# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1527 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1528 --- ## [Bulk index operation with iterations failed](https://discuss.elastic.co/t/bulk-index-operation-with-iterations-failed/150355)
**Author:** [@zhugw](https://discuss.elastic.co/u/zhugw)\ **Replies:** 3\ **Last updated:** [October 5, 2018, 9:14am UTC](https://discuss.elastic.co/t/bulk-index-operation-with-iterations-failed/150355 "2018-10-05T09:14:37Z")
I want to use rally to insert many docs to an index for benchmark, e.g. I have a documents.json with 1405 records, I want to insert 1405\*1000 to index for benchmark. { "operation": "bulk-index", "iterations": 1000, … --- ## [org.elasticsearch.hadoop.rest.EsHadoopNoNodesLeftException: Connection error (check network and/or proxy settings)- all nodes failed; tried \[\[172.24.191.234:9010, 172.24.191.231:9010, 172.24.191.233:9010\]\]](https://discuss.elastic.co/t/org-elasticsearch-hadoop-rest-eshadoopnonodesleftexception-connection-error-check-network-and-or-proxy-settings-all-nodes-failed-tried-172-24-191-234-9010-172-24-191-231-9010-172-24-191-233-9010/150957)
**Author:** [@bpaul](https://discuss.elastic.co/u/bpaul)\ **Replies:** 2\ **Last updated:** [October 5, 2018, 6:57am UTC](https://discuss.elastic.co/t/org-elasticsearch-hadoop-rest-eshadoopnonodesleftexception-connection-error-check-network-and-or-proxy-settings-all-nodes-failed-tried-172-24-191-234-9010-172-24-191-231-9010-172-24-191-233-9010/150957 "2018-10-05T06:57:28Z")
Hello guys, I am trying to export data from hadoop into elastic search. The Map reduce job is getting failed and the daeomon of elastic search is automatically shutting down.I have configured 4 nodes to form an elastic s… --- ## [Not enough master nodes discovered during pinging (found \[\[\]\], but needed \[2\]), pinging again](https://discuss.elastic.co/t/not-enough-master-nodes-discovered-during-pinging-found-but-needed-2-pinging-again/150575)
**Author:** [@aviral\_srivastava](https://discuss.elastic.co/u/aviral_srivastava)\ **Replies:** 3\ **Last updated:** [October 5, 2018, 6:44am UTC](https://discuss.elastic.co/t/not-enough-master-nodes-discovered-during-pinging-found-but-needed-2-pinging-again/150575 "2018-10-05T06:44:26Z")
Hi, I have a 4 node cluster. 3 nodes are running on Red Hat Enterprise Linux Server. 1 node is on Windows Server 2008 R2. Configurations are as follows: node4 \[coordinating node\] cluster.name: appmon node.name: no… --- ## [How to reduce snapshot sizes](https://discuss.elastic.co/t/how-to-reduce-snapshot-sizes/151143)
**Author:** [@Jianzhou\_Z](https://discuss.elastic.co/u/Jianzhou_Z)\ **Replies:** 7\ **Last updated:** [October 5, 2018, 6:42am UTC](https://discuss.elastic.co/t/how-to-reduce-snapshot-sizes/151143 "2018-10-05T06:42:03Z")
Backup repository size is much bigger than indices size discusses a problem that snapshots can be too large. I do not think removing old snapshots is the solution because if the old snapshot has segments that newer snap… --- ## [Index doesn't work, but why?](https://discuss.elastic.co/t/index-doesnt-work-but-why/151058)
**Author:** [@humalog](https://discuss.elastic.co/u/humalog)\ **Replies:** 2\ **Last updated:** [October 5, 2018, 6:36am UTC](https://discuss.elastic.co/t/index-doesnt-work-but-why/151058 "2018-10-05T06:36:35Z")
Hello, i am new to EKB. I try to learn EKB 6.4.0 and i am at Watcher/Altering. It works fine with Logging Action. Now i want to run Index Action. I want to write certain index entries to a new index. This is my watch: … --- ## [How does elasticsearch decide how many shards can be restored in parallel](https://discuss.elastic.co/t/how-does-elasticsearch-decide-how-many-shards-can-be-restored-in-parallel/151139)
**Author:** [@Jianzhou\_Z](https://discuss.elastic.co/u/Jianzhou_Z)\ **Replies:** 1\ **Last updated:** [October 5, 2018, 5:48am UTC](https://discuss.elastic.co/t/how-does-elasticsearch-decide-how-many-shards-can-be-restored-in-parallel/151139 "2018-10-05T05:48:50Z")
I made a snapshot of an index with 24 shards. The index is of size 700g. When restoring, it restores 4 shards in parallel. My cluster is a new cluster with only one machine w/o replica nodes. The machine is AWS c3.8xlar… --- ## [Query must and must\_not](https://discuss.elastic.co/t/query-must-and-must-not/150976)
**Author:** [@pjanzen](https://discuss.elastic.co/u/pjanzen)\ **Replies:** 1\ **Last updated:** [October 5, 2018, 4:59am UTC](https://discuss.elastic.co/t/query-must-and-must-not/150976 "2018-10-05T04:59:56Z")
Hi All, I am working on the below query and my perception of the output is that the domain.keyword produced by the must\_not is excluded from the output. Is that correct? { "query": { "bool": { "must": \[ … --- ## [ES getting OOM and crashing every hour](https://discuss.elastic.co/t/es-getting-oom-and-crashing-every-hour/151147)
**Author:** [@vikash\_srivastava](https://discuss.elastic.co/u/vikash_srivastava)\ **Replies:** 0\ **Last updated:** [October 5, 2018, 4:58am UTC](https://discuss.elastic.co/t/es-getting-oom-and-crashing-every-hour/151147 "2018-10-05T04:58:57Z")
Please let me know if you need any info Environment: Linux host-70-1-1-48 4.4.0-47-generic #68-Ubuntu SMP Wed Oct 26 19:39:52 UTC 2016 x86\_64 x86\_64 x86\_64 GNU/Linux ro http://10.131.69.72:9200/\_nodes/settings {"\_nod… --- ## [Data nodes unable to join masternode](https://discuss.elastic.co/t/data-nodes-unable-to-join-masternode/151106)
**Author:** [@rmadoori](https://discuss.elastic.co/u/rmadoori)\ **Replies:** 1\ **Last updated:** [October 5, 2018, 12:27am UTC](https://discuss.elastic.co/t/data-nodes-unable-to-join-masternode/151106 "2018-10-05T00:27:02Z")
Hi, I have elasticsearch cluster with master node and 3 data nodes running in docker container. Initially it came with basic license and i switched to trial license. curl -XPUT 'http://0.0.0.0:9200/\_xpack/license' -H… --- ## [Missing authentication token for REST request \[/\]](https://discuss.elastic.co/t/missing-authentication-token-for-rest-request/151103)
**Author:** [@rmadoori](https://discuss.elastic.co/u/rmadoori)\ **Replies:** 1\ **Last updated:** [October 4, 2018, 10:32pm UTC](https://discuss.elastic.co/t/missing-authentication-token-for-rest-request/151103 "2018-10-04T22:32:46Z")
\[2018-10-04T19:00:45,986\]\[DEBUG\]\[r.suppressed \] path: /, params: {} org.elasticsearch.ElasticsearchSecurityException: missing authentication token for REST request \[/\] at org.elasticsearch.xpack.core.security.support.Ex… --- ## [Not able to see the cluster status attribute in monitoring-es index](https://discuss.elastic.co/t/not-able-to-see-the-cluster-status-attribute-in-monitoring-es-index/150942)
**Author:** [@mpandey](https://discuss.elastic.co/u/mpandey)\ **Replies:** 3\ **Last updated:** [October 4, 2018, 10:31pm UTC](https://discuss.elastic.co/t/not-able-to-see-the-cluster-status-attribute-in-monitoring-es-index/150942 "2018-10-04T22:31:55Z")
I am working on creating an alert around cluster status wherein I am using .monitoring-es-\* index to extract the cluster status. But after doing some initial study, I realized that index does not contain that attribute. … --- ## [How to setup elastic search kibana with trial license](https://discuss.elastic.co/t/how-to-setup-elastic-search-kibana-with-trial-license/151099)
**Author:** [@rmadoori](https://discuss.elastic.co/u/rmadoori)\ **Replies:** 1\ **Last updated:** [October 4, 2018, 8:57pm UTC](https://discuss.elastic.co/t/how-to-setup-elastic-search-kibana-with-trial-license/151099 "2018-10-04T20:57:25Z")
How to setup elastic serach and kibana with xpack trial licence in docker conatiner?? --- ## [Malware detected in elasticsearch index file](https://discuss.elastic.co/t/malware-detected-in-elasticsearch-index-file/150753)
**Author:** [@Maekee](https://discuss.elastic.co/u/Maekee)\ **Replies:** 3\ **Last updated:** [October 4, 2018, 8:52pm UTC](https://discuss.elastic.co/t/malware-detected-in-elasticsearch-index-file/150753 "2018-10-04T20:52:08Z")
Our malware detection found a malware (Exploit:O97M/DDEDownloader.C) in a index file system file where we store our indices: file:D:\\ESData\\Data\\nodes\\0\\indices\\w9l0szt8RR-ZeQ8p4asJqA\\3\\index\_108v\_Lucene70\_0.dvd Have i… --- ## [WordNet synonym file format error](https://discuss.elastic.co/t/wordnet-synonym-file-format-error/151118)
**Author:** [@arjunp](https://discuss.elastic.co/u/arjunp)\ **Replies:** 0\ **Last updated:** [October 4, 2018, 8:03pm UTC](https://discuss.elastic.co/t/wordnet-synonym-file-format-error/151118 "2018-10-04T20:03:13Z")
Hi All, I am trying to load the WorNet synonym file (wn\_s.pl) in to the Elastic Search 6.4.1from http://wordnetcode.princeton.edu/3.0/WNprolog-3.0.tar.gz. It is not loading certain records and throws an parse exception… --- ## [How to look for string '\\user' using query\_string](https://discuss.elastic.co/t/how-to-look-for-string-user-using-query-string/151114)
**Author:** [@lucas.alvarez](https://discuss.elastic.co/u/lucas.alvarez)\ **Replies:** 1\ **Last updated:** [October 4, 2018, 7:47pm UTC](https://discuss.elastic.co/t/how-to-look-for-string-user-using-query-string/151114 "2018-10-04T19:47:42Z")
Hello everybody!. I have tried for an hour a way to look for '\\user' inside of a message and I cannot make it work. I know this can be easily done using the match\_phrase command, but since I'm using ElastAlert I must us… --- ## [Error - Failed to execute action](https://discuss.elastic.co/t/error-failed-to-execute-action/151101)
**Author:** [@Yolanda\_Goncalves](https://discuss.elastic.co/u/Yolanda_Goncalves)\ **Replies:** 1\ **Last updated:** [October 4, 2018, 7:10pm UTC](https://discuss.elastic.co/t/error-failed-to-execute-action/151101 "2018-10-04T19:10:49Z")
Hi, I am trying to input a csv file trought logstash but I am getting the following error message: \[root@wazuh-server logstash\]# ./bin/logstash -f logstash\_scan.config WARNING: Could not find logstash.yml which is typ… --- ## [Decision to throttle based on a condition](https://discuss.elastic.co/t/decision-to-throttle-based-on-a-condition/149489)
**Author:** [@gautu7](https://discuss.elastic.co/u/gautu7)\ **Replies:** 2\ **Last updated:** [October 4, 2018, 7:04pm UTC](https://discuss.elastic.co/t/decision-to-throttle-based-on-a-condition/149489 "2018-10-04T19:04:44Z")
I want to throttle an action based on the result of a previously executed action. Let's say I have 10 unique nodes for a fs utilization alert and I want to throttle based on each unique node with the met condition. For … --- ## [Hadoop Error : Cannot detect ES version - typically this happens if the network/Elasticsearch cluster is not accessible or when targeting a WAN/Cloud instance without the proper setting 'es.nodes.wan.only'](https://discuss.elastic.co/t/hadoop-error-cannot-detect-es-version-typically-this-happens-if-the-network-elasticsearch-cluster-is-not-accessible-or-when-targeting-a-wan-cloud-instance-without-the-proper-setting-es-nodes-wan-only/150833)
**Author:** [@bpaul](https://discuss.elastic.co/u/bpaul)\ **Replies:** 1\ **Last updated:** [October 4, 2018, 7:04pm UTC](https://discuss.elastic.co/t/hadoop-error-cannot-detect-es-version-typically-this-happens-if-the-network-elasticsearch-cluster-is-not-accessible-or-when-targeting-a-wan-cloud-instance-without-the-proper-setting-es-nodes-wan-only/150833 "2018-10-04T19:04:35Z")
I have been trying to load data from hadoop cluster into Elastic search index. I had started the MapReduce job for executing the operation but it failed throwing the above given error. It throwed the above given error a… --- ## [Ingest Node - Stored pipelines](https://discuss.elastic.co/t/ingest-node-stored-pipelines/150991)
**Author:** [@gourmax-geo](https://discuss.elastic.co/u/gourmax-geo)\ **Replies:** 1\ **Last updated:** [October 4, 2018, 7:03pm UTC](https://discuss.elastic.co/t/ingest-node-stored-pipelines/150991 "2018-10-04T19:03:46Z")
Hi, I'm trying to make some test with ingest node and coordinator node. The settings between both is pretty easy, but I was wondering if there is any way to be sure that my pipeline is really "stored" in the ingest nod… --- ## [Elasticsearch \[6.2\] doesn't find ampersand](https://discuss.elastic.co/t/elasticsearch-6-2-doesnt-find-ampersand/151098)
**Author:** [@xlbrlx](https://discuss.elastic.co/u/xlbrlx)\ **Replies:** 0\ **Last updated:** [October 4, 2018, 6:45pm UTC](https://discuss.elastic.co/t/elasticsearch-6-2-doesnt-find-ampersand/151098 "2018-10-04T18:45:58Z")
Hi there, I just upgraded my elasticsearch 1.7 to 6.2. Mapping is the same but query doesn't work anymore. Here is my old mapping: "myField": { "type": "string", "index\_options": "offsets", "term\_vector": "with\_po… --- ## [Logstash target on Elasticsearch Architecture](https://discuss.elastic.co/t/logstash-target-on-elasticsearch-architecture/150952)
**Author:** [@negrote](https://discuss.elastic.co/u/negrote)\ **Replies:** 7\ **Last updated:** [October 4, 2018, 6:36pm UTC](https://discuss.elastic.co/t/logstash-target-on-elasticsearch-architecture/150952 "2018-10-04T18:36:34Z")
Hi, I have the following architecture to elasticsearch 3 dedicated master eligible nodes (8 GB RAM + 2 CPUs) 3 data/ingest node (64GB RAM + 8 CPUs) 1 coordinating node (24 GB RAM + 4 CPUs) Which the better approach?… --- ## [Errors with ElasticSearch Setup](https://discuss.elastic.co/t/errors-with-elasticsearch-setup/150049)
**Author:** [@psd401](https://discuss.elastic.co/u/psd401)\ **Replies:** 7\ **Last updated:** [October 4, 2018, 5:16pm UTC](https://discuss.elastic.co/t/errors-with-elasticsearch-setup/150049 "2018-10-04T17:16:59Z")
This is my first time dabbling with ElasticSearch, and unfortunately, we are experiencing a multitude of errors and I am not entirely sure where to exactly go to pinpoint this problem. Basically, we are running a Linux s… --- ## [Search Performance Tuning](https://discuss.elastic.co/t/search-performance-tuning/150831)
**Author:** [@shemilr](https://discuss.elastic.co/u/shemilr)\ **Replies:** 3\ **Last updated:** [October 4, 2018, 5:10pm UTC](https://discuss.elastic.co/t/search-performance-tuning/150831 "2018-10-04T17:10:37Z")
Hi, I have one index in nested mapping structure with total of 35 million records . I am using some nested columns for searching also. When searching with nested fields, application is taking more time to respond for th… --- ## ["overhead spent" over and over during periods of time](https://discuss.elastic.co/t/overhead-spent-over-and-over-during-periods-of-time/150750)
**Author:** [@Maekee](https://discuss.elastic.co/u/Maekee)\ **Replies:** 1\ **Last updated:** [October 4, 2018, 3:18pm UTC](https://discuss.elastic.co/t/overhead-spent-over-and-over-during-periods-of-time/150750 "2018-10-04T15:18:31Z")
Hi, We have a one node cluster where JvmGcMonitorService warns about overhead like this: The logfile: \[2018-10-02T13:03:24,173\]\[WARN \]\[o.e.m.j.JvmGcMonitorService\] \[VzhkwYM\] \[gc\]\[73354\] overhead, spent \[1.1s\] collect… --- ## [Elastic search pattern](https://discuss.elastic.co/t/elastic-search-pattern/151062)
**Author:** [@pradeepbill7](https://discuss.elastic.co/u/pradeepbill7)\ **Replies:** 0\ **Last updated:** [October 4, 2018, 2:53pm UTC](https://discuss.elastic.co/t/elastic-search-pattern/151062 "2018-10-04T14:53:29Z")
Hello there, I am using ELK6.4 stack, I have data like the attached picture, and the search works only if I give like this "headers.direction:external" , but i need it to work when i give "direction:external", I am … --- ## [Migration of Index files from 5.0.0 to 6.2.4](https://discuss.elastic.co/t/migration-of-index-files-from-5-0-0-to-6-2-4/150749)
**Author:** [@sparuchuri](https://discuss.elastic.co/u/sparuchuri)\ **Replies:** 2\ **Last updated:** [October 4, 2018, 2:54pm UTC](https://discuss.elastic.co/t/migration-of-index-files-from-5-0-0-to-6-2-4/150749 "2018-10-04T14:54:35Z")
Currently index files are created using ElasticSearch.NET . How to migrate from 5.0.0 index files to 6.2.4 index files (6.2.4 version is using NEST API) Please help me on this.. --- ## [How to sort query result by sum of a field?](https://discuss.elastic.co/t/how-to-sort-query-result-by-sum-of-a-field/151056)
**Author:** [@ali\_houshyaripour](https://discuss.elastic.co/u/ali_houshyaripour)\ **Replies:** 0\ **Last updated:** [October 4, 2018, 2:03pm UTC](https://discuss.elastic.co/t/how-to-sort-query-result-by-sum-of-a-field/151056 "2018-10-04T14:03:53Z")
Hi... I have an index with name "user\_activity" in elastic and a query that get all of result, now I want to sort my result from it by sum of coin fields of every user, this means that users should be sort by sum(coin) … --- ## [ELK Using docker](https://discuss.elastic.co/t/elk-using-docker/151049)
**Author:** [@Ganesh2303](https://discuss.elastic.co/u/Ganesh2303)\ **Replies:** 0\ **Last updated:** [October 4, 2018, 1:10pm UTC](https://discuss.elastic.co/t/elk-using-docker/151049 "2018-10-04T13:10:28Z")
HI, I'm Using ELK version 6.2.4 and using of docker i have installed ELK. Currently, my container holds the node detail inside the container due to this container is get crashed or else indexes get deleted automatically… --- ## [Problem running elasticsearch in a minikube cluster](https://discuss.elastic.co/t/problem-running-elasticsearch-in-a-minikube-cluster/151031)
**Author:** [@anj\_kri](https://discuss.elastic.co/u/anj_kri)\ **Replies:** 9\ **Last updated:** [October 4, 2018, 12:58pm UTC](https://discuss.elastic.co/t/problem-running-elasticsearch-in-a-minikube-cluster/151031 "2018-10-04T12:58:14Z")
I have created a kubernetes cluster using minikube. created a helm chart of elasticsearch and installed it in the cluster. I have also passed the environment variables from the chart's deployment file to configure elast… --- ## [Elasticsearch upgrade and migration from 2.3.4 to 6.2](https://discuss.elastic.co/t/elasticsearch-upgrade-and-migration-from-2-3-4-to-6-2/149305)
**Author:** [@angshuman.ray](https://discuss.elastic.co/u/angshuman.ray)\ **Replies:** 2\ **Last updated:** [October 4, 2018, 12:19pm UTC](https://discuss.elastic.co/t/elasticsearch-upgrade-and-migration-from-2-3-4-to-6-2/149305 "2018-10-04T12:19:03Z")
Hi, We are working on upgrading our elasticsearch 2.3.4 environment to 6.2. In our system we have 6 node elasticsearch (2.3.4) cluster with full of logs in different monthly indices and high flow of incoming logs. As d… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1526) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1528)