# Elasticsearch

**URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1552

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 1553

---

## [If a shard fails with no replica, is the data lost entirely?](https://discuss.elastic.co/t/if-a-shard-fails-with-no-replica-is-the-data-lost-entirely/148037)

<div class="topic-metadata">

**Author:** [@jtalmi](https://discuss.elastic.co/u/jtalmi)\
**Replies:** 0\
**Last updated:** [September 11, 2018, 2:57am UTC](https://discuss.elastic.co/t/if-a-shard-fails-with-no-replica-is-the-data-lost-entirely/148037 "2018-09-11T02:57:12Z")

</div>

Hi, I have a single-shard index with no replicas running on a single-node cluster. The shard has apparently failed, and while I'm not sure why right now, I want to know if there are any options for data recovery. { "…

---

## [Saved Search in Kibana Dashboard User Only - no data](https://discuss.elastic.co/t/saved-search-in-kibana-dashboard-user-only-no-data/146535)

<div class="topic-metadata">

**Author:** [@Data\_Statistics](https://discuss.elastic.co/u/Data_Statistics)\
**Replies:** 3\
**Last updated:** [September 10, 2018, 11:06pm UTC](https://discuss.elastic.co/t/saved-search-in-kibana-dashboard-user-only-no-data/146535 "2018-09-10T23:06:17Z")

</div>

Hi All, Yesterday I updated elastic and kibana to 6.4 version, and in the dashboard all Saved Searches appears with no data for the Kibana\_Dashboard\_User\_Only users. When I change these users to other roles, like kiban…

---

## [\[SOLVED\] How long a "gradle check" is supposed to take?](https://discuss.elastic.co/t/solved-how-long-a-gradle-check-is-supposed-to-take/148007)

<div class="topic-metadata">

**Author:** [@cbismuth](https://discuss.elastic.co/u/cbismuth)\
**Replies:** 2\
**Last updated:** [September 10, 2018, 9:09pm UTC](https://discuss.elastic.co/t/solved-how-long-a-gradle-check-is-supposed-to-take/148007 "2018-09-10T21:09:07Z")

</div>

Hi, I'm new to Elasticsearch contribution workflow. I've stopped the gradle check command on my laptop after 20 minutes. Could an Elasticsearch developer/contributor tell me how long this command is supposed to last? M…

---

## [Writing to wrong index](https://discuss.elastic.co/t/writing-to-wrong-index/147761)

<div class="topic-metadata">

**Author:** [@waynesmallman](https://discuss.elastic.co/u/waynesmallman)\
**Replies:** 9\
**Last updated:** [September 10, 2018, 9:08pm UTC](https://discuss.elastic.co/t/writing-to-wrong-index/147761 "2018-09-10T21:08:00Z")

</div>

I need to update a mapping with additional fields, but decided to create an experimental map first and write documents to it to weed out the problems. As it happened, the whole thing worked first time of asking, but then…

---

## [Contradictory and, sometimes, poor, advice given for es.set.netty.runtime.available.processors](https://discuss.elastic.co/t/contradictory-and-sometimes-poor-advice-given-for-es-set-netty-runtime-available-processors/148014)

<div class="topic-metadata">

**Author:** [@Stu\_S](https://discuss.elastic.co/u/Stu_S)\
**Replies:** 0\
**Last updated:** [September 10, 2018, 7:55pm UTC](https://discuss.elastic.co/t/contradictory-and-sometimes-poor-advice-given-for-es-set-netty-runtime-available-processors/148014 "2018-09-10T19:55:09Z")

</div>

Elasticsearch has a setting "processors" that defaults to "Runtime.getRuntime().availableProcessors()": It takes that setting, and tries to set the availableProcessor variable in Netty: Unless a particular system p…

---

## [Search template json\_parse\_exception](https://discuss.elastic.co/t/search-template-json-parse-exception/148010)

<div class="topic-metadata">

**Author:** [@JackFazackerley](https://discuss.elastic.co/u/JackFazackerley)\
**Replies:** 0\
**Last updated:** [September 10, 2018, 7:38pm UTC](https://discuss.elastic.co/t/search-template-json-parse-exception/148010 "2018-09-10T19:38:50Z")

</div>

Elasticsearch Version: 6.3.2 Kibana Version: 6.3.2 I've been using search templates for a while now and they've worked fine. Although when I \_search/template with a template I have (below), i get the following error: "…

---

## [Elasticsearch does not return results sometimes](https://discuss.elastic.co/t/elasticsearch-does-not-return-results-sometimes/148005)

<div class="topic-metadata">

**Author:** [@ESCoder](https://discuss.elastic.co/u/ESCoder)\
**Replies:** 0\
**Last updated:** [September 10, 2018, 7:01pm UTC](https://discuss.elastic.co/t/elasticsearch-does-not-return-results-sometimes/148005 "2018-09-10T19:01:55Z")

</div>

Hi, We are using Elastic 6.0 and Nest with 1 primary and 3 replicas. When we run the same query some times search returns no results. And if we execute same query again it will return the results. This pattern is not co…

---

## [Aggregating Metrics based on custom (bucket) intervals](https://discuss.elastic.co/t/aggregating-metrics-based-on-custom-bucket-intervals/148002)

<div class="topic-metadata">

**Author:** [@anand\_iyer](https://discuss.elastic.co/u/anand_iyer)\
**Replies:** 0\
**Last updated:** [September 10, 2018, 6:48pm UTC](https://discuss.elastic.co/t/aggregating-metrics-based-on-custom-bucket-intervals/148002 "2018-09-10T18:48:40Z")

</div>

I'm trying to average a certain metric within every 5 minutes for an hour, from the current time. So there would be 12 data points for an hour, where each data point would be the average value of that metric in the 5 min…

---

## [Not able to update mapping in template](https://discuss.elastic.co/t/not-able-to-update-mapping-in-template/147844)

<div class="topic-metadata">

**Author:** [@Nitin\_gupta](https://discuss.elastic.co/u/Nitin_gupta)\
**Replies:** 2\
**Last updated:** [September 10, 2018, 6:40pm UTC](https://discuss.elastic.co/t/not-able-to-update-mapping-in-template/147844 "2018-09-10T18:40:15Z")

</div>

Hi , i recently installed 6.4 version . Uploaded few logs and new index got created .Now i want to use template . When i am using below query to create template , only "default" mapping is updated but not the "doc" My…

---

## [How can I call "extended\_stats" in Elasticsearch 6.4.0 SQL syntax](https://discuss.elastic.co/t/how-can-i-call-extended-stats-in-elasticsearch-6-4-0-sql-syntax/145941)

<div class="topic-metadata">

**Author:** [@jam1142](https://discuss.elastic.co/u/jam1142)\
**Replies:** 6\
**Last updated:** [September 10, 2018, 6:03pm UTC](https://discuss.elastic.co/t/how-can-i-call-extended-stats-in-elasticsearch-6-4-0-sql-syntax/145941 "2018-09-10T18:03:33Z")

</div>

I am excited to hear elasticsearch giving option to write query in SQL syntax but just curious about how can we achieve elasticsearch features like aggregate "extended\_stats" through SQL syntax. I am looking for standard…

---

## [Snapshot Delete not working as expected](https://discuss.elastic.co/t/snapshot-delete-not-working-as-expected/147421)

<div class="topic-metadata">

**Author:** [@pri](https://discuss.elastic.co/u/pri)\
**Replies:** 5\
**Last updated:** [September 10, 2018, 5:42pm UTC](https://discuss.elastic.co/t/snapshot-delete-not-working-as-expected/147421 "2018-09-10T17:42:28Z")

</div>

I have been running hourly snapshots without periodically deleting older snapshots for a while using curator. The snapshots are stored in Amazon s3. And the number of snapshots have grown to a large number. I tried clea…

---

## [Replicating "\_all" functionality in v6 via "copy\_to" mapping parameter?](https://discuss.elastic.co/t/replicating-all-functionality-in-v6-via-copy-to-mapping-parameter/147787)

<div class="topic-metadata">

**Author:** [@alexu](https://discuss.elastic.co/u/alexu)\
**Replies:** 2\
**Last updated:** [September 10, 2018, 5:35pm UTC](https://discuss.elastic.co/t/replicating-all-functionality-in-v6-via-copy-to-mapping-parameter/147787 "2018-09-10T17:35:00Z")

</div>

For some reason we always assumed that removal of the "\_all" field in v6 is not a big deal and we can always create a custom "\_all" field via "copy\_to" mapping option. But it appears that "copy\_to" cannot copy fields fr…

---

## [Memory problems while querying](https://discuss.elastic.co/t/memory-problems-while-querying/147099)

<div class="topic-metadata">

**Author:** [@00PAD00](https://discuss.elastic.co/u/00PAD00)\
**Replies:** 3\
**Last updated:** [September 10, 2018, 4:20pm UTC](https://discuss.elastic.co/t/memory-problems-while-querying/147099 "2018-09-10T16:20:40Z")

</div>

Hi, I am running a query (below) on my cluster which is heavily impacting it since its status turns red. The cluster has 10 data nodes. { 'size':0, 'query':{ 'bool':{ 'must\_no…

---

## [Failed to send join request to master in Elastic 6.4.0](https://discuss.elastic.co/t/failed-to-send-join-request-to-master-in-elastic-6-4-0/147943)

<div class="topic-metadata">

**Author:** [@dhananjay88](https://discuss.elastic.co/u/dhananjay88)\
**Replies:** 15\
**Last updated:** [September 10, 2018, 4:19pm UTC](https://discuss.elastic.co/t/failed-to-send-join-request-to-master-in-elastic-6-4-0/147943 "2018-09-10T16:19:54Z")

</div>

Hi, I am getting the Error of failed to send join request to master while running Elastic 6.4.0. Please see the below given log snapshot and help me. Master Node Config cluster.name: aabb node.name: linsee1 node.mast…

---

## [Querying nested arrays](https://discuss.elastic.co/t/querying-nested-arrays/144381)

<div class="topic-metadata">

**Author:** [@Michael\_Noronha](https://discuss.elastic.co/u/Michael_Noronha)\
**Replies:** 3\
**Last updated:** [September 10, 2018, 4:18pm UTC](https://discuss.elastic.co/t/querying-nested-arrays/144381 "2018-09-10T16:18:32Z")

</div>

My current data representation is as follows: { ... "\_source": { "thing1": { "data": \[\[1,2,3\], \[4,5,6\], \[7,8,9\]\] }, "thing2": { "data": \[\[1,2,3\], \[4,5,6\], \[7,8,9\]\] } } }…

---

## [Using Has Parent Query how can I return specific Child](https://discuss.elastic.co/t/using-has-parent-query-how-can-i-return-specific-child/144454)

<div class="topic-metadata">

**Author:** [@code\_blue](https://discuss.elastic.co/u/code_blue)\
**Replies:** 1\
**Last updated:** [September 10, 2018, 4:12pm UTC](https://discuss.elastic.co/t/using-has-parent-query-how-can-i-return-specific-child/144454 "2018-09-10T16:12:38Z")

</div>

I have a scenario where a Parent "Car" has children "Toyota" & "Honda". If I run the below Has Parent Query it will return all children's of Car but I am looking is there a way to return only a specific children of Car. …

---

## [Primary shard is not active Timeout: \[1m\] (reindex api)](https://discuss.elastic.co/t/primary-shard-is-not-active-timeout-1m-reindex-api/147931)

<div class="topic-metadata">

**Author:** [@rkparkar](https://discuss.elastic.co/u/rkparkar)\
**Replies:** 1\
**Last updated:** [September 10, 2018, 4:11pm UTC](https://discuss.elastic.co/t/primary-shard-is-not-active-timeout-1m-reindex-api/147931 "2018-09-10T16:11:00Z")

</div>

Hi , i am trying to use the reindex api to copy data from one ES to another (both on 6.2.4). but i get the following error. "primary shard is not active Timeout: \[1m\] " detailed error : "cause":{"type":"unavailable\_sh…

---

## [Installation help needed](https://discuss.elastic.co/t/installation-help-needed/147984)

<div class="topic-metadata">

**Author:** [@eeeeting](https://discuss.elastic.co/u/eeeeting)\
**Replies:** 1\
**Last updated:** [September 10, 2018, 4:04pm UTC](https://discuss.elastic.co/t/installation-help-needed/147984 "2018-09-10T16:04:29Z")

</div>

hi, i downloaded the installation file, unzipped it and clicked the elasticsearch.bat file as the instruction showed, but a black window appeared in less than a second and then disappeared and nothing happens. why???

---

## [How Design my business to elastic indexes](https://discuss.elastic.co/t/how-design-my-business-to-elastic-indexes/147444)

<div class="topic-metadata">

**Author:** [@Yasser\_Ahmed](https://discuss.elastic.co/u/Yasser_Ahmed)\
**Replies:** 1\
**Last updated:** [September 10, 2018, 3:39pm UTC](https://discuss.elastic.co/t/how-design-my-business-to-elastic-indexes/147444 "2018-09-10T15:39:20Z")

</div>

Hi All, Please can you help me to how I can design my business case to elastic indexes. My business case : we have users that can make many transactions and for each transaction can have many products . In Relationa…

---

## [Plugin to call external Rest End point for each resulted doc with exrta parameters from Original Request](https://discuss.elastic.co/t/plugin-to-call-external-rest-end-point-for-each-resulted-doc-with-exrta-parameters-from-original-request/144592)

<div class="topic-metadata">

**Author:** [@vipindwivedi](https://discuss.elastic.co/u/vipindwivedi)\
**Replies:** 9\
**Last updated:** [September 10, 2018, 3:03pm UTC](https://discuss.elastic.co/t/plugin-to-call-external-rest-end-point-for-each-resulted-doc-with-exrta-parameters-from-original-request/144592 "2018-09-10T15:03:54Z")

</div>

Hi, I was going through online documentation to find if there is any way I can try to solve my use case while using ES for my document search. My Use case is like this .. Loaded bunch of document in ES lets say 10k. …

---

## [Shrink a lot of indexes at the same time](https://discuss.elastic.co/t/shrink-a-lot-of-indexes-at-the-same-time/147976)

<div class="topic-metadata">

**Author:** [@bamboomy](https://discuss.elastic.co/u/bamboomy)\
**Replies:** 0\
**Last updated:** [September 10, 2018, 3:00pm UTC](https://discuss.elastic.co/t/shrink-a-lot-of-indexes-at-the-same-time/147976 "2018-09-10T15:00:40Z")

</div>

Dear all, we have a lot of indexes that have 5 shards when 1 would do. Is there a possibility to bulk shrink them? Best regards, S.

---

## [Nested aggregation slows query from ~400ms to 10s](https://discuss.elastic.co/t/nested-aggregation-slows-query-from-400ms-to-10s/147539)

<div class="topic-metadata">

**Author:** [@newnewb](https://discuss.elastic.co/u/newnewb)\
**Replies:** 10\
**Last updated:** [September 10, 2018, 2:18pm UTC](https://discuss.elastic.co/t/nested-aggregation-slows-query-from-400ms-to-10s/147539 "2018-09-10T14:18:15Z")

</div>

Hello everyone, I created a simple query which looks for specific 5 car ID's and aggregates upon them. It's extremely fast, takes about 300-500ms. But if I add a nested aggregation which looks only for a specific colour…

---

## [Curator field\_stats doesn't work](https://discuss.elastic.co/t/curator-field-stats-doesnt-work/147619)

<div class="topic-metadata">

**Author:** [@aubreybox](https://discuss.elastic.co/u/aubreybox)\
**Replies:** 10\
**Last updated:** [September 10, 2018, 1:41pm UTC](https://discuss.elastic.co/t/curator-field-stats-doesnt-work/147619 "2018-09-10T13:41:38Z")

</div>

I updated curator from 5.5.2 to 5.5.4 Before that: curator\_cli --config config show\_indices --filter\_list '\[{"filtertype":"pattern","kind":"prefix","value":"filebeat-"}, {"filtertype":"age","source":"field\_stats","dir…

---

## [Watcher - Email notification](https://discuss.elastic.co/t/watcher-email-notification/147930)

<div class="topic-metadata">

**Author:** [@Goyal.vikas87](https://discuss.elastic.co/u/Goyal.vikas87)\
**Replies:** 1\
**Last updated:** [September 10, 2018, 1:22pm UTC](https://discuss.elastic.co/t/watcher-email-notification/147930 "2018-09-10T13:22:26Z")

</div>

I have a field (say Field1) in every document in my index. I want to create a notification alert so that whenver value of Field1 crosses fixed value then it sent out an email alert to the mentioned email id. Please help…

---

## [Parametrized watch](https://discuss.elastic.co/t/parametrized-watch/145878)

<div class="topic-metadata">

**Author:** [@The](https://discuss.elastic.co/u/The)\
**Replies:** 6\
**Last updated:** [September 10, 2018, 1:18pm UTC](https://discuss.elastic.co/t/parametrized-watch/145878 "2018-09-10T13:18:05Z")

</div>

I gather logs from 500 different devices (each separated with different id) and would like to create a watcher that detects when any of them stops sending data. I managed to create a watcher that does it for a single dev…

---

## [Broken Logstash -\> Elasticsearch indexing after upgrade to 6.4 from 5.4](https://discuss.elastic.co/t/broken-logstash-elasticsearch-indexing-after-upgrade-to-6-4-from-5-4/147745)

<div class="topic-metadata">

**Author:** [@brian.jones](https://discuss.elastic.co/u/brian.jones)\
**Replies:** 1\
**Last updated:** [September 10, 2018, 1:09pm UTC](https://discuss.elastic.co/t/broken-logstash-elasticsearch-indexing-after-upgrade-to-6-4-from-5-4/147745 "2018-09-10T13:09:01Z")

</div>

I have had a 5.x ELK server running for a long time with a bunch of grok pattern stuff taking syslog input from our network devices (Cisco route/switch/FW) to Logstash and outputting it to Elasticsearch. Now, I decided t…

---

## [Slow index performance after upgrade from 5.6.8 to 6.1.4](https://discuss.elastic.co/t/slow-index-performance-after-upgrade-from-5-6-8-to-6-1-4/146756)

<div class="topic-metadata">

**Author:** [@dltu](https://discuss.elastic.co/u/dltu)\
**Replies:** 2\
**Last updated:** [September 10, 2018, 4:30am UTC](https://discuss.elastic.co/t/slow-index-performance-after-upgrade-from-5-6-8-to-6-1-4/146756 "2018-09-10T04:30:10Z")

</div>

After upgrade, my cluster become very worst when ingest data. With normal status (not ingest), everything ok(cpu, heap, io, network, load.. keep low) But with some small ingest continously, cluster become poor perfoman…

---

## [Where is the plugin upload button?](https://discuss.elastic.co/t/where-is-the-plugin-upload-button/147966)

<div class="topic-metadata">

**Author:** [@Kim\_Rauff\_Schurmann](https://discuss.elastic.co/u/Kim_Rauff_Schurmann)\
**Replies:** 0\
**Last updated:** [September 10, 2018, 1:06pm UTC](https://discuss.elastic.co/t/where-is-the-plugin-upload-button/147966 "2018-09-10T13:06:07Z")

</div>

Hi, I am trying to upload a new plugin for my cloud cluster but there is no upload button? What am I missing here? /Kim

---

## [TLS security in Elasticsearch](https://discuss.elastic.co/t/tls-security-in-elasticsearch/147947)

<div class="topic-metadata">

**Author:** [@Tek\_Chand](https://discuss.elastic.co/u/Tek_Chand)\
**Replies:** 4\
**Last updated:** [September 10, 2018, 12:20pm UTC](https://discuss.elastic.co/t/tls-security-in-elasticsearch/147947 "2018-09-10T12:20:44Z")

</div>

Hello Team, Can we use TLS feature for secure communication in cluster for basic license version or we need to purchase gold or platinum license to use this feature? Thanks.

---

## [How can I correctly index @screen\_name, #hashtag and url in Japanese text?](https://discuss.elastic.co/t/how-can-i-correctly-index-screen-name-hashtag-and-url-in-japanese-text/147946)

<div class="topic-metadata">

**Author:** [@mpyw](https://discuss.elastic.co/u/mpyw)\
**Replies:** 0\
**Last updated:** [September 10, 2018, 11:13am UTC](https://discuss.elastic.co/t/how-can-i-correctly-index-screen-name-hashtag-and-url-in-japanese-text/147946 "2018-09-10T11:13:33Z")

</div>

What I need to do Use kuromoji as a tokenizer and an analyzer for handling Japanese fulltext search Recognize tokens that match /\\b@\\w{1,30}\\b/ (screen\_name) Recognize tokens that match URL Pattern Recognize tokens tha…

[Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1551)

[Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1553)
