# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1542 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1543 --- ## [Count is not same in kibana and pandas](https://discuss.elastic.co/t/count-is-not-same-in-kibana-and-pandas/149369)
**Author:** [@a3191](https://discuss.elastic.co/u/a3191)\ **Replies:** 0\ **Last updated:** [September 21, 2018, 12:39am UTC](https://discuss.elastic.co/t/count-is-not-same-in-kibana-and-pandas/149369 "2018-09-21T00:39:58Z")
I am getting data from elastic search to pandas using Search and scan method. My document count is in billions and millions. I noticed a weird thing. When I am matching the numbers in my pandas and kibana for the same ti… --- ## [Difficulty understanding dis\_max query using \_validate](https://discuss.elastic.co/t/difficulty-understanding-dis-max-query-using-validate/148880)
**Author:** [@keithag](https://discuss.elastic.co/u/keithag)\ **Replies:** 1\ **Last updated:** [September 21, 2018, 12:06am UTC](https://discuss.elastic.co/t/difficulty-understanding-dis-max-query-using-validate/148880 "2018-09-21T00:06:14Z")
To better understand dis\_max, I am using \_validate to review the Lucene syntax produced. However, the generated Lucene syntax appears to be incorrect. I've tried this with 6.4.0 and 6.1.2. Here is my corpus: PUT ind… --- ## [Aggregations over rescore](https://discuss.elastic.co/t/aggregations-over-rescore/148505)
**Author:** [@Brett\_Anderson](https://discuss.elastic.co/u/Brett_Anderson)\ **Replies:** 7\ **Last updated:** [September 20, 2018, 11:54pm UTC](https://discuss.elastic.co/t/aggregations-over-rescore/148505 "2018-09-20T23:54:11Z")
I'm using ES 5.6. It seems that the aggregations apply before the rescore is applied to the query. I say this because if you try to sort the buckets by a max "\_score" it uses the score from the main query and not the res… --- ## [How to return multiple inner hits in multiple nested sub-queries for the same path?](https://discuss.elastic.co/t/how-to-return-multiple-inner-hits-in-multiple-nested-sub-queries-for-the-same-path/149367)
**Author:** [@NewHere](https://discuss.elastic.co/u/NewHere)\ **Replies:** 0\ **Last updated:** [September 20, 2018, 10:34pm UTC](https://discuss.elastic.co/t/how-to-return-multiple-inner-hits-in-multiple-nested-sub-queries-for-the-same-path/149367 "2018-09-20T22:34:49Z")
When I have multiple nested sub-queries for the same path, it seems the result will only include the inner hits result of the last nested sub-query. Is there a way to return all of the inner hits results for the multiple… --- ## [ElasticSearch service shows "active running" but it's not listening on port 9200, and no logs are being written](https://discuss.elastic.co/t/elasticsearch-service-shows-active-running-but-its-not-listening-on-port-9200-and-no-logs-are-being-written/149288)
**Author:** [@nola111](https://discuss.elastic.co/u/nola111)\ **Replies:** 1\ **Last updated:** [September 20, 2018, 9:54pm UTC](https://discuss.elastic.co/t/elasticsearch-service-shows-active-running-but-its-not-listening-on-port-9200-and-no-logs-are-being-written/149288 "2018-09-20T21:54:20Z")
Ubuntu 16.04 with Elasticsearch 6.2.1 on a VM in Azure - a couple days ago I could not get the ElasticSearch service to start at all. I resolved the issue with help from a kind soul by increasing the heap size in the j… --- ## [Elasticsearch start failed when Path.data change in elasticsearch.yml](https://discuss.elastic.co/t/elasticsearch-start-failed-when-path-data-change-in-elasticsearch-yml/149218)
**Author:** [@phongddh](https://discuss.elastic.co/u/phongddh)\ **Replies:** 4\ **Last updated:** [September 20, 2018, 9:31pm UTC](https://discuss.elastic.co/t/elasticsearch-start-failed-when-path-data-change-in-elasticsearch-yml/149218 "2018-09-20T21:31:23Z")
I setup the elasticsearch 6.4.1 on CentOS machine and its works fine until i uncomment the "path.data: /var/www/STO-44/elasticsearch/" setting in elasticsearch.yml . Info: \[root@elk-fshare ~\]# ll /var/www/STO-44/ tot… --- ## [Dumping elastic data into csv or into any NOSQL through python](https://discuss.elastic.co/t/dumping-elastic-data-into-csv-or-into-any-nosql-through-python/146412)
**Author:** [@a3191](https://discuss.elastic.co/u/a3191)\ **Replies:** 2\ **Last updated:** [September 20, 2018, 8:00pm UTC](https://discuss.elastic.co/t/dumping-elastic-data-into-csv-or-into-any-nosql-through-python/146412 "2018-09-20T20:00:54Z")
As we know we can't fetch more than 10000 rows in python from elastic search because of connection error issue. I want data for two hours from my elastic clusterand for every 5 minutes, I am having approx 10000 observati… --- ## [Alerting on derivative](https://discuss.elastic.co/t/alerting-on-derivative/148765)
**Author:** [@torbjornkarlsson](https://discuss.elastic.co/u/torbjornkarlsson)\ **Replies:** 5\ **Last updated:** [September 20, 2018, 7:55pm UTC](https://discuss.elastic.co/t/alerting-on-derivative/148765 "2018-09-20T19:55:07Z")
Hi. It is fairly easy to create a visualization that shows spikes in number of requests (using derivative). But how do I go about to create a watcher that triggers on a big increase in number of requests? Ideally, we w… --- ## [Check for field's existence in script processor ingest node](https://discuss.elastic.co/t/check-for-fields-existence-in-script-processor-ingest-node/149171)
**Author:** [@meetdave2611997](https://discuss.elastic.co/u/meetdave2611997)\ **Replies:** 4\ **Last updated:** [September 20, 2018, 4:50pm UTC](https://discuss.elastic.co/t/check-for-fields-existence-in-script-processor-ingest-node/149171 "2018-09-20T16:50:35Z")
Hello, I am using ingest node for processing documents and I am using script processor for processing documents. Now my requirement is to check whether the field exists and based on existence process goes further. I am… --- ## [No More Logs After Enabling SSL and X-Pack](https://discuss.elastic.co/t/no-more-logs-after-enabling-ssl-and-x-pack/149161)
**Author:** [@tvoll](https://discuss.elastic.co/u/tvoll)\ **Replies:** 4\ **Last updated:** [September 20, 2018, 4:40pm UTC](https://discuss.elastic.co/t/no-more-logs-after-enabling-ssl-and-x-pack/149161 "2018-09-20T16:40:51Z")
Running the Elastic Stack on v6.3.2, recently got X-Pack, but am now having issues with authenticating logstash/filebeat with SSL. I've created a username and password for each of the services, but nothing is appearing i… --- ## [Issue when elasticsearch is reindexing](https://discuss.elastic.co/t/issue-when-elasticsearch-is-reindexing/149207)
**Author:** [@Sebastian\_Benavides](https://discuss.elastic.co/u/Sebastian_Benavides)\ **Replies:** 0\ **Last updated:** [September 20, 2018, 1:15am UTC](https://discuss.elastic.co/t/issue-when-elasticsearch-is-reindexing/149207 "2018-09-20T01:15:00Z")
Hi everybody. We have an issue with Elasticsearch 5. As long as we are reindexing we get these kind of errors, this is the stacktrace: // Searchkick::ImportError: {"type"=\>"index\_not\_found\_exception", "reason"=\>"no such… --- ## [\[6.3.0\] homebrew recipe](https://discuss.elastic.co/t/6-3-0-homebrew-recipe/136765)
**Author:** [@loren](https://discuss.elastic.co/u/loren)\ **Replies:** 12\ **Last updated:** [September 20, 2018, 2:56pm UTC](https://discuss.elastic.co/t/6-3-0-homebrew-recipe/136765 "2018-09-20T14:56:52Z")
I was surprised to see there was no homebrew recipe for 6.3.0 yet and no open PR so I set about creating a PR myself. I ran into some issues with brew audit --strict and, after some digging, found this is why there is no… --- ## [How to change HighLevel Client default timeout value?](https://discuss.elastic.co/t/how-to-change-highlevel-client-default-timeout-value/149315)
**Author:** [@varun1992](https://discuss.elastic.co/u/varun1992)\ **Replies:** 0\ **Last updated:** [September 20, 2018, 2:37pm UTC](https://discuss.elastic.co/t/how-to-change-highlevel-client-default-timeout-value/149315 "2018-09-20T14:37:33Z")
I initialised client in java as below RestHighLevelClient client = new RestHighLevelClient( RestClient.builder( new HttpHost("localhost", 9200, "http"), new HttpHost("localhost", … --- ## [Sum aggregation on nested query](https://discuss.elastic.co/t/sum-aggregation-on-nested-query/149093)
**Author:** [@kardagan](https://discuss.elastic.co/u/kardagan)\ **Replies:** 1\ **Last updated:** [September 20, 2018, 2:00pm UTC](https://discuss.elastic.co/t/sum-aggregation-on-nested-query/149093 "2018-09-20T14:00:30Z")
Hello, In my database I have products, each products have differents offers and offers have sales. A sale is defined by a sale datetime and a nb (number of sales for de date) I have to get produts and offers who have … --- ## [Crashing Suspect Garbage Compiler](https://discuss.elastic.co/t/crashing-suspect-garbage-compiler/149300)
**Author:** [@kurtiskurtis](https://discuss.elastic.co/u/kurtiskurtis)\ **Replies:** 0\ **Last updated:** [September 20, 2018, 1:32pm UTC](https://discuss.elastic.co/t/crashing-suspect-garbage-compiler/149300 "2018-09-20T13:32:19Z")
Every few days, my cluster gets into a bad state where a few of the nodes are disconnected (seems like the master removes them). Right at the same time they are removed, the node shows this in their logs: \[2018-09-20T0… --- ## [Rejected Execution exception](https://discuss.elastic.co/t/rejected-execution-exception/149084)
**Author:** [@Giuseppe\_Merlo](https://discuss.elastic.co/u/Giuseppe_Merlo)\ **Replies:** 2\ **Last updated:** [September 20, 2018, 1:06pm UTC](https://discuss.elastic.co/t/rejected-execution-exception/149084 "2018-09-20T13:06:29Z")
Hi everyone. I'm using ES in a development system and i've got this error using a search request. I tried to change queue\_size from 1000 to 10000 but this didn't work: Trace: \[es\_rejected\_execution\_exception\] rejected… --- ## [Elasticsearch refuses to run](https://discuss.elastic.co/t/elasticsearch-refuses-to-run/148945)
**Author:** [@adrwer](https://discuss.elastic.co/u/adrwer)\ **Replies:** 21\ **Last updated:** [September 20, 2018, 12:34pm UTC](https://discuss.elastic.co/t/elasticsearch-refuses-to-run/148945 "2018-09-20T12:34:32Z")
I've installed the .tar.gz package on a Rhel7.5 instance on Amazon Web Services with a RAM of 1GB and volume of 10GB but when I run it with this command "./bin/elasticsearch" I get this error despite reducing the heap si… --- ## [Restoring snapshots to a new system](https://discuss.elastic.co/t/restoring-snapshots-to-a-new-system/149030)
**Author:** [@mishaua](https://discuss.elastic.co/u/mishaua)\ **Replies:** 1\ **Last updated:** [September 20, 2018, 12:20pm UTC](https://discuss.elastic.co/t/restoring-snapshots-to-a-new-system/149030 "2018-09-20T12:20:36Z")
hello with snaphsots, if you have a curl job to backup daily, if you need to restore to a new system, will you need to restore every daily snapshot individually? --- ## [How to log all search request to es](https://discuss.elastic.co/t/how-to-log-all-search-request-to-es/149005)
**Author:** [@wangqinghuan](https://discuss.elastic.co/u/wangqinghuan)\ **Replies:** 1\ **Last updated:** [September 20, 2018, 12:19pm UTC](https://discuss.elastic.co/t/how-to-log-all-search-request-to-es/149005 "2018-09-20T12:19:26Z")
hi , i want to record all elasticsearch access log contains request body so that i can find those incorrect request. Does elasticsearch have any support? --- ## [Add single quotation to curl xpost in shell script](https://discuss.elastic.co/t/add-single-quotation-to-curl-xpost-in-shell-script/149034)
**Author:** [@nayun\_oh](https://discuss.elastic.co/u/nayun_oh)\ **Replies:** 1\ **Last updated:** [September 20, 2018, 12:18pm UTC](https://discuss.elastic.co/t/add-single-quotation-to-curl-xpost-in-shell-script/149034 "2018-09-20T12:18:10Z")
I add this code in my shell script. But every time I add single quotation in painless( 'hello' ) It keeps giving me errors. I don't know what is wrong with my code. I hope you will be able to help with this. Thank you … --- ## [Finding out what change triggered the non-noop in an update?](https://discuss.elastic.co/t/finding-out-what-change-triggered-the-non-noop-in-an-update/148679)
**Author:** [@TimHeckel](https://discuss.elastic.co/u/TimHeckel)\ **Replies:** 1\ **Last updated:** [September 20, 2018, 12:14pm UTC](https://discuss.elastic.co/t/finding-out-what-change-triggered-the-non-noop-in-an-update/148679 "2018-09-20T12:14:33Z")
Hi all -- I was quite happy when the noop flag was introduced in ES 5. I'm wondering if there are any plans to surface not only whether the action was a noop, but in the cases where noop: false, also surface what data ch… --- ## [Index creates in different timezone other than UTC?](https://discuss.elastic.co/t/index-creates-in-different-timezone-other-than-utc/148941)
**Author:** [@af615dbd55cac2cacf32](https://discuss.elastic.co/u/af615dbd55cac2cacf32)\ **Replies:** 10\ **Last updated:** [September 20, 2018, 12:12pm UTC](https://discuss.elastic.co/t/index-creates-in-different-timezone-other-than-utc/148941 "2018-09-20T12:12:43Z")
Hello, My ELK servers are located in Asia/Seoul timezone which is GMT+9:00. Elasticsearch creates indices on a daily basis, but the indices are created at 9AM (instead of 12AM) due to timezone difference. I know Kiban… --- ## [How to compute average search request cost time through indices stats api](https://discuss.elastic.co/t/how-to-compute-average-search-request-cost-time-through-indices-stats-api/149285)
**Author:** [@Integret](https://discuss.elastic.co/u/Integret)\ **Replies:** 0\ **Last updated:** [September 20, 2018, 12:04pm UTC](https://discuss.elastic.co/t/how-to-compute-average-search-request-cost-time-through-indices-stats-api/149285 "2018-09-20T12:04:28Z")
i call the /{index}/\_stats/ interface two times, and try to compute average search cost time use: （total.search.query\_time\_in\_millis 2 - total.search.query\_time\_in\_millis 1）/ ( total.search.query\_total 2 - total.search.… --- ## [Bulkindex in elasticsearch(facing exception heap size out of memory)](https://discuss.elastic.co/t/bulkindex-in-elasticsearch-facing-exception-heap-size-out-of-memory/149270)
**Author:** [@johnrabi](https://discuss.elastic.co/u/johnrabi)\ **Replies:** 0\ **Last updated:** [September 20, 2018, 10:27am UTC](https://discuss.elastic.co/t/bulkindex-in-elasticsearch-facing-exception-heap-size-out-of-memory/149270 "2018-09-20T10:27:15Z")
hi , can anyone help me how to resolve this issue ? My Es version: 5.6.2 I am using JestClient for connecting es language: java I am having the list of datas (like 10000 ) how to write bulk index API facing exceptio… --- ## [GetMappings API using Java High Level Rest Client not working](https://discuss.elastic.co/t/getmappings-api-using-java-high-level-rest-client-not-working/147336)
**Author:** [@rimalk](https://discuss.elastic.co/u/rimalk)\ **Replies:** 2\ **Last updated:** [September 20, 2018, 11:53am UTC](https://discuss.elastic.co/t/getmappings-api-using-java-high-level-rest-client-not-working/147336 "2018-09-20T11:53:07Z")
Hi, I am not able to execute the GetMappings request using the Java High Level Rest Client. I am getting an error Exception in thread "main" ElasticsearchStatusException\[Elasticsearch exception \[type=illegal\_argument\_… --- ## [Inconsistent newlines in watcher email body text](https://discuss.elastic.co/t/inconsistent-newlines-in-watcher-email-body-text/148668)
**Author:** [@jgburks](https://discuss.elastic.co/u/jgburks)\ **Replies:** 2\ **Last updated:** [September 20, 2018, 11:40am UTC](https://discuss.elastic.co/t/inconsistent-newlines-in-watcher-email-body-text/148668 "2018-09-20T11:40:36Z")
I'm using this Watcher code to send myself emails: "body": { "text": "{{#ctx.payload.hits.hits}}{{\_source.@timestamp}} {{\_source.message}}\\n{{/ctx.payload.hits.hits}}" But I don't get a newline in the email b… --- ## [Webhook action in watcher to use environment variables](https://discuss.elastic.co/t/webhook-action-in-watcher-to-use-environment-variables/148790)
**Author:** [@vinodkannan](https://discuss.elastic.co/u/vinodkannan)\ **Replies:** 3\ **Last updated:** [September 20, 2018, 11:38am UTC](https://discuss.elastic.co/t/webhook-action-in-watcher-to-use-environment-variables/148790 "2018-09-20T11:38:52Z")
Hi, This is the webhook action I am using: "actions" : { "web-post" : { "webhook": { "method" : "POST", "host": "x.x.x.x", "port": 8090, "path": ":/notification", "headers": { "Content-Type": "application/json" … --- ## [Query for counting docs in all indices](https://discuss.elastic.co/t/query-for-counting-docs-in-all-indices/149236)
**Author:** [@kumpelblase](https://discuss.elastic.co/u/kumpelblase)\ **Replies:** 8\ **Last updated:** [September 20, 2018, 10:59am UTC](https://discuss.elastic.co/t/query-for-counting-docs-in-all-indices/149236 "2018-09-20T10:59:23Z")
I need a query that counts all docs in all indices. I have found and read the \_count API, but GET /\_all/\_count for example only gives the number of documents in all indices together. If I substitude \_all with an index n… --- ## [GC Collector Error shut down ingest node](https://discuss.elastic.co/t/gc-collector-error-shut-down-ingest-node/149115)
**Author:** [@Emiliano\_Baum](https://discuss.elastic.co/u/Emiliano_Baum)\ **Replies:** 2\ **Last updated:** [September 20, 2018, 10:57am UTC](https://discuss.elastic.co/t/gc-collector-error-shut-down-ingest-node/149115 "2018-09-20T10:57:59Z")
The elastic service shut down when the log report the following error. I use ES 5.6, over Ubuntu server 16.04. The cluster have 10 nodes, two of this are ingestion nodes, and one of this have the problem. this is the… --- ## [Elastic search cluster setup suggestion required](https://discuss.elastic.co/t/elastic-search-cluster-setup-suggestion-required/149258)
**Author:** [@pokaleshrey](https://discuss.elastic.co/u/pokaleshrey)\ **Replies:** 8\ **Last updated:** [September 20, 2018, 10:40am UTC](https://discuss.elastic.co/t/elastic-search-cluster-setup-suggestion-required/149258 "2018-09-20T10:40:34Z")
Hi, I have a cluster setup of 2 data nodes and 1 master node. One eligible master. I handle about 400Gb of data. All our search requests and indexing requests are made to the master node. This caused some RAM issues … [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1541) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1543)