# Elasticsearch

**URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1540

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 1541

---

## [Duplicate Xms and Xms values for Elasticsearch with Docker](https://discuss.elastic.co/t/duplicate-xms-and-xms-values-for-elasticsearch-with-docker/149590)

<div class="topic-metadata">

**Author:** [@Hari\_Prasad](https://discuss.elastic.co/u/Hari_Prasad)\
**Replies:** 0\
**Last updated:** [September 23, 2018, 12:38pm UTC](https://discuss.elastic.co/t/duplicate-xms-and-xms-values-for-elasticsearch-with-docker/149590 "2018-09-23T12:38:20Z")

</div>

I have setup the ELK stack with Docker and I am using the 6.4.0 version of the same, with Docker version 18.06.0-ce, build 0ffa825. The docker compose file for the Elasticsearch is elasticsearch: image: docker.elastic.…

---

## [Elasticsearch and GDPR](https://discuss.elastic.co/t/elasticsearch-and-gdpr/149548)

<div class="topic-metadata">

**Author:** [@arvesen](https://discuss.elastic.co/u/arvesen)\
**Replies:** 0\
**Last updated:** [September 22, 2018, 1:40pm UTC](https://discuss.elastic.co/t/elasticsearch-and-gdpr/149548 "2018-09-22T13:40:02Z")

</div>

Hi! A little while ago, a potential issue of Elasticsearch (primarilty when used as a primary data store – which you shouldn't do) and the GDPR occured to me. I recently wrote a blog post about the subject, but the gis…

---

## [Machine learning (what are free features)](https://discuss.elastic.co/t/machine-learning-what-are-free-features/149566)

<div class="topic-metadata">

**Author:** [@clickstream](https://discuss.elastic.co/u/clickstream)\
**Replies:** 5\
**Last updated:** [September 23, 2018, 8:26am UTC](https://discuss.elastic.co/t/machine-learning-what-are-free-features/149566 "2018-09-23T08:26:46Z")

</div>

Hi guys i wanted to ask if i install free versions of Elasticsearch and Kibana, will the machine learning functions be available on my Kibana dashboard under job creating. Thanks!

---

## [One or more replica shards open many files](https://discuss.elastic.co/t/one-or-more-replica-shards-open-many-files/149577)

<div class="topic-metadata">

**Author:** [@Jozsef\_Basa](https://discuss.elastic.co/u/Jozsef_Basa)\
**Replies:** 0\
**Last updated:** [September 23, 2018, 8:06am UTC](https://discuss.elastic.co/t/one-or-more-replica-shards-open-many-files/149577 "2018-09-23T08:06:42Z")

</div>

Hi I have a 5 node ES (6.2.2) cluster for monitoring the performance of around 15 applications. The indices feed by logstash. I have a daily indices of each application. One of the indices (4 primary + 1 replica) which …

---

## [Newbie question on how to structure elasticsearch index](https://discuss.elastic.co/t/newbie-question-on-how-to-structure-elasticsearch-index/149546)

<div class="topic-metadata">

**Author:** [@charlesg99](https://discuss.elastic.co/u/charlesg99)\
**Replies:** 3\
**Last updated:** [September 23, 2018, 3:11am UTC](https://discuss.elastic.co/t/newbie-question-on-how-to-structure-elasticsearch-index/149546 "2018-09-23T03:11:33Z")

</div>

Hi, I'm trying to replace mysql fulltext search with elasticsearch in my application, but I'm not sure how to optimally design my data structure(s) and perform the searches. Right now, all of my data is in a single elast…

---

## [Filebeat/Logstash and duplicate indexes](https://discuss.elastic.co/t/filebeat-logstash-and-duplicate-indexes/149334)

<div class="topic-metadata">

**Author:** [@0a118576f418da54acef](https://discuss.elastic.co/u/0a118576f418da54acef)\
**Replies:** 1\
**Last updated:** [September 22, 2018, 7:02pm UTC](https://discuss.elastic.co/t/filebeat-logstash-and-duplicate-indexes/149334 "2018-09-22T19:02:52Z")

</div>

Hi all Question about Log stash and filebeat , at my work I sync or copy Apache log file from amazon S3 bucket (but the issue is the same if i add data to the local file manually ), this step is with filebeat that tran…

---

## [How to keep relations between fields, when using stored fields and Fields query?](https://discuss.elastic.co/t/how-to-keep-relations-between-fields-when-using-stored-fields-and-fields-query/149558)

<div class="topic-metadata">

**Author:** [@JF2018](https://discuss.elastic.co/u/JF2018)\
**Replies:** 0\
**Last updated:** [September 22, 2018, 4:36pm UTC](https://discuss.elastic.co/t/how-to-keep-relations-between-fields-when-using-stored-fields-and-fields-query/149558 "2018-09-22T16:36:00Z")

</div>

Hi I have a large document, where I only wish to retrieve a couple of the fields. The solution I have found to this problem, is to use stored fields. I know \_source filtering is a possibility, but this is very slow, s…

---

## [Need Help to parse specific Log format](https://discuss.elastic.co/t/need-help-to-parse-specific-log-format/149469)

<div class="topic-metadata">

**Author:** [@Tdannhausen](https://discuss.elastic.co/u/Tdannhausen)\
**Replies:** 3\
**Last updated:** [September 22, 2018, 4:11pm UTC](https://discuss.elastic.co/t/need-help-to-parse-specific-log-format/149469 "2018-09-22T16:11:47Z")

</div>

Hi, I could use some help. I need to parse a specific log format. It looks like this: {"properties":{"columns":\["time","v0"\],"db":"default","vs":"/Common/Test\_10+/Common/BaDOS","metric":"base.conns","sample\_rate":"1000…

---

## [Facing exception while connecting to Es .. (org.apache.http.conn.ConnectTimeoutException)](https://discuss.elastic.co/t/facing-exception-while-connecting-to-es-org-apache-http-conn-connecttimeoutexception/149540)

<div class="topic-metadata">

**Author:** [@johnrabi](https://discuss.elastic.co/u/johnrabi)\
**Replies:** 0\
**Last updated:** [September 22, 2018, 11:01am UTC](https://discuss.elastic.co/t/facing-exception-while-connecting-to-es-org-apache-http-conn-connecttimeoutexception/149540 "2018-09-22T11:01:14Z")

</div>

Hi, can anyone help me how to resolve this issue? i am connecting es through jsetclient ..facing exception like org.apache.http.conn.ConnectTimeoutException: Connect to 47.147.206.52:14001 failed: connect timed out C…

---

## [Unequal Shard sizes within an index](https://discuss.elastic.co/t/unequal-shard-sizes-within-an-index/149464)

<div class="topic-metadata">

**Author:** [@ekamberchadda](https://discuss.elastic.co/u/ekamberchadda)\
**Replies:** 0\
**Last updated:** [September 21, 2018, 1:21pm UTC](https://discuss.elastic.co/t/unequal-shard-sizes-within-an-index/149464 "2018-09-21T13:21:14Z")

</div>

Observed highly unequal shard sizes within an index. Not using any custom routing. Specifications: elastic search version: 6.2.2 java: 1.8.0\_181 operating system: Centos 7.3.1611 CPU per host: 8 Ram: 64 gb JVM …

---

## [Return an collection of unique values by id](https://discuss.elastic.co/t/return-an-collection-of-unique-values-by-id/149534)

<div class="topic-metadata">

**Author:** [@Baikal\_Irkutsk](https://discuss.elastic.co/u/Baikal_Irkutsk)\
**Replies:** 0\
**Last updated:** [September 22, 2018, 8:21am UTC](https://discuss.elastic.co/t/return-an-collection-of-unique-values-by-id/149534 "2018-09-22T08:21:37Z")

</div>

Hello everyone. This is my question. I have search functionality on my online shop. When users search some products, I'd like to collect all available characteristics values of search results and give my users opportu…

---

## [Datatype accidentally changed from keyword to text](https://discuss.elastic.co/t/datatype-accidentally-changed-from-keyword-to-text/149220)

<div class="topic-metadata">

**Author:** [@hiwjd](https://discuss.elastic.co/u/hiwjd)\
**Replies:** 2\
**Last updated:** [September 22, 2018, 6:55am UTC](https://discuss.elastic.co/t/datatype-accidentally-changed-from-keyword-to-text/149220 "2018-09-22T06:55:42Z")

</div>

hi there. here is my issue. i init a index with field attrs which its datatype is keyword. but the datatype of attrs will accidentally be changed to text. here is the initial datatype from Get Mapping API: { album…

---

## [Missing data from replica shards after delete by query and index](https://discuss.elastic.co/t/missing-data-from-replica-shards-after-delete-by-query-and-index/149402)

<div class="topic-metadata">

**Author:** [@ashokm](https://discuss.elastic.co/u/ashokm)\
**Replies:** 5\
**Last updated:** [September 22, 2018, 6:43am UTC](https://discuss.elastic.co/t/missing-data-from-replica-shards-after-delete-by-query-and-index/149402 "2018-09-22T06:43:03Z")

</div>

Hi All, We are on ES 2.4.4. We are using delete by query to delete all docs of given type in an index using delete by query. Immediately, we index the data again. Sometimes, doc count on replica is less than primary. I…

---

## [Integrating elastic search with existing spring boot application](https://discuss.elastic.co/t/integrating-elastic-search-with-existing-spring-boot-application/149463)

<div class="topic-metadata">

**Author:** [@mohabshihab](https://discuss.elastic.co/u/mohabshihab)\
**Replies:** 4\
**Last updated:** [September 22, 2018, 4:14am UTC](https://discuss.elastic.co/t/integrating-elastic-search-with-existing-spring-boot-application/149463 "2018-09-22T04:14:10Z")

</div>

I have an under development springboot application and need to use elastic search for items search for items search I am using spring data elastic search repository implementation my question is what's the best practic…

---

## [How to search one certain field's value with not unique results](https://discuss.elastic.co/t/how-to-search-one-certain-fields-value-with-not-unique-results/149531)

<div class="topic-metadata">

**Author:** [@jamesjin](https://discuss.elastic.co/u/jamesjin)\
**Replies:** 0\
**Last updated:** [September 22, 2018, 4:11am UTC](https://discuss.elastic.co/t/how-to-search-one-certain-fields-value-with-not-unique-results/149531 "2018-09-22T04:11:49Z")

</div>

Hi, Need some advise. I have indexed documents in elasticsearch, now i want to search all results with one certain field value with all related document, like following if i search for reportId=12345, the results will …

---

## [Check elasticsearch running on web like on windows](https://discuss.elastic.co/t/check-elasticsearch-running-on-web-like-on-windows/148948)

<div class="topic-metadata">

**Author:** [@mejuliver](https://discuss.elastic.co/u/mejuliver)\
**Replies:** 1\
**Last updated:** [September 21, 2018, 10:50pm UTC](https://discuss.elastic.co/t/check-elasticsearch-running-on-web-like-on-windows/148948 "2018-09-21T22:50:34Z")

</div>

in windows, elasticsearch frontend can be acces using http://localhost:9200 how about if I installed it unto my server, how can I check the elasticsearch frontend if its working, should it be https://domain.com:9200?

---

## [Paging through data](https://discuss.elastic.co/t/paging-through-data/148840)

<div class="topic-metadata">

**Author:** [@grant\_donovan](https://discuss.elastic.co/u/grant_donovan)\
**Replies:** 1\
**Last updated:** [September 21, 2018, 10:45pm UTC](https://discuss.elastic.co/t/paging-through-data/148840 "2018-09-21T22:45:43Z")

</div>

I have what I thought was a simple requirement, but am now stumped. In some cases users call our data and ingest into their own systems, normally we do something like this The url that calls our application may say som…

---

## [Restarting a Single Node in a Cluster Always Forces a Reallocation](https://discuss.elastic.co/t/restarting-a-single-node-in-a-cluster-always-forces-a-reallocation/149366)

<div class="topic-metadata">

**Author:** [@zuhana2018](https://discuss.elastic.co/u/zuhana2018)\
**Replies:** 1\
**Last updated:** [September 21, 2018, 10:38pm UTC](https://discuss.elastic.co/t/restarting-a-single-node-in-a-cluster-always-forces-a-reallocation/149366 "2018-09-21T22:38:22Z")

</div>

Question An ES 6.4 node restart does not persist the UUID and causes shard reallocations & sync's when the node rejoins the cluster. The is there another configuration other than path.data that need to be set to persist…

---

## [Unable to install elasticsearch-plugin](https://discuss.elastic.co/t/unable-to-install-elasticsearch-plugin/149379)

<div class="topic-metadata">

**Author:** [@fpervil](https://discuss.elastic.co/u/fpervil)\
**Replies:** 4\
**Last updated:** [September 21, 2018, 10:17pm UTC](https://discuss.elastic.co/t/unable-to-install-elasticsearch-plugin/149379 "2018-09-21T22:17:41Z")

</div>

When I tried to perform a elasticsearch-plugin install ingest-geoip, I get the following error: Exception in thread "main" javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path buildi…

---

## [Shards are not allocating to available node](https://discuss.elastic.co/t/shards-are-not-allocating-to-available-node/149487)

<div class="topic-metadata">

**Author:** [@Francisco\_Correia](https://discuss.elastic.co/u/Francisco_Correia)\
**Replies:** 1\
**Last updated:** [September 21, 2018, 9:47pm UTC](https://discuss.elastic.co/t/shards-are-not-allocating-to-available-node/149487 "2018-09-21T21:47:08Z")

</div>

Hi, I'm running an 1 node elastic search version 6.2.1 and I'm getting an error with several indexes that fails to be allocated. $ curl -s 'http://localhost:9200/\_cluster/health?pretty' { "cluster\_name": "docker-c…

---

## [Automatically restore LATEST Snapshot during Launch](https://discuss.elastic.co/t/automatically-restore-latest-snapshot-during-launch/149516)

<div class="topic-metadata">

**Author:** [@titan1978](https://discuss.elastic.co/u/titan1978)\
**Replies:** 0\
**Last updated:** [September 21, 2018, 8:31pm UTC](https://discuss.elastic.co/t/automatically-restore-latest-snapshot-during-launch/149516 "2018-09-21T20:31:54Z")

</div>

I'm trying to figure out the best way to automatically restore the LATEST snapshot when ElasticSearch is launching (on AWS). I have hundreds of snapshots - each snapshot taken daily. The Intent is to figure out which w…

---

## [Log files not being written out on data nodes](https://discuss.elastic.co/t/log-files-not-being-written-out-on-data-nodes/149512)

<div class="topic-metadata">

**Author:** [@kwstx14](https://discuss.elastic.co/u/kwstx14)\
**Replies:** 0\
**Last updated:** [September 21, 2018, 7:55pm UTC](https://discuss.elastic.co/t/log-files-not-being-written-out-on-data-nodes/149512 "2018-09-21T19:55:31Z")

</div>

I have an Elasticsearch cluster running v5.2.0. The master and query servers in the cluster are happily writing out logs, but the data servers haven't written any logs in at least 5 months. logging.yml and log4j2.propert…

---

## [How to search for a first occurrence of a term](https://discuss.elastic.co/t/how-to-search-for-a-first-occurrence-of-a-term/149426)

<div class="topic-metadata">

**Author:** [@caub](https://discuss.elastic.co/u/caub)\
**Replies:** 4\
**Last updated:** [September 21, 2018, 6:19pm UTC](https://discuss.elastic.co/t/how-to-search-for-a-first-occurrence-of-a-term/149426 "2018-09-21T18:19:41Z")

</div>

I'd like to search in the last 5 minutes, for values in the err\_msg field that occured for the first time ever. And repeat this search every 5 minutes, so it should be as efficient as possible I wonder how to shape this…

---

## [Timelion Sheets Maximum Number](https://discuss.elastic.co/t/timelion-sheets-maximum-number/149501)

<div class="topic-metadata">

**Author:** [@xbmotsai](https://discuss.elastic.co/u/xbmotsai)\
**Replies:** 0\
**Last updated:** [September 21, 2018, 6:17pm UTC](https://discuss.elastic.co/t/timelion-sheets-maximum-number/149501 "2018-09-21T18:17:20Z")

</div>

Hello All, I am using Timelion to plot values coming from LoRa nodes in the wild. It works great! But I think I found a bug with the sheet browser. I am now with over 100 sheets (we have way more than 100 nodes) and wh…

---

## [Help with index template format for date with 6 millis](https://discuss.elastic.co/t/help-with-index-template-format-for-date-with-6-millis/149450)

<div class="topic-metadata">

**Author:** [@reswob](https://discuss.elastic.co/u/reswob)\
**Replies:** 3\
**Last updated:** [September 21, 2018, 5:41pm UTC](https://discuss.elastic.co/t/help-with-index-template-format-for-date-with-6-millis/149450 "2018-09-21T17:41:36Z")

</div>

I have a time field that has dates like: 2018-09-21T08:10:22.441223-0400 and I tried to create my template with the following: "format" : "YYYY-MM-dd'T'HH:mm:ss.SSSSSS-Z" "format" : "YYYY-MM-ddTHH:mm:ss.SSSSSS-Z" "f…

---

## [Yet another multiple type issue in ES 6.X. I am stumped](https://discuss.elastic.co/t/yet-another-multiple-type-issue-in-es-6-x-i-am-stumped/149477)

<div class="topic-metadata">

**Author:** [@rouble](https://discuss.elastic.co/u/rouble)\
**Replies:** 4\
**Last updated:** [September 21, 2018, 5:22pm UTC](https://discuss.elastic.co/t/yet-another-multiple-type-issue-in-es-6-x-i-am-stumped/149477 "2018-09-21T17:22:02Z")

</div>

Gurus, I am recreating some work originally done in ES 5.X and I am hitting the multiple type issue. The original work can be found in github here. For some reason, and I cant explain why, when inserting entries they ge…

---

## [Is it ever ok to set ES's heap to \> 50% RAM?](https://discuss.elastic.co/t/is-it-ever-ok-to-set-ess-heap-to-50-ram/149019)

<div class="topic-metadata">

**Author:** [@martiansnoop](https://discuss.elastic.co/u/martiansnoop)\
**Replies:** 2\
**Last updated:** [September 21, 2018, 5:20pm UTC](https://discuss.elastic.co/t/is-it-ever-ok-to-set-ess-heap-to-50-ram/149019 "2018-09-21T17:20:09Z")

</div>

I'm trying to learn some rules of thumb for when or if it's ever ok to increase min and max heap values for ES to \> 50% of physical memory. This page recommends setting min and max heap to the same value, and setting bo…

---

## [Migrating from Elasticsearch 2 to 6](https://discuss.elastic.co/t/migrating-from-elasticsearch-2-to-6/149494)

<div class="topic-metadata">

**Author:** [@ApolloX](https://discuss.elastic.co/u/ApolloX)\
**Replies:** 0\
**Last updated:** [September 21, 2018, 5:06pm UTC](https://discuss.elastic.co/t/migrating-from-elasticsearch-2-to-6/149494 "2018-09-21T17:06:26Z")

</div>

I'm in the process of migrating an application from 2.4.6 server to a 6.3.2 server. I have a Java process that currently indexes data on the 2.4.6 server using the Shield plugin for authentication. As part of the migra…

---

## [Insert object to nested array](https://discuss.elastic.co/t/insert-object-to-nested-array/149491)

<div class="topic-metadata">

**Author:** [@Martin\_Blaustein](https://discuss.elastic.co/u/Martin_Blaustein)\
**Replies:** 0\
**Last updated:** [September 21, 2018, 4:47pm UTC](https://discuss.elastic.co/t/insert-object-to-nested-array/149491 "2018-09-21T16:47:34Z")

</div>

I'm trying to insert an object to a nested array through the java api, but I get the following error MapperParsingException\[object mapping for \[X\] tried to parse field \[null\] as object, but found a concrete value\] doin…

---

## [Need help with trimming trail spaces](https://discuss.elastic.co/t/need-help-with-trimming-trail-spaces/149480)

<div class="topic-metadata">

**Author:** [@kiran1](https://discuss.elastic.co/u/kiran1)\
**Replies:** 1\
**Last updated:** [September 21, 2018, 4:09pm UTC](https://discuss.elastic.co/t/need-help-with-trimming-trail-spaces/149480 "2018-09-21T16:09:05Z")

</div>

Hi All, i have the following log pattern \[20/Sep/2018:16:20:49 -0400\] 00.000.000.000 "GET /XXXXX-XXXXX-XXXX/health HTTP/1.1" 200 (1 ms) 0 I am using the following grok pattern @parse @type grok \[%{DATA:time}\] %{IP…

[Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1539)

[Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1541)
