# Elasticsearch

**URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1530

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 1531

---

## [ES logs are not written when starting from Client API](https://discuss.elastic.co/t/es-logs-are-not-written-when-starting-from-client-api/150834)

<div class="topic-metadata">

**Author:** [@iaskdoubt](https://discuss.elastic.co/u/iaskdoubt)\
**Replies:** 0\
**Last updated:** [October 3, 2018, 7:12am UTC](https://discuss.elastic.co/t/es-logs-are-not-written-when-starting-from-client-api/150834 "2018-10-03T07:12:55Z")

</div>

Elastic search is not writing any logs when started from the client API. We use the elastic search 2.2 we have also set the path.logs in configuration file

---

## [Elasticsearch Best practice sizing](https://discuss.elastic.co/t/elasticsearch-best-practice-sizing/150782)

<div class="topic-metadata">

**Author:** [@fcalegari](https://discuss.elastic.co/u/fcalegari)\
**Replies:** 2\
**Last updated:** [October 3, 2018, 5:43am UTC](https://discuss.elastic.co/t/elasticsearch-best-practice-sizing/150782 "2018-10-03T05:43:20Z")

</div>

Hi , we need to know if Is writting a Best practice to sizing the elastic architecture. How many servers we need for the clúster? What disk space ,memory , cpu Is recommended for each server? Best practice to calculat…

---

## [Elasticsearch backup on non-shared filesystem](https://discuss.elastic.co/t/elasticsearch-backup-on-non-shared-filesystem/150813)

<div class="topic-metadata">

**Author:** [@Rupesh\_Ranjan](https://discuss.elastic.co/u/Rupesh_Ranjan)\
**Replies:** 3\
**Last updated:** [October 3, 2018, 5:30am UTC](https://discuss.elastic.co/t/elasticsearch-backup-on-non-shared-filesystem/150813 "2018-10-03T05:30:13Z")

</div>

I have a ES cluster (v6.2.4), each data node having their data locally (in the VMs). In order to take a snapshot/backup of the cluster data, i came across this https://www.elastic.co/guide/en/elasticsearch/reference/curr…

---

## [Best practices on detecting QueryString Query](https://discuss.elastic.co/t/best-practices-on-detecting-querystring-query/150779)

<div class="topic-metadata">

**Author:** [@Jon\_Hourany](https://discuss.elastic.co/u/Jon_Hourany)\
**Replies:** 0\
**Last updated:** [October 3, 2018, 12:10am UTC](https://discuss.elastic.co/t/best-practices-on-detecting-querystring-query/150779 "2018-10-03T00:10:13Z")

</div>

Currently, given a user query I have a process that passes the query to multiple fields with different analyzers who each add boost the score in some way or another. If the words "AND" or "OR" show up in the query, then …

---

## [Kibana logstash not showing data after a period of time](https://discuss.elastic.co/t/kibana-logstash-not-showing-data-after-a-period-of-time/150776)

<div class="topic-metadata">

**Author:** [@Lee\_Weng\_Sheng](https://discuss.elastic.co/u/Lee_Weng_Sheng)\
**Replies:** 0\
**Last updated:** [October 2, 2018, 10:02pm UTC](https://discuss.elastic.co/t/kibana-logstash-not-showing-data-after-a-period-of-time/150776 "2018-10-02T22:02:13Z")

</div>

Is there any troubleshoot steps? \[root@m logstash\]# curl -XGET 'http://localhost:9200/\_cat/indices?v' health status index uuid pri rep docs.count docs.deleted store.size pri.store.size …

---

## [Proper way to run multiple instances of Elasticsearch 6.4.x on Single Windows Server Host?](https://discuss.elastic.co/t/proper-way-to-run-multiple-instances-of-elasticsearch-6-4-x-on-single-windows-server-host/150772)

<div class="topic-metadata">

**Author:** [@Matt\_Vasquez](https://discuss.elastic.co/u/Matt_Vasquez)\
**Replies:** 0\
**Last updated:** [October 2, 2018, 9:47pm UTC](https://discuss.elastic.co/t/proper-way-to-run-multiple-instances-of-elasticsearch-6-4-x-on-single-windows-server-host/150772 "2018-10-02T21:47:23Z")

</div>

Whats the proper way to run multiple instances of Elasticsearch 6.4.x on Single Windows Server Host?? Non-Containerized...

---

## [Dfs\_query\_then\_fetch value not working with SearchRequestBuilder.setSearchType](https://discuss.elastic.co/t/dfs-query-then-fetch-value-not-working-with-searchrequestbuilder-setsearchtype/150603)

<div class="topic-metadata">

**Author:** [@wmebed](https://discuss.elastic.co/u/wmebed)\
**Replies:** 1\
**Last updated:** [October 2, 2018, 9:32pm UTC](https://discuss.elastic.co/t/dfs-query-then-fetch-value-not-working-with-searchrequestbuilder-setsearchtype/150603 "2018-10-02T21:32:47Z")

</div>

I implemented an ActionPlugin by extending BaseRestHandler. But when I set the searchType (searchRequestBuilder.setSearchType(SearchType.DFS\_QUERY\_THEN\_FETCH).execute().get()....) it isn't being honored. I can tell the…

---

## [Elasticsearch 6.4.1 - Configuring X-pack on CentOS7 x64 Issue](https://discuss.elastic.co/t/elasticsearch-6-4-1-configuring-x-pack-on-centos7-x64-issue/150397)

<div class="topic-metadata">

**Author:** [@mreloysanchez](https://discuss.elastic.co/u/mreloysanchez)\
**Replies:** 4\
**Last updated:** [October 2, 2018, 9:32pm UTC](https://discuss.elastic.co/t/elasticsearch-6-4-1-configuring-x-pack-on-centos7-x64-issue/150397 "2018-10-02T21:32:37Z")

</div>

Hello, I've installed Elasticsearch 6.4.1 and installed Kibana 6.4.1 Logstash 6.4.1, Packetbeat 6.4.1, and Filebeat 6.4.1 on our CentOS 7 x64 VMware VM. Reviewing the documentation on how to secure Elasticsearch here: h…

---

## [Configuring the standard tokenizer elasticsearch](https://discuss.elastic.co/t/configuring-the-standard-tokenizer-elasticsearch/150742)

<div class="topic-metadata">

**Author:** [@surajdalvi](https://discuss.elastic.co/u/surajdalvi)\
**Replies:** 1\
**Last updated:** [October 2, 2018, 8:10pm UTC](https://discuss.elastic.co/t/configuring-the-standard-tokenizer-elasticsearch/150742 "2018-10-02T20:10:16Z")

</div>

Hi, I am using default tokenizer(standard) for my index in elastic search. and adding documents to it. but standard tokenizer can't split words which having "." dot in it. For example: POST \_analyze { "tokenizer": "s…

---

## [Get all field names / mappings for a specific query](https://discuss.elastic.co/t/get-all-field-names-mappings-for-a-specific-query/148655)

<div class="topic-metadata">

**Author:** [@hello](https://discuss.elastic.co/u/hello)\
**Replies:** 0\
**Last updated:** [September 14, 2018, 4:38pm UTC](https://discuss.elastic.co/t/get-all-field-names-mappings-for-a-specific-query/148655 "2018-09-14T16:38:32Z")

</div>

Say I have clothing types that each have shared and distinct mappings. I can get all of the field mappings using the get mapping API. It seems prior to ES 5, we used to be able to aggregate on \_field\_names in order to …

---

## [Client connection impossible](https://discuss.elastic.co/t/client-connection-impossible/150707)

<div class="topic-metadata">

**Author:** [@mrxrom](https://discuss.elastic.co/u/mrxrom)\
**Replies:** 3\
**Last updated:** [October 2, 2018, 7:40pm UTC](https://discuss.elastic.co/t/client-connection-impossible/150707 "2018-10-02T19:40:04Z")

</div>

Hello guys, i have build a java application to manage 3 databases (MySQL, mongoDb and ElasticSearch). evything was designed with databases in a local network and it worked very well. Now we want to put the app on work …

---

## [Machine Learning - Watcher - Not Firing](https://discuss.elastic.co/t/machine-learning-watcher-not-firing/150361)

<div class="topic-metadata">

**Author:** [@Ryan\_Downey](https://discuss.elastic.co/u/Ryan_Downey)\
**Replies:** 5\
**Last updated:** [October 2, 2018, 7:25pm UTC](https://discuss.elastic.co/t/machine-learning-watcher-not-firing/150361 "2018-10-02T19:25:37Z")

</div>

I've set up a ML job that tracks all of the servers that we have deployed metricbeat on by using the Detector low\_count thats then split by beat.name so that each server is tracked. I've setup a Watcher that matches the…

---

## [Template \_search unexpected character](https://discuss.elastic.co/t/template-search-unexpected-character/150754)

<div class="topic-metadata">

**Author:** [@JackFazackerley](https://discuss.elastic.co/u/JackFazackerley)\
**Replies:** 0\
**Last updated:** [October 2, 2018, 7:21pm UTC](https://discuss.elastic.co/t/template-search-unexpected-character/150754 "2018-10-02T19:21:58Z")

</div>

Elasticsearch version: 6.3.2 I have a search template, which I am using to loop over an array of strings but when I \_search/template I get an error saying Unexpected character ('{' (code 123)): was expecting comma to se…

---

## [Sum diferentes counts kibana](https://discuss.elastic.co/t/sum-diferentes-counts-kibana/150744)

<div class="topic-metadata">

**Author:** [@rafaelvicio](https://discuss.elastic.co/u/rafaelvicio)\
**Replies:** 0\
**Last updated:** [October 2, 2018, 5:28pm UTC](https://discuss.elastic.co/t/sum-diferentes-counts-kibana/150744 "2018-10-02T17:28:21Z")

</div>

Can I add / subtract counts with different attributes? count1: { query: { match: { event\_type: { query: icecast type: phrase } } } } count2: { query: { match: { event\_type: { query: othericecast type: p…

---

## [Performance degrading after a couple of weeks](https://discuss.elastic.co/t/performance-degrading-after-a-couple-of-weeks/150241)

<div class="topic-metadata">

**Author:** [@S\_Chase](https://discuss.elastic.co/u/S_Chase)\
**Replies:** 6\
**Last updated:** [October 2, 2018, 4:43pm UTC](https://discuss.elastic.co/t/performance-degrading-after-a-couple-of-weeks/150241 "2018-10-02T16:43:58Z")

</div>

on ES 6.4: I'm finding that over the course of 20 days Elastic Stack grinds to a very slow crawl. JVM heap gets to 99.9% and nearly everything times out. if I close indexes over the previous couple of weeks JVM moves …

---

## [Elasticsearch health shows RED](https://discuss.elastic.co/t/elasticsearch-health-shows-red/150695)

<div class="topic-metadata">

**Author:** [@anuragh](https://discuss.elastic.co/u/anuragh)\
**Replies:** 6\
**Last updated:** [October 2, 2018, 2:37pm UTC](https://discuss.elastic.co/t/elasticsearch-health-shows-red/150695 "2018-10-02T14:37:04Z")

</div>

Currently ES version is 5.4.3 and we are planning to upgrade to latest version. But before doing this i need to make the cluster GREEN.Please help {"cluster\_name":"TestCluster", "status":"red", "timed\_out":false, "n…

---

## [Query string query: default fuzziness?](https://discuss.elastic.co/t/query-string-query-default-fuzziness/148788)

<div class="topic-metadata">

**Author:** [@kasscharal](https://discuss.elastic.co/u/kasscharal)\
**Replies:** 4\
**Last updated:** [October 2, 2018, 2:29pm UTC](https://discuss.elastic.co/t/query-string-query-default-fuzziness/148788 "2018-10-02T14:29:32Z")

</div>

Hello people, I'm using ES for quite a while but I'm stuck on something I cannot explain. I do a simple query like: { "query": { "query\_string" : { "query" : "daan" } } } having all settings on default, and I …

---

## [High performance penalty, when size in query is increased](https://discuss.elastic.co/t/high-performance-penalty-when-size-in-query-is-increased/149314)

<div class="topic-metadata">

**Author:** [@JF2018](https://discuss.elastic.co/u/JF2018)\
**Replies:** 2\
**Last updated:** [October 2, 2018, 1:57pm UTC](https://discuss.elastic.co/t/high-performance-penalty-when-size-in-query-is-increased/149314 "2018-10-02T13:57:47Z")

</div>

Hi I have a query on the form: { "size" : 10, "query" : { \<Calling a plugin with different params, which filters and scores\> }, "\_source" : { "includes" : \[ "title" \] } } When I increase the size, t…

---

## [Coordinator node linked to Ingest node](https://discuss.elastic.co/t/coordinator-node-linked-to-ingest-node/150715)

<div class="topic-metadata">

**Author:** [@gourmax-geo](https://discuss.elastic.co/u/gourmax-geo)\
**Replies:** 0\
**Last updated:** [October 2, 2018, 1:30pm UTC](https://discuss.elastic.co/t/coordinator-node-linked-to-ingest-node/150715 "2018-10-02T13:30:13Z")

</div>

I'm developing an elasticsearch cluster for a "search" use-case with small real-time ingestion of time series. Here is my scheduled cluster: 3 master-eligible nodes 3 data nodes 1 ingest node 1 coordinator only node W…

---

## [Cannot evaluate org.elasticsearch.action.index.IndexResponse.toString()](https://discuss.elastic.co/t/cannot-evaluate-org-elasticsearch-action-index-indexresponse-tostring/150445)

<div class="topic-metadata">

**Author:** [@Dav](https://discuss.elastic.co/u/Dav)\
**Replies:** 1\
**Last updated:** [October 2, 2018, 1:16pm UTC](https://discuss.elastic.co/t/cannot-evaluate-org-elasticsearch-action-index-indexresponse-tostring/150445 "2018-10-02T13:16:51Z")

</div>

When using elasticsearch 6.4.1, I got the error: Method threw 'java.lang.NoClassDefFoundError' exception. Cannot evaluate org.elasticsearch.action.index.IndexResponse.toString() in the IndexResponse. And I used RestHig…

---

## [Date histogram every half a month](https://discuss.elastic.co/t/date-histogram-every-half-a-month/150675)

<div class="topic-metadata">

**Author:** [@Islam\_Elshobokshy](https://discuss.elastic.co/u/Islam_Elshobokshy)\
**Replies:** 4\
**Last updated:** [October 2, 2018, 1:05pm UTC](https://discuss.elastic.co/t/date-histogram-every-half-a-month/150675 "2018-10-02T13:05:40Z")

</div>

How to write an interval that groups by every half a month? Rather than 1M I want something like 1/2M to group by from the first to the 16th and from the 16th to the end of the month, every month. Is there a way to do so…

---

## [Group Conditions](https://discuss.elastic.co/t/group-conditions/149824)

<div class="topic-metadata">

**Author:** [@TomTom](https://discuss.elastic.co/u/TomTom)\
**Replies:** 11\
**Last updated:** [October 2, 2018, 1:05pm UTC](https://discuss.elastic.co/t/group-conditions/149824 "2018-10-02T13:05:39Z")

</div>

Currently i have this Query to search data in ElasticSearch: { "query": { "bool": { "must": \[ { "term": { "account\_id": 128 …

---

## [CORS error when sending get reuqest from angular 6 app to elasticsearch, even when its allowed](https://discuss.elastic.co/t/cors-error-when-sending-get-reuqest-from-angular-6-app-to-elasticsearch-even-when-its-allowed/150705)

<div class="topic-metadata">

**Author:** [@yishain11](https://discuss.elastic.co/u/yishain11)\
**Replies:** 0\
**Last updated:** [October 2, 2018, 12:55pm UTC](https://discuss.elastic.co/t/cors-error-when-sending-get-reuqest-from-angular-6-app-to-elasticsearch-even-when-its-allowed/150705 "2018-10-02T12:55:03Z")

</div>

0 down vote favorite I have an angular 6 app that sends http requests to elasticsearch DB. The angular app, nodejs server (that serves the angular app) and elasticsearch are hosted on the same machine, and the browser …

---

## [SAML Authentication error](https://discuss.elastic.co/t/saml-authentication-error/150522)

<div class="topic-metadata">

**Author:** [@drjackal](https://discuss.elastic.co/u/drjackal)\
**Replies:** 4\
**Last updated:** [October 2, 2018, 12:31pm UTC](https://discuss.elastic.co/t/saml-authentication-error/150522 "2018-10-02T12:31:53Z")

</div>

I am trying to configure SAML authentication together with our Windows 2016 ADFS server but whatever I try I am running into the following error: Authentication to realm saml1 failed - SAML Attribute \[nameid:persistent\]…

---

## [Delete a document with an empty \_id?](https://discuss.elastic.co/t/delete-a-document-with-an-empty-id/150696)

<div class="topic-metadata">

**Author:** [@stuayre](https://discuss.elastic.co/u/stuayre)\
**Replies:** 0\
**Last updated:** [October 2, 2018, 12:24pm UTC](https://discuss.elastic.co/t/delete-a-document-with-an-empty-id/150696 "2018-10-02T12:24:05Z")

</div>

Somehow a record has entered elastic search with an empty \_id I think this happened through the \_bulk api, how do I delete a document with an empty \_id?

---

## [Automate reindex operation with curator and dynamically create destionation indices](https://discuss.elastic.co/t/automate-reindex-operation-with-curator-and-dynamically-create-destionation-indices/150651)

<div class="topic-metadata">

**Author:** [@victor.nilsson](https://discuss.elastic.co/u/victor.nilsson)\
**Replies:** 1\
**Last updated:** [October 2, 2018, 12:01pm UTC](https://discuss.elastic.co/t/automate-reindex-operation-with-curator-and-dynamically-create-destionation-indices/150651 "2018-10-02T12:01:27Z")

</div>

Hi, We are as of now creating daily indices which we want to reindex to a monthly index. We want the flow to look something like this if possible: Curator checks if index is older than 1 month If index is older than s…

---

## [Simple range query not working, why?](https://discuss.elastic.co/t/simple-range-query-not-working-why/150682)

<div class="topic-metadata">

**Author:** [@Jacob\_Bogers](https://discuss.elastic.co/u/Jacob_Bogers)\
**Replies:** 12\
**Last updated:** [October 2, 2018, 11:41am UTC](https://discuss.elastic.co/t/simple-range-query-not-working-why/150682 "2018-10-02T11:41:39Z")

</div>

i execute this query below, the datas are always formatted in such a way that a simple string comparison str1 \> str2 will return true if the actual date of str1 is larger then str2 \> { \> "query": { \> "bool"…

---

## [Multi Get API - POST equivalent?](https://discuss.elastic.co/t/multi-get-api-post-equivalent/150687)

<div class="topic-metadata">

**Author:** [@Ryan\_Jones](https://discuss.elastic.co/u/Ryan_Jones)\
**Replies:** 1\
**Last updated:** [October 2, 2018, 11:37am UTC](https://discuss.elastic.co/t/multi-get-api-post-equivalent/150687 "2018-10-02T11:37:37Z")

</div>

Hi, I want to use the Multi Get API, but can see that it uses the GET HTTP verb, yet takes in a body. Is there a POST equivalent to this API? I'm writing a Java-based application and using either a Jersey Client or Un…

---

## [Elastic search project completed](https://discuss.elastic.co/t/elastic-search-project-completed/150665)

<div class="topic-metadata">

**Author:** [@Adike\_Maduabuchi](https://discuss.elastic.co/u/Adike_Maduabuchi)\
**Replies:** 1\
**Last updated:** [October 2, 2018, 9:05am UTC](https://discuss.elastic.co/t/elastic-search-project-completed/150665 "2018-10-02T09:05:12Z")

</div>

My first project in my company was to build a search engine using elasticsearch on laravel platform. am happy that yesterday i wrapped up the full project and the site is raadaa.com , you can check it but we havent push…

---

## [Elasticsearch join datatype in java API](https://discuss.elastic.co/t/elasticsearch-join-datatype-in-java-api/150660)

<div class="topic-metadata">

**Author:** [@soi](https://discuss.elastic.co/u/soi)\
**Replies:** 0\
**Last updated:** [October 2, 2018, 8:38am UTC](https://discuss.elastic.co/t/elasticsearch-join-datatype-in-java-api/150660 "2018-10-02T08:38:02Z")

</div>

Hello, How could i use java API in elasticsearch \>= 5.6 to index document with parent/child relationship using join datatype. any example please ? Thank you

[Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1529)

[Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1531)
