single node has all primary shards which increase the IOPS load on the … --- ## [Elasticsearch: Testing Analyzers](https://discuss.elastic.co/t/elasticsearch-testing-analyzers/151757)
**Author:** [@rahulnama](https://discuss.elastic.co/u/rahulnama)\ **Replies:** 7\ **Last updated:** [October 15, 2018, 4:58am UTC](https://discuss.elastic.co/t/elasticsearch-testing-analyzers/151757 "2018-10-15T04:58:34Z")
Hi Team Can someone please give insights on how to test the Analyzers? Once we define Analyzers in mappings and started indexing, how should we test the Analyzers? We want to understand the way how each analyzer perfor… --- ## [Elasticsearch 5.5 is taking more than 4 hours to start in CentOS 7.x](https://discuss.elastic.co/t/elasticsearch-5-5-is-taking-more-than-4-hours-to-start-in-centos-7-x/151989)
**Author:** [@vrajasekhar123](https://discuss.elastic.co/u/vrajasekhar123)\ **Replies:** 9\ **Last updated:** [October 15, 2018, 4:31am UTC](https://discuss.elastic.co/t/elasticsearch-5-5-is-taking-more-than-4-hours-to-start-in-centos-7-x/151989 "2018-10-15T04:31:17Z")
Hi All, I used Elasticsearch 5.5.2 on CentOS 6.9. It was working fine. Now i have upgraded my OS to CentOS 7.5. Now it is taking around 4 to 5 hours to enable 9200 port. Logs also not updating till that time. Process … --- ## [\[Too many errors, abort\]](https://discuss.elastic.co/t/too-many-errors-abort/151963)
**Author:** [@rmadoori](https://discuss.elastic.co/u/rmadoori)\ **Replies:** 3\ **Last updated:** [October 15, 2018, 12:44am UTC](https://discuss.elastic.co/t/too-many-errors-abort/151963 "2018-10-15T00:44:21Z")
\`# A fatal error has been detected by the Java Runtime Environment: SIGSEGV (0xb) at pc=0x00007f8f50f71aac, pid=1, tid=72 JRE version: OpenJDK Runtime Environment (10.0.2+13) (build 10.0.2+13) Java VM: OpenJDK 64-Bit … --- ## [Installation fails when I specify a custom installation directory](https://discuss.elastic.co/t/installation-fails-when-i-specify-a-custom-installation-directory/152365)
**Author:** [@neergttocsdivad](https://discuss.elastic.co/u/neergttocsdivad)\ **Replies:** 6\ **Last updated:** [October 15, 2018, 12:10am UTC](https://discuss.elastic.co/t/installation-fails-when-i-specify-a-custom-installation-directory/152365 "2018-10-15T00:10:53Z")
Windows 10 I checked 'use a custom installation directory' then set one or more directory locations to mapped folders in a NAS, the installation appears to progress for a while but then rolled back and displayed 'an err… --- ## [Painless: problem accessing nested object using dot notation](https://discuss.elastic.co/t/painless-problem-accessing-nested-object-using-dot-notation/150599)
**Author:** [@rozling](https://discuss.elastic.co/u/rozling)\ **Replies:** 3\ **Last updated:** [October 14, 2018, 10:53pm UTC](https://discuss.elastic.co/t/painless-problem-accessing-nested-object-using-dot-notation/150599 "2018-10-14T22:53:36Z")
Hi, I'm having problems reindexing data using a painless script. The nested field context.data.result is mapped as an object in the destination index, but in some cases the source data is either a string or an array of… --- ## [Multi-statement scripts in elasticsearch](https://discuss.elastic.co/t/multi-statement-scripts-in-elasticsearch/151448)
**Author:** [@Nikesh](https://discuss.elastic.co/u/Nikesh)\ **Replies:** 1\ **Last updated:** [October 14, 2018, 10:15pm UTC](https://discuss.elastic.co/t/multi-statement-scripts-in-elasticsearch/151448 "2018-10-14T22:15:08Z")
Hi all, I have indexed a document PUT test/\_doc/1 { "counter" : 1, "tags" : \["red"\] } I am using script to update my content of the documents POST test/\_doc/1/\_update { "script" : { "source": "ctx.\_source.tags… --- ## [Scripted Metric Aggregation for multi-doc](https://discuss.elastic.co/t/scripted-metric-aggregation-for-multi-doc/151957)
**Author:** [@shwesinhan](https://discuss.elastic.co/u/shwesinhan)\ **Replies:** 1\ **Last updated:** [October 14, 2018, 9:27pm UTC](https://discuss.elastic.co/t/scripted-metric-aggregation-for-multi-doc/151957 "2018-10-14T21:27:24Z")
Can Scripted Metric Aggregation run in the context of a multi document? --- ## [Calculate two timestamps using painless](https://discuss.elastic.co/t/calculate-two-timestamps-using-painless/151556)
**Author:** [@shwesinhan](https://discuss.elastic.co/u/shwesinhan)\ **Replies:** 6\ **Last updated:** [October 14, 2018, 9:26pm UTC](https://discuss.elastic.co/t/calculate-two-timestamps-using-painless/151556 "2018-10-14T21:26:14Z")
hi team! is that possible to calculate subtract the time between two logs by id in painless script??? log example is below: plz point out to me if possible :slight\_smile: thanks so much --- ## [Nested GeoDistance Query Doesn't Return Results](https://discuss.elastic.co/t/nested-geodistance-query-doesnt-return-results/151371)
**Author:** [@hacker\_21](https://discuss.elastic.co/u/hacker_21)\ **Replies:** 2\ **Last updated:** [October 14, 2018, 8:40pm UTC](https://discuss.elastic.co/t/nested-geodistance-query-doesnt-return-results/151371 "2018-10-14T20:40:06Z")
I have the following mapping: mapping = """ { "settings": { "analysis": { "analyzer" : "stop", "normalizer": { "lowercase\_normalizer": { "type": "custom", "char\_filter": \[\], "filter": \["lowercase"\] } } } }, … --- ## [With removal of mapping types, should bulk api update as well?](https://discuss.elastic.co/t/with-removal-of-mapping-types-should-bulk-api-update-as-well/152376)
**Author:** [@qiulang](https://discuss.elastic.co/u/qiulang)\ **Replies:** 3\ **Last updated:** [October 14, 2018, 7:55pm UTC](https://discuss.elastic.co/t/with-removal-of-mapping-types-should-bulk-api-update-as-well/152376 "2018-10-14T19:55:52Z")
Hi, Mapping types has deprecated since 6.x but when I check bulk api ,it still uses type as example, POST \_bulk { "index" : { "\_index" : "test", "\_type" : "\_doc", "\_id" : "1" } } { "field1" : "value1" } So will "\_typ… --- ## [Certutil cert generation](https://discuss.elastic.co/t/certutil-cert-generation/152030)
**Author:** [@Raj\_Kumar](https://discuss.elastic.co/u/Raj_Kumar)\ **Replies:** 1\ **Last updated:** [October 14, 2018, 7:32pm UTC](https://discuss.elastic.co/t/certutil-cert-generation/152030 "2018-10-14T19:32:18Z")
Hi There, I have three node cluster solution , am truing to create csr with instances.yml ( these have all my node , dns name, ip address etc ...) My question is if we creating csr with cerutil tool, will it create thre… --- ## [Show certain documents first, then sort remaining documents](https://discuss.elastic.co/t/show-certain-documents-first-then-sort-remaining-documents/152254)
**Author:** [@khonsu](https://discuss.elastic.co/u/khonsu)\ **Replies:** 2\ **Last updated:** [October 14, 2018, 5:44pm UTC](https://discuss.elastic.co/t/show-certain-documents-first-then-sort-remaining-documents/152254 "2018-10-14T17:44:03Z")
Is it possible to exclude some documents from sorting operation, show specific documents first then sort? What I want to achieve is supplying set of ids to ES and showing matching documents first and then sort other rem… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1516) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1518)