# Elasticsearch

**URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1549

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 1550

---

## [Search becomes faster after reindex](https://discuss.elastic.co/t/search-becomes-faster-after-reindex/148391)

<div class="topic-metadata">

**Author:** [@panfng](https://discuss.elastic.co/u/panfng)\
**Replies:** 2\
**Last updated:** [September 13, 2018, 11:22pm UTC](https://discuss.elastic.co/t/search-becomes-faster-after-reindex/148391 "2018-09-13T23:22:54Z")

</div>

Hi, we are using ES 5.5. we recently found that the average query time drops after every reindex, and then it climbs gradually after the reindex. This pattern repeats every day. Anyone has a good explanation for this ki…

---

## [Elastic stack + nginx installation bash script](https://discuss.elastic.co/t/elastic-stack-nginx-installation-bash-script/148524)

<div class="topic-metadata">

**Author:** [@derekmizak](https://discuss.elastic.co/u/derekmizak)\
**Replies:** 0\
**Last updated:** [September 13, 2018, 10:07pm UTC](https://discuss.elastic.co/t/elastic-stack-nginx-installation-bash-script/148524 "2018-09-13T22:07:35Z")

</div>

To save yourself time when setting up Elasticstac lab machines you can use this bash script which install JDK -Elasticsearch -Kibana -Logstash Tested on Ubuntu 18.04 - it is worth to notice that it doesn't work wit…

---

## [Document groups privileges](https://discuss.elastic.co/t/document-groups-privileges/148337)

<div class="topic-metadata">

**Author:** [@zalpany2000](https://discuss.elastic.co/u/zalpany2000)\
**Replies:** 8\
**Last updated:** [September 13, 2018, 9:21pm UTC](https://discuss.elastic.co/t/document-groups-privileges/148337 "2018-09-13T21:21:07Z")

</div>

Hello Elasticers have anyone experience with having different groups of documents each have certain access privileges from certain users? I mean for editing or adding new documents into this group? the case is that, we…

---

## [RestFilter, RestHandler, BaseRestHandler alternate Solution](https://discuss.elastic.co/t/restfilter-resthandler-baseresthandler-alternate-solution/148508)

<div class="topic-metadata">

**Author:** [@arul\_since1975](https://discuss.elastic.co/u/arul_since1975)\
**Replies:** 0\
**Last updated:** [September 13, 2018, 7:37pm UTC](https://discuss.elastic.co/t/restfilter-resthandler-baseresthandler-alternate-solution/148508 "2018-09-13T19:37:26Z")

</div>

Hi all, I have an Authentication plugin written in ES 5.1 has the following Classes. Public Class SecurityFilter extends RestFilter Where public void process(final RestRequest request, final RestChannel channel, fi…

---

## [What's the cache key for Node query cache](https://discuss.elastic.co/t/whats-the-cache-key-for-node-query-cache/148507)

<div class="topic-metadata">

**Author:** [@panfng](https://discuss.elastic.co/u/panfng)\
**Replies:** 0\
**Last updated:** [September 13, 2018, 7:37pm UTC](https://discuss.elastic.co/t/whats-the-cache-key-for-node-query-cache/148507 "2018-09-13T19:37:11Z")

</div>

Hi, what's the cache key for Node query cache can different indices query hit the same entry of the query cache?

---

## [Exception during Reindex](https://discuss.elastic.co/t/exception-during-reindex/148506)

<div class="topic-metadata">

**Author:** [@tcarolan](https://discuss.elastic.co/u/tcarolan)\
**Replies:** 2\
**Last updated:** [September 13, 2018, 7:37pm UTC](https://discuss.elastic.co/t/exception-during-reindex/148506 "2018-09-13T19:37:09Z")

</div>

Version: 5.4 I'm trying to use reindex to make a minor change to a mapping, although the mapping itself is complex and contains custom analyzer/tokenizers. Reindex works if I don't create the new mapping first: POST \_…

---

## [Snapshot not being taken](https://discuss.elastic.co/t/snapshot-not-being-taken/148499)

<div class="topic-metadata">

**Author:** [@aliyesami](https://discuss.elastic.co/u/aliyesami)\
**Replies:** 0\
**Last updated:** [September 13, 2018, 6:40pm UTC](https://discuss.elastic.co/t/snapshot-not-being-taken/148499 "2018-09-13T18:40:02Z")

</div>

I am trying to take a snapshot of an index but its not creating any files , although the backup status comes as ok . all 5 cluster nodes have read/write access to the share. The index status is green and has data. cu…

---

## [Index backup in elasticsearch cluster](https://discuss.elastic.co/t/index-backup-in-elasticsearch-cluster/148488)

<div class="topic-metadata">

**Author:** [@aliyesami](https://discuss.elastic.co/u/aliyesami)\
**Replies:** 1\
**Last updated:** [September 13, 2018, 6:37pm UTC](https://discuss.elastic.co/t/index-backup-in-elasticsearch-cluster/148488 "2018-09-13T18:37:08Z")

</div>

I am trying to backup an index in a 5 node elastic cluster but its failing . The directories are there but it seems it wants a shared folder among all the cluster nodes? \[elasticsearch@hadoop5 logs\]$ curl -XPUT 'hadoop1…

---

## [Elasticsearch 6.4 Kerberos: Checksum failed](https://discuss.elastic.co/t/elasticsearch-6-4-kerberos-checksum-failed/146735)

<div class="topic-metadata">

**Author:** [@Constantine\_Abayeu](https://discuss.elastic.co/u/Constantine_Abayeu)\
**Replies:** 5\
**Last updated:** [September 13, 2018, 6:19pm UTC](https://discuss.elastic.co/t/elasticsearch-6-4-kerberos-checksum-failed/146735 "2018-09-13T18:19:12Z")

</div>

Hello, there. We are doing PoC on 6.4 build in Kerberos Auth for elasticsearch. Here is a problem I have ran into with trying to set it up (please help me understand what is happening here): my Kerberos part of elasti…

---

## [ES cluster configuration question](https://discuss.elastic.co/t/es-cluster-configuration-question/148490)

<div class="topic-metadata">

**Author:** [@aliyesami](https://discuss.elastic.co/u/aliyesami)\
**Replies:** 0\
**Last updated:** [September 13, 2018, 5:33pm UTC](https://discuss.elastic.co/t/es-cluster-configuration-question/148490 "2018-09-13T17:33:05Z")

</div>

I have setup a 5 node cluster and each node has the following in the YML file what's the implication ? what is the right way to setup a cluster ? I think there is some master slave roles involved and I am not sure I un…

---

## [Bucket\_script location](https://discuss.elastic.co/t/bucket-script-location/148366)

<div class="topic-metadata">

**Author:** [@chapmantrain](https://discuss.elastic.co/u/chapmantrain)\
**Replies:** 2\
**Last updated:** [September 13, 2018, 5:02pm UTC](https://discuss.elastic.co/t/bucket-script-location/148366 "2018-09-13T17:02:59Z")

</div>

I would like to construct a query that would calculate a moving average. The working query is below. I need to do an initial query for the specific function to be analyzed. After that I am doing a four week from present …

---

## [Snapshot performance very slow](https://discuss.elastic.co/t/snapshot-performance-very-slow/148482)

<div class="topic-metadata">

**Author:** [@KeninHouston](https://discuss.elastic.co/u/KeninHouston)\
**Replies:** 0\
**Last updated:** [September 13, 2018, 4:27pm UTC](https://discuss.elastic.co/t/snapshot-performance-very-slow/148482 "2018-09-13T16:27:41Z")

</div>

Hi, I have an ElasticSearch 6.3 cluster running on 3 Azure nodes. Each node is 4 vcpus, 14 GB RAM. My snapshot repository is stored on an Azure fileshare. I have 36 indexes, 14Gb of data. The snapshot repository is emp…

---

## [ES starts, but Cross Cluster Search shows local data node disconnected](https://discuss.elastic.co/t/es-starts-but-cross-cluster-search-shows-local-data-node-disconnected/147466)

<div class="topic-metadata">

**Author:** [@mtowle](https://discuss.elastic.co/u/mtowle)\
**Replies:** 2\
**Last updated:** [September 13, 2018, 3:37pm UTC](https://discuss.elastic.co/t/es-starts-but-cross-cluster-search-shows-local-data-node-disconnected/147466 "2018-09-13T15:37:34Z")

</div>

I have two lab ES 6.2.2 data nodes, and one data node also acts as a Cross Cluster Search node. When I start the CCS node for the first time with a script that starts up ES upon reboot, curl shows the node is connected,…

---

## [Data taking too much space](https://discuss.elastic.co/t/data-taking-too-much-space/148467)

<div class="topic-metadata">

**Author:** [@anirudh](https://discuss.elastic.co/u/anirudh)\
**Replies:** 0\
**Last updated:** [September 13, 2018, 2:40pm UTC](https://discuss.elastic.co/t/data-taking-too-much-space/148467 "2018-09-13T14:40:42Z")

</div>

hi i am currently using elasticsearch 6.3.2 version. In the monitoring (x-pack) screen it shows Disk Usage as 13.3 GB, however Disk Available is only 40.7/199.9 GB. I have got 4 nodes in the cluster. Any ideas on what …

---

## [Dont recieve Comfirm subscription notification in elasticsearch data](https://discuss.elastic.co/t/dont-recieve-comfirm-subscription-notification-in-elasticsearch-data/148463)

<div class="topic-metadata">

**Author:** [@Emilien\_Vuillaume](https://discuss.elastic.co/u/Emilien_Vuillaume)\
**Replies:** 0\
**Last updated:** [September 13, 2018, 1:53pm UTC](https://discuss.elastic.co/t/dont-recieve-comfirm-subscription-notification-in-elasticsearch-data/148463 "2018-09-13T13:53:39Z")

</div>

I try to connect a new elasticsearch server (v 6.4.0) to receive AWS SNS datas. I put endpoint in https url like that : https://USERNAME:PASSWORD@XXXXXXXXXXXXXXX.eu-central-1.aws.cloud.es.io:9343/index-name/test but I …

---

## [What is the difference between suggest\_mode missing and always?](https://discuss.elastic.co/t/what-is-the-difference-between-suggest-mode-missing-and-always/148316)

<div class="topic-metadata">

**Author:** [@riol6](https://discuss.elastic.co/u/riol6)\
**Replies:** 1\
**Last updated:** [September 13, 2018, 1:20pm UTC](https://discuss.elastic.co/t/what-is-the-difference-between-suggest-mode-missing-and-always/148316 "2018-09-13T13:20:25Z")

</div>

elasticsearch version 6.4.0 I am a newcomer to elasticsearch. I have some doubts about term suggest .I know suggest\_mode has possible values(missing, popular, always) and i understand the 'missing', but can't understan…

---

## [Elasticsearch Frequently Failed and Slows Down After Upgrade to 6.4](https://discuss.elastic.co/t/elasticsearch-frequently-failed-and-slows-down-after-upgrade-to-6-4/148435)

<div class="topic-metadata">

**Author:** [@fiq](https://discuss.elastic.co/u/fiq)\
**Replies:** 3\
**Last updated:** [September 13, 2018, 11:27am UTC](https://discuss.elastic.co/t/elasticsearch-frequently-failed-and-slows-down-after-upgrade-to-6-4/148435 "2018-09-13T11:27:57Z")

</div>

Hi, I have this problem where elasticsearch is frequently failed and shard allocation after restart is very slow after upgrading to 6.4 from 6.2. \[2018-09-13T17:26:23,546\]\[WARN \]\[o.e.i.c.IndicesClusterStateService\] \[EL…

---

## [Watcher with conditions fails on transform](https://discuss.elastic.co/t/watcher-with-conditions-fails-on-transform/147962)

<div class="topic-metadata">

**Author:** [@JeffreyH1989](https://discuss.elastic.co/u/JeffreyH1989)\
**Replies:** 5\
**Last updated:** [September 13, 2018, 11:26am UTC](https://discuss.elastic.co/t/watcher-with-conditions-fails-on-transform/147962 "2018-09-13T11:26:39Z")

</div>

Good afternoon, I'm trying to create a Watcher for cluster alerting in Slack. I'm using the Elasticsearch cluster state watcher included with X-Pack. For testing, i'm verifying if the behavior works like the built-in on…

---

## [Keyword values not dynamically updated?](https://discuss.elastic.co/t/keyword-values-not-dynamically-updated/148430)

<div class="topic-metadata">

**Author:** [@intellion](https://discuss.elastic.co/u/intellion)\
**Replies:** 0\
**Last updated:** [September 13, 2018, 9:42am UTC](https://discuss.elastic.co/t/keyword-values-not-dynamically-updated/148430 "2018-09-13T09:42:54Z")

</div>

I have an index with a string field named "Hostname". And there is also an automatically created HostName.Keyword field. I use this -keyword-field for aggregations, e.g. in an Control-Visualisation. Problem now is that…

---

## [Sort buckets by shared field values](https://discuss.elastic.co/t/sort-buckets-by-shared-field-values/147590)

<div class="topic-metadata">

**Author:** [@Domme](https://discuss.elastic.co/u/Domme)\
**Replies:** 0\
**Last updated:** [September 6, 2018, 1:54pm UTC](https://discuss.elastic.co/t/sort-buckets-by-shared-field-values/147590 "2018-09-06T13:54:44Z")

</div>

I would like to group documents based on a group field G. I use the „field aggregation“ strategy described in the Elastic documention to sort the buckets by the maximal score of the contained documents (called 'field col…

---

## [Decommission a hard drive from a node](https://discuss.elastic.co/t/decommission-a-hard-drive-from-a-node/148420)

<div class="topic-metadata">

**Author:** [@elastic\_paul](https://discuss.elastic.co/u/elastic_paul)\
**Replies:** 1\
**Last updated:** [September 13, 2018, 9:33am UTC](https://discuss.elastic.co/t/decommission-a-hard-drive-from-a-node/148420 "2018-09-13T09:33:51Z")

</div>

I have 8 nodes in my cluster. Each node has 12 disks. All 12 disks in each node contain shards. I would like to remove one of the disks from one of the nodes. What is the correct way to move the data off the disk and th…

---

## [Preferred master node](https://discuss.elastic.co/t/preferred-master-node/146730)

<div class="topic-metadata">

**Author:** [@Fpernet](https://discuss.elastic.co/u/Fpernet)\
**Replies:** 1\
**Last updated:** [September 13, 2018, 9:19am UTC](https://discuss.elastic.co/t/preferred-master-node/146730 "2018-09-13T09:19:33Z")

</div>

Hi All, Need some advice. I have a cluster ES 6.4.0 with 5 Data Nodes, 1 Master Node. All of the 5 Data Nodes are Master elligible nodes. Since i have a dedicated Master Node (no other role), I would like that this n…

---

## [Getting a warning "seccomp unavailable: 's390x' architecture unsupported" while starting service on s390x](https://discuss.elastic.co/t/getting-a-warning-seccomp-unavailable-s390x-architecture-unsupported-while-starting-service-on-s390x/148416)

<div class="topic-metadata">

**Author:** [@chakravarthy\_G](https://discuss.elastic.co/u/chakravarthy_G)\
**Replies:** 0\
**Last updated:** [September 13, 2018, 7:11am UTC](https://discuss.elastic.co/t/getting-a-warning-seccomp-unavailable-s390x-architecture-unsupported-while-starting-service-on-s390x/148416 "2018-09-13T07:11:04Z")

</div>

Elasticsearch version (bin/elasticsearch --version): 6.4.0 JVM version (java -version): adoptOpenJDK 10 OS version (uname -a if on a Unix-like system): Linux abc8c2c59c04 4.4.132-94.33-default #1 SMP Tue May 29 20:09:5…

---

## [Several conditions in Condition part of Watcher](https://discuss.elastic.co/t/several-conditions-in-condition-part-of-watcher/148419)

<div class="topic-metadata">

**Author:** [@\_Sergey](https://discuss.elastic.co/u/_Sergey)\
**Replies:** 1\
**Last updated:** [September 13, 2018, 8:19am UTC](https://discuss.elastic.co/t/several-conditions-in-condition-part-of-watcher/148419 "2018-09-13T08:19:15Z")

</div>

Hey community, Can you advise please: is it possible or what is the correct way to mention in Condition part of watcher several conditions (sorry for tautology). I want to use smth like this: "condition": { "script…

---

## [ES 6.X C reate a match query that queries a string array](https://discuss.elastic.co/t/es-6-x-c-reate-a-match-query-that-queries-a-string-array/148417)

<div class="topic-metadata">

**Author:** [@MiguelSalenda](https://discuss.elastic.co/u/MiguelSalenda)\
**Replies:** 0\
**Last updated:** [September 13, 2018, 7:31am UTC](https://discuss.elastic.co/t/es-6-x-c-reate-a-match-query-that-queries-a-string-array/148417 "2018-09-13T07:31:35Z")

</div>

Hello all, I'm trying to refactor a ES 1.7 query that uses a match query that queries a string array into a ES 6.X query. Here is the query in 1.7: { "query": { "bool": { "must": { "matc…

---

## [Elasticsearch create index api created a all uppercase field index](https://discuss.elastic.co/t/elasticsearch-create-index-api-created-a-all-uppercase-field-index/148410)

<div class="topic-metadata">

**Author:** [@memery\_xmb](https://discuss.elastic.co/u/memery_xmb)\
**Replies:** 2\
**Last updated:** [September 13, 2018, 5:42am UTC](https://discuss.elastic.co/t/elasticsearch-create-index-api-created-a-all-uppercase-field-index/148410 "2018-09-13T05:42:52Z")

</div>

I'm working with elasticsearch 6.2.4 and using the following code to create an index. CreateIndexRequest request = new CreateIndexRequest(indexName); request.source(jsonSource, XContentType.JSON); CreateIndexResponse…

---

## [Syntax error in Search API with query\_string and date filter](https://discuss.elastic.co/t/syntax-error-in-search-api-with-query-string-and-date-filter/148397)

<div class="topic-metadata">

**Author:** [@shankarps](https://discuss.elastic.co/u/shankarps)\
**Replies:** 0\
**Last updated:** [September 13, 2018, 2:04am UTC](https://discuss.elastic.co/t/syntax-error-in-search-api-with-query-string-and-date-filter/148397 "2018-09-13T02:04:08Z")

</div>

I need help wiht understanding this syntax. I have gone through the docs, but since I am new to ELK, I am finding it hard to make this run. The following API query runs and returns all records that has the exact match o…

---

## [Elasticsearch Search REST API is not running](https://discuss.elastic.co/t/elasticsearch-search-rest-api-is-not-running/148387)

<div class="topic-metadata">

**Author:** [@shankarps](https://discuss.elastic.co/u/shankarps)\
**Replies:** 2\
**Last updated:** [September 13, 2018, 1:16am UTC](https://discuss.elastic.co/t/elasticsearch-search-rest-api-is-not-running/148387 "2018-09-13T01:16:20Z")

</div>

I have the free version of ELK installation running in a single server. I can search using Kibana at http://my-server:5601/app/kibana. I can also access the REST API to see the list of indexes (curl request to http://my…

---

## [Use SAN for Warm Data Nodes](https://discuss.elastic.co/t/use-san-for-warm-data-nodes/148339)

<div class="topic-metadata">

**Author:** [@samwzm](https://discuss.elastic.co/u/samwzm)\
**Replies:** 1\
**Last updated:** [September 13, 2018, 12:22am UTC](https://discuss.elastic.co/t/use-san-for-warm-data-nodes/148339 "2018-09-13T00:22:30Z")

</div>

Hi, there, Is it possible to use SAN for warm data nodes for data storage? Any suggestions/considerations for doing that? Thanks for any help! Sam

---

## [Unexpected problem processing bytes for class](https://discuss.elastic.co/t/unexpected-problem-processing-bytes-for-class/148381)

<div class="topic-metadata">

**Author:** [@akaukuntla](https://discuss.elastic.co/u/akaukuntla)\
**Replies:** 0\
**Last updated:** [September 12, 2018, 9:34pm UTC](https://discuss.elastic.co/t/unexpected-problem-processing-bytes-for-class/148381 "2018-09-12T21:34:48Z")

</div>

Hi. I'm using the Elasticseach Rest high-level client 6.3.2 in Grails/Groovy project. Here is the Gradle dependecy I have added as suggested in the documentation \[https://www.elastic.co/guide/en/elasticsearch/client/ja…

[Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1548)

[Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1550)
