# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1546 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1547 --- ## [Transform datetime to string](https://discuss.elastic.co/t/transform-datetime-to-string/148822)
**Author:** [@jakn](https://discuss.elastic.co/u/jakn)\ **Replies:** 1\ **Last updated:** [September 17, 2018, 12:45pm UTC](https://discuss.elastic.co/t/transform-datetime-to-string/148822 "2018-09-17T12:45:03Z")
I use the following transform in a watcher "transform": { "script": { "source": "return \[ 'time\_triggered': Instant.ofEpochMilli(ctx.trigger.triggered\_time.getMillis()).atZone(ZoneId.of('Europe/Copenhagen')) \]… --- ## [Inconsistent newlines in email body text](https://discuss.elastic.co/t/inconsistent-newlines-in-email-body-text/148681)
**Author:** [@jgburks](https://discuss.elastic.co/u/jgburks)\ **Replies:** 2\ **Last updated:** [September 17, 2018, 12:29pm UTC](https://discuss.elastic.co/t/inconsistent-newlines-in-email-body-text/148681 "2018-09-17T12:29:58Z")
I'm using this Watcher code to send myself emails: "body": { "text": "{{#ctx.payload.hits.hits}}{{\_source.@timestamp}} {{\_source.message}}\\n{{/ctx.payload.hits.hits}}" But I don't get a newline in the email body bet… --- ## [Is it possible to use rescoring within a bool query?](https://discuss.elastic.co/t/is-it-possible-to-use-rescoring-within-a-bool-query/148829)
**Author:** [@cads](https://discuss.elastic.co/u/cads)\ **Replies:** 0\ **Last updated:** [September 17, 2018, 12:06pm UTC](https://discuss.elastic.co/t/is-it-possible-to-use-rescoring-within-a-bool-query/148829 "2018-09-17T12:06:35Z")
This is what I attempted to do, but I receive the following error in line 31: \[multi\_match\] malformed query, expected \[END\_OBJECT\] but found \[FIELD\_NAME\] Obviously, "rescore" is interpreted as a field name. How to do … --- ## [SQL Query special chars](https://discuss.elastic.co/t/sql-query-special-chars/148595)
**Author:** [@kumpelblase](https://discuss.elastic.co/u/kumpelblase)\ **Replies:** 1\ **Last updated:** [September 17, 2018, 11:49am UTC](https://discuss.elastic.co/t/sql-query-special-chars/148595 "2018-09-17T11:49:08Z")
Hi there I have a index called "index-460". When I do SQL query request like: POST \_xpack/sql { "query":"DESCRIBE index-460" } I get the response: { "error": { "root\_cause": \[ { "typ… --- ## [Create multiple indexes while pushing data from filebeat to elasticsearch](https://discuss.elastic.co/t/create-multiple-indexes-while-pushing-data-from-filebeat-to-elasticsearch/148649)
**Author:** [@souravtyson](https://discuss.elastic.co/u/souravtyson)\ **Replies:** 4\ **Last updated:** [September 17, 2018, 11:02am UTC](https://discuss.elastic.co/t/create-multiple-indexes-while-pushing-data-from-filebeat-to-elasticsearch/148649 "2018-09-17T11:02:04Z")
Hi team, I am trying to push the nginx logs using filebeat to elasticsearch. I wanted to created multiple indexes based on data logged in my file. For example : i have a field of response time that gets logged into th… --- ## [Fetching only matching fields from a nested field](https://discuss.elastic.co/t/fetching-only-matching-fields-from-a-nested-field/148825)
**Author:** [@mohit1](https://discuss.elastic.co/u/mohit1)\ **Replies:** 0\ **Last updated:** [September 17, 2018, 11:46am UTC](https://discuss.elastic.co/t/fetching-only-matching-fields-from-a-nested-field/148825 "2018-09-17T11:46:20Z")
Hi have a nested field with many fields and when i am querying it,it is returning all the fields even if it matches one, my query is as follows nested": { "path": "rooms", "query": { "bool": { "must": \[ { "range":… --- ## [Can't reach Rally Target throughput](https://discuss.elastic.co/t/cant-reach-rally-target-throughput/148612)
**Author:** [@Sunil\_pandith](https://discuss.elastic.co/u/Sunil_pandith)\ **Replies:** 7\ **Last updated:** [September 17, 2018, 11:23am UTC](https://discuss.elastic.co/t/cant-reach-rally-target-throughput/148612 "2018-09-17T11:23:39Z")
Hi, I have a 4 node cluster setup. I'm benchmarking the setup using Rally. I have set the no. of "client" for a search operation in "track.json" to 12 with "target-throughput" of 2500. But the rally reported that it has… --- ## [How to aggregate over 'ip' field using script](https://discuss.elastic.co/t/how-to-aggregate-over-ip-field-using-script/148817)
**Author:** [@sayali\_hinge](https://discuss.elastic.co/u/sayali_hinge)\ **Replies:** 0\ **Last updated:** [September 17, 2018, 11:07am UTC](https://discuss.elastic.co/t/how-to-aggregate-over-ip-field-using-script/148817 "2018-09-17T11:07:26Z")
I am trying to perform terms aggregation over a field of type 'ip' using inline script like this : \> { "aggs":{ "by\_ipaddress":{ "terms":{ "script" : { "inline" : "doc\['ipAddressFrom'\].value", … --- ## [Problems with role based access: x\_content\_parse\_exception](https://discuss.elastic.co/t/problems-with-role-based-access-x-content-parse-exception/148796)
**Author:** [@ea1987](https://discuss.elastic.co/u/ea1987)\ **Replies:** 4\ **Last updated:** [September 17, 2018, 10:52am UTC](https://discuss.elastic.co/t/problems-with-role-based-access-x-content-parse-exception/148796 "2018-09-17T10:52:49Z")
Hi guys, I'm facing a strange problem with role based access control. Here is my use case: INDEX DEFINITION { "invoices\_status" : { "aliases" : { }, "mappings" : { "status" : { "properties" : { "company" : { "t… --- ## [Rally throughput metric as average instead of percentile](https://discuss.elastic.co/t/rally-throughput-metric-as-average-instead-of-percentile/148292)
**Author:** [@Sunil\_pandith](https://discuss.elastic.co/u/Sunil_pandith)\ **Replies:** 4\ **Last updated:** [September 17, 2018, 10:30am UTC](https://discuss.elastic.co/t/rally-throughput-metric-as-average-instead-of-percentile/148292 "2018-09-17T10:30:12Z")
Hi, I have been using the rally to benchmark the setup. The throughput latency and service time are in percentile. Is there any to way to get the throughput metrics in average response time (latency + service) rather t… --- ## [Different result for cardinality aggregation \[6.3.0\] in Python 3.6 plugin](https://discuss.elastic.co/t/different-result-for-cardinality-aggregation-6-3-0-in-python-3-6-plugin/148798)
**Author:** [@Wietse](https://discuss.elastic.co/u/Wietse)\ **Replies:** 0\ **Last updated:** [September 17, 2018, 9:18am UTC](https://discuss.elastic.co/t/different-result-for-cardinality-aggregation-6-3-0-in-python-3-6-plugin/148798 "2018-09-17T09:18:59Z")
Hi I'm trying to extract every hour the amount of unique users who logged in the past 24 hours. For this I use the cardinality aggregation with a range on the time. I use ELK 6.3. GET logins/\_search { "\_source": "use… --- ## [Caused by: org.elasticsearch.ElasticsearchSecurityException: missing authentication token for action \[internal:transport/handshake\]](https://discuss.elastic.co/t/caused-by-org-elasticsearch-elasticsearchsecurityexception-missing-authentication-token-for-action-internal-transport-handshake/148758)
**Author:** [@vschakka](https://discuss.elastic.co/u/vschakka)\ **Replies:** 1\ **Last updated:** [September 17, 2018, 9:59am UTC](https://discuss.elastic.co/t/caused-by-org-elasticsearch-elasticsearchsecurityexception-missing-authentication-token-for-action-internal-transport-handshake/148758 "2018-09-17T09:59:04Z")
Hi , Recently I upgraded elastic, logstash and kibana to 6.4.0 from 6.2.x. After restarting es nodes and tribe, getting below exception. Due to which sync is not happening resulting to stopping indexing. I disabled xpac… --- ## [Courier fetch: shards failed exception is at TRACE level](https://discuss.elastic.co/t/courier-fetch-shards-failed-exception-is-at-trace-level/148803)
**Author:** [@Nikhil\_Utane](https://discuss.elastic.co/u/Nikhil_Utane)\ **Replies:** 0\ **Last updated:** [September 17, 2018, 9:37am UTC](https://discuss.elastic.co/t/courier-fetch-shards-failed-exception-is-at-trace-level/148803 "2018-09-17T09:37:54Z")
Hi, I was observing some "Courier fetch: shards failed exceptions" in Kibana. I was finally able to root-cause it due to the scripted fields. Unfortunately, there was no information given in the Elasticsearch logs by d… --- ## [Exclude field in hightlight](https://discuss.elastic.co/t/exclude-field-in-hightlight/148797)
**Author:** [@Kirtash](https://discuss.elastic.co/u/Kirtash)\ **Replies:** 0\ **Last updated:** [September 17, 2018, 9:14am UTC](https://discuss.elastic.co/t/exclude-field-in-hightlight/148797 "2018-09-17T09:14:58Z")
Hello! Is possible exclude fields using \* in hightlight? I have a field of 12.000 characters and I would like only exclude this field. For now I'm using this structure of search: GET offers/\_search { "query": { "boo… --- ## [Unassigned shards on es 5.5.1](https://discuss.elastic.co/t/unassigned-shards-on-es-5-5-1/148779)
**Author:** [@Guy\_Barnea](https://discuss.elastic.co/u/Guy_Barnea)\ **Replies:** 8\ **Last updated:** [September 17, 2018, 8:39am UTC](https://discuss.elastic.co/t/unassigned-shards-on-es-5-5-1/148779 "2018-09-17T08:39:58Z")
Hello, Im running elasticSearch 5.5.1 on port 9200. I have a problem with its shards : not all of them are assign and right now , I dont have access to all of my files in my indexes. How can i solve this problem? Th… --- ## [Cusom date query](https://discuss.elastic.co/t/cusom-date-query/148778)
**Author:** [@Islam\_Elshobokshy](https://discuss.elastic.co/u/Islam_Elshobokshy)\ **Replies:** 0\ **Last updated:** [September 17, 2018, 7:30am UTC](https://discuss.elastic.co/t/cusom-date-query/148778 "2018-09-17T07:30:27Z")
Any idea how to transform this query to elasticsearch ? (myDate is a date format coming from the datatabse, we're just transforming it here to a year month only format) SELECT date\_format(myDate,'%Y%m') as custom FROM … --- ## [Improve mapping performance on Elasticsearch](https://discuss.elastic.co/t/improve-mapping-performance-on-elasticsearch/148773)
**Author:** [@goldy146](https://discuss.elastic.co/u/goldy146)\ **Replies:** 1\ **Last updated:** [September 17, 2018, 8:23am UTC](https://discuss.elastic.co/t/improve-mapping-performance-on-elasticsearch/148773 "2018-09-17T08:23:44Z")
My elastic cluster contains indices with giant mapping files. This is due to the fact that some of my indices contain up to 60k different fields. To elaborate a bit about my setup, each index contains information from a… --- ## [Client API Multiple queries](https://discuss.elastic.co/t/client-api-multiple-queries/148784)
**Author:** [@xodn0812](https://discuss.elastic.co/u/xodn0812)\ **Replies:** 0\ **Last updated:** [September 17, 2018, 8:06am UTC](https://discuss.elastic.co/t/client-api-multiple-queries/148784 "2018-09-17T08:06:18Z")
I want to use condition search and time search at the same time. However, the query () API seems to be able to issue only one condition. Can I put multiple conditions? My sources are: SearchSourceBuilder searchSource… --- ## [Accessing search size in execution context](https://discuss.elastic.co/t/accessing-search-size-in-execution-context/148723)
**Author:** [@jgburks](https://discuss.elastic.co/u/jgburks)\ **Replies:** 1\ **Last updated:** [September 17, 2018, 7:46am UTC](https://discuss.elastic.co/t/accessing-search-size-in-execution-context/148723 "2018-09-17T07:46:05Z")
Is there any way to access the search/query size value in the execution context? So emails could include something like "showing up to {{ctx.search.request.size}} results}}". Thanks --- ## [Request.types not working in ECE Watcher](https://discuss.elastic.co/t/request-types-not-working-in-ece-watcher/148509)
**Author:** [@gautu7](https://discuss.elastic.co/u/gautu7)\ **Replies:** 3\ **Last updated:** [September 17, 2018, 7:43am UTC](https://discuss.elastic.co/t/request-types-not-working-in-ece-watcher/148509 "2018-09-17T07:43:17Z")
Hi, I am trying to execute Watchers which pulls in certain types directly and perform actions it. When I use types to specify the type to read like in the example below, it doesn't work, but does work when I remove type… --- ## [Disk - Filesystem and block size recommendations](https://discuss.elastic.co/t/disk-filesystem-and-block-size-recommendations/148782)
**Author:** [@Sylmarch](https://discuss.elastic.co/u/Sylmarch)\ **Replies:** 0\ **Last updated:** [September 17, 2018, 7:42am UTC](https://discuss.elastic.co/t/disk-filesystem-and-block-size-recommendations/148782 "2018-09-17T07:42:12Z")
Hello, I'm going to install a new Elasticsearch 6.x cluster with hot and warm nodes. hot nodes have SSD disks warm nodes have HDD disks Indices with no modifications for N hours/days will be moved from hot to warm no… --- ## [How to create filter match a string using regex?](https://discuss.elastic.co/t/how-to-create-filter-match-a-string-using-regex/148768)
**Author:** [@bella](https://discuss.elastic.co/u/bella)\ **Replies:** 0\ **Last updated:** [September 17, 2018, 7:08am UTC](https://discuss.elastic.co/t/how-to-create-filter-match-a-string-using-regex/148768 "2018-09-17T07:08:22Z")
Hi there, I was trying to create a filter to match field "source" and value "/var/log/nginx/\*-access.log", the log file name contains the domain name, e.g, /var/log/nginx/mydomain.com-access.log, couldn't get it work, h… --- ## [Notify Slack action in watcher fails if message attachment contains actions](https://discuss.elastic.co/t/notify-slack-action-in-watcher-fails-if-message-attachment-contains-actions/148367)
**Author:** [@vicpav](https://discuss.elastic.co/u/vicpav)\ **Replies:** 2\ **Last updated:** [September 17, 2018, 6:59am UTC](https://discuss.elastic.co/t/notify-slack-action-in-watcher-fails-if-message-attachment-contains-actions/148367 "2018-09-17T06:59:54Z")
Elastic cluster 6.3.2 is deployed to Elastic cloud. While trying to animate the Slack notifications sent by our watchers I have updated the message to include a link button as per Slack documentation . As a result, the … --- ## [Custom Similiarity Plugin](https://discuss.elastic.co/t/custom-similiarity-plugin/148737)
**Author:** [@micmer](https://discuss.elastic.co/u/micmer)\ **Replies:** 2\ **Last updated:** [September 17, 2018, 6:54am UTC](https://discuss.elastic.co/t/custom-similiarity-plugin/148737 "2018-09-17T06:54:49Z")
Hi, I want to update my custom similarity plugin from version 6.2 to version 6.4. However the AbstractSimilarityProvider class has been removed from version 6.4. That class I was using so far for making my lucene Similar… --- ## [Autosuggestion using Elasticsearch for huge data content](https://discuss.elastic.co/t/autosuggestion-using-elasticsearch-for-huge-data-content/148745)
**Author:** [@Nikesh](https://discuss.elastic.co/u/Nikesh)\ **Replies:** 1\ **Last updated:** [September 17, 2018, 6:45am UTC](https://discuss.elastic.co/t/autosuggestion-using-elasticsearch-for-huge-data-content/148745 "2018-09-17T06:45:17Z")
Hi, I am trying to use autosuggestion feature on two fields, "title" and "content".Content field is huge (about 30-40 pages). How do I index this field? My suggestion query works only when data is searched from the ver… --- ## [Which query type can give you an average score of the sub-queries?](https://discuss.elastic.co/t/which-query-type-can-give-you-an-average-score-of-the-sub-queries/148764)
**Author:** [@NewHere](https://discuss.elastic.co/u/NewHere)\ **Replies:** 0\ **Last updated:** [September 17, 2018, 6:19am UTC](https://discuss.elastic.co/t/which-query-type-can-give-you-an-average-score-of-the-sub-queries/148764 "2018-09-17T06:19:40Z")
Say I have a bunch of sub-queries, using bool query "should" I can get the sum of each matched query score into the final score. How do I get an average score instead of sum? e.g.: {"query":{"bool":{"should":\[{sub-query… --- ## [Unsuccessful GETS missing\_total = 7138 in nodes/stats](https://discuss.elastic.co/t/unsuccessful-gets-missing-total-7138-in-nodes-stats/147650)
**Author:** [@Priya\_Prabhakar](https://discuss.elastic.co/u/Priya_Prabhakar)\ **Replies:** 3\ **Last updated:** [September 17, 2018, 6:02am UTC](https://discuss.elastic.co/t/unsuccessful-gets-missing-total-7138-in-nodes-stats/147650 "2018-09-17T06:02:49Z")
Hello Team, -What I checked : I have gone through the below doc, which only give the overview, I need more details about the stats: get shows statistics about get-by-ID statistics. This includes GET and HEAD req… --- ## [Snapshot stuck IN\_PROGRESS](https://discuss.elastic.co/t/snapshot-stuck-in-progress/148552)
**Author:** [@markuchi](https://discuss.elastic.co/u/markuchi)\ **Replies:** 3\ **Last updated:** [September 17, 2018, 4:50am UTC](https://discuss.elastic.co/t/snapshot-stuck-in-progress/148552 "2018-09-17T04:50:05Z")
Running a snapshot has taken days and has been IN\_PROGRESS state During the snapshot we hit the low watermark and want to stop the snapshot and redo one we fix the watermark. We have performed rolling restarts multiple… --- ## [Curator for Elastic cluster with xpack](https://discuss.elastic.co/t/curator-for-elastic-cluster-with-xpack/148275)
**Author:** [@tushar\_raut](https://discuss.elastic.co/u/tushar_raut)\ **Replies:** 6\ **Last updated:** [September 17, 2018, 4:42am UTC](https://discuss.elastic.co/t/curator-for-elastic-cluster-with-xpack/148275 "2018-09-17T04:42:01Z")
Hi, I am trying to setup curator for my elastic cluster which is running on version 6.3. I have installed curator 5.5.4. Curator yaml : --- client: hosts: - \["node-1", "node-2", "node-3"\] port: 9200 url\_pre… --- ## [Cloud elastic Alerting not working as expected](https://discuss.elastic.co/t/cloud-elastic-alerting-not-working-as-expected/148111)
**Author:** [@Hitesh\_Baldaniya](https://discuss.elastic.co/u/Hitesh_Baldaniya)\ **Replies:** 9\ **Last updated:** [September 17, 2018, 4:31am UTC](https://discuss.elastic.co/t/cloud-elastic-alerting-not-working-as-expected/148111 "2018-09-17T04:31:21Z")
Hi Team, We have setup watcher on our monitoring elasticsearch server. We are monitoring on ".monitoring-es-\*" indices with following mentioned watcher definition, but it always getting triggered so I believe compare st… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1545) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1547)