# Elasticsearch

**URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1571

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 1572

---

## [Not able to create S3 Repo](https://discuss.elastic.co/t/not-able-to-create-s3-repo/145677)

<div class="topic-metadata">

**Author:** [@sreejiths](https://discuss.elastic.co/u/sreejiths)\
**Replies:** 1\
**Last updated:** [August 23, 2018, 9:24am UTC](https://discuss.elastic.co/t/not-able-to-create-s3-repo/145677 "2018-08-23T09:24:07Z")

</div>

Hi We are running Elasticsearch cluster running on V5.6.8 . I am trying to created REPO on On-Premise Object Stores (IBM Cleversafe) and i am getting below error . I have installed repository-s3 plugin in all elastics…

---

## [Elastic search watcher : Unable to fix this error](https://discuss.elastic.co/t/elastic-search-watcher-unable-to-fix-this-error/145683)

<div class="topic-metadata">

**Author:** [@yeruvavasavi](https://discuss.elastic.co/u/yeruvavasavi)\
**Replies:** 3\
**Last updated:** [August 23, 2018, 9:17am UTC](https://discuss.elastic.co/t/elastic-search-watcher-unable-to-fix-this-error/145683 "2018-08-23T09:17:07Z")

</div>

"total": 41, "failed": 0, "successful": 41, "skipped": 0 }, "hits": { "hits": \[\], "total": 411225, "max\_score": 0 }, "took": 18, "timed\_out": false }, "search"…

---

## [Not received license file after payment](https://discuss.elastic.co/t/not-received-license-file-after-payment/145679)

<div class="topic-metadata">

**Author:** [@Frode\_Rennemo](https://discuss.elastic.co/u/Frode_Rennemo)\
**Replies:** 3\
**Last updated:** [August 23, 2018, 8:52am UTC](https://discuss.elastic.co/t/not-received-license-file-after-payment/145679 "2018-08-23T08:52:52Z")

</div>

It seems that we did not receive the updated license file when we recently paid the invoice, and now our license is expired. I have submitted an issue in the support portal but it has already been a week and no answer. W…

---

## [Extracting fields from hits in watchers](https://discuss.elastic.co/t/extracting-fields-from-hits-in-watchers/145675)

<div class="topic-metadata">

**Author:** [@Magnus\_Therning](https://discuss.elastic.co/u/Magnus_Therning)\
**Replies:** 0\
**Last updated:** [August 23, 2018, 8:13am UTC](https://discuss.elastic.co/t/extracting-fields-from-hits-in-watchers/145675 "2018-08-23T08:13:14Z")

</div>

I'm trying to limit the data I attach to emails by naming fields in input.search.extract. The examples I've found typically use something simple like hits.total, and that works. However, things like hits.hits.0.\_source d…

---

## [Search with inject attachment - too long](https://discuss.elastic.co/t/search-with-inject-attachment-too-long/145307)

<div class="topic-metadata">

**Author:** [@Vikentyi](https://discuss.elastic.co/u/Vikentyi)\
**Replies:** 29\
**Last updated:** [August 23, 2018, 7:55am UTC](https://discuss.elastic.co/t/search-with-inject-attachment-too-long/145307 "2018-08-23T07:55:49Z")

</div>

Hello. I am using elasticsearch 5.4 and inject attachment plugin. I have indexed everything and search works fine. But the question is: when i index a lot of content files and perform search with excluding attachment.c…

---

## [How i can increase thread pool queue size in Elasticsearch 5.6](https://discuss.elastic.co/t/how-i-can-increase-thread-pool-queue-size-in-elasticsearch-5-6/145661)

<div class="topic-metadata">

**Author:** [@amitshar04](https://discuss.elastic.co/u/amitshar04)\
**Replies:** 6\
**Last updated:** [August 23, 2018, 7:31am UTC](https://discuss.elastic.co/t/how-i-can-increase-thread-pool-queue-size-in-elasticsearch-5-6/145661 "2018-08-23T07:31:28Z")

</div>

thread pool queue size how can make changes in elasticsearch.yml file for increasing thread pool queue size setting ? i am using Elasticsearch 5.6 Please help !!

---

## [Elasticsearch on Google Compute - Network issues and shard lock fails](https://discuss.elastic.co/t/elasticsearch-on-google-compute-network-issues-and-shard-lock-fails/145459)

<div class="topic-metadata">

**Author:** [@eranhirs](https://discuss.elastic.co/u/eranhirs)\
**Replies:** 1\
**Last updated:** [August 23, 2018, 7:18am UTC](https://discuss.elastic.co/t/elasticsearch-on-google-compute-network-issues-and-shard-lock-fails/145459 "2018-08-23T07:18:22Z")

</div>

Some tech background - I have 5 nodes in the cluster, all are configured as both master and data nodes, around 2TB of data, all of them run with docker. I just moved my cluster from AWS EC2 to Google Compute, and lookin…

---

## [How does the ELK people earn money and support continuous development?](https://discuss.elastic.co/t/how-does-the-elk-people-earn-money-and-support-continuous-development/145319)

<div class="topic-metadata">

**Author:** [@groverjatin17](https://discuss.elastic.co/u/groverjatin17)\
**Replies:** 4\
**Last updated:** [August 23, 2018, 7:10am UTC](https://discuss.elastic.co/t/how-does-the-elk-people-earn-money-and-support-continuous-development/145319 "2018-08-23T07:10:10Z")

</div>

I am fairly new to this and i was asked this question by my manager and i had not answer. i have read few terms like paid elastic cloud subscription or plugins but can anyone please explain Who and How's of the various w…

---

## [How to find optimal value for setting search.max\_buckets](https://discuss.elastic.co/t/how-to-find-optimal-value-for-setting-search-max-buckets/145665)

<div class="topic-metadata">

**Author:** [@ishantanu](https://discuss.elastic.co/u/ishantanu)\
**Replies:** 0\
**Last updated:** [August 23, 2018, 6:46am UTC](https://discuss.elastic.co/t/how-to-find-optimal-value-for-setting-search-max-buckets/145665 "2018-08-23T06:46:23Z")

</div>

Hi, I am recently facing an issue for a visualization (visual builder) which use "Max" aggregation on a numeric field whose result is them grouped by another field. Now, when I group the aggregation by everything, I ca…

---

## [Assign a group of users READ only access to certain indices while allowing them to create visualizations?](https://discuss.elastic.co/t/assign-a-group-of-users-read-only-access-to-certain-indices-while-allowing-them-to-create-visualizations/145651)

<div class="topic-metadata">

**Author:** [@victor.nilsson](https://discuss.elastic.co/u/victor.nilsson)\
**Replies:** 2\
**Last updated:** [August 23, 2018, 6:03am UTC](https://discuss.elastic.co/t/assign-a-group-of-users-read-only-access-to-certain-indices-while-allowing-them-to-create-visualizations/145651 "2018-08-23T06:03:46Z")

</div>

Hi, We have set up AD authentication for our ELK stack and have successfully mapped ELK roles to our AD-groups which is working fantastically. Now we want to allow them to create visualizations as well, what is the reco…

---

## [Search API using aggregation](https://discuss.elastic.co/t/search-api-using-aggregation/145541)

<div class="topic-metadata">

**Author:** [@Raghuveer\_SJ](https://discuss.elastic.co/u/Raghuveer_SJ)\
**Replies:** 0\
**Last updated:** [August 22, 2018, 11:19am UTC](https://discuss.elastic.co/t/search-api-using-aggregation/145541 "2018-08-22T11:19:20Z")

</div>

I have started learning JAVA search APIs on elasticsearch 6.3.2 and want to be compatible for future use, i don't want to use TransportClient. I would like to run a query using aggregation something in SQL world would lo…

---

## [Elasticsearch node/os stats show 0 cpu usage on Ubuntu 16.04LTS](https://discuss.elastic.co/t/elasticsearch-node-os-stats-show-0-cpu-usage-on-ubuntu-16-04lts/145655)

<div class="topic-metadata">

**Author:** [@pdeaudney](https://discuss.elastic.co/u/pdeaudney)\
**Replies:** 0\
**Last updated:** [August 23, 2018, 6:09am UTC](https://discuss.elastic.co/t/elasticsearch-node-os-stats-show-0-cpu-usage-on-ubuntu-16-04lts/145655 "2018-08-23T06:09:43Z")

</div>

Hi, My ES cluster is operating on ubuntu 16.04 LTS and is running version 6.3.2 (deb install) When I use kibana my dashboard for the nodes show 0% cpu usage. When I query GET /\_nodes/stats/os,process I also see 0% cpu…

---

## [How aggregation work in Java API](https://discuss.elastic.co/t/how-aggregation-work-in-java-api/145649)

<div class="topic-metadata">

**Author:** [@arepalli.ram1987](https://discuss.elastic.co/u/arepalli.ram1987)\
**Replies:** 2\
**Last updated:** [August 23, 2018, 6:02am UTC](https://discuss.elastic.co/t/how-aggregation-work-in-java-api/145649 "2018-08-23T06:02:40Z")

</div>

Hi how will work aggregation in java api. i have query which will get the records of 50000 and aggregation result is 15000 records. is it perform the aggregation on 50000 records or 10000 records. why because max output…

---

## [Mapping inconsistent error](https://discuss.elastic.co/t/mapping-inconsistent-error/145638)

<div class="topic-metadata">

**Author:** [@bob28](https://discuss.elastic.co/u/bob28)\
**Replies:** 0\
**Last updated:** [August 23, 2018, 3:44am UTC](https://discuss.elastic.co/t/mapping-inconsistent-error/145638 "2018-08-23T03:44:14Z")

</div>

Hi, When I read from elasticsearch, I am getting field position not fount and mapping inconsistency error. Could you please let me know how to resolve this issue and why we get this error normally and what kind of step…

---

## [Rollup - type \[RangeAggregationBuilder\] is currently unsupported](https://discuss.elastic.co/t/rollup-type-rangeaggregationbuilder-is-currently-unsupported/144418)

<div class="topic-metadata">

**Author:** [@Paul\_Ainslie](https://discuss.elastic.co/u/Paul_Ainslie)\
**Replies:** 2\
**Last updated:** [August 23, 2018, 3:36am UTC](https://discuss.elastic.co/t/rollup-type-rangeaggregationbuilder-is-currently-unsupported/144418 "2018-08-23T03:36:23Z")

</div>

Is there a way of rewriting this query so it works on a \_rollup\_search? It works on the raw index, but I get this error on the rollup index. { "error": { "root\_cause": \[ { "type": "illegal\_argument\_…

---

## [Cluster in Yellow](https://discuss.elastic.co/t/cluster-in-yellow/145630)

<div class="topic-metadata">

**Author:** [@newlearner](https://discuss.elastic.co/u/newlearner)\
**Replies:** 0\
**Last updated:** [August 23, 2018, 2:23am UTC](https://discuss.elastic.co/t/cluster-in-yellow/145630 "2018-08-23T02:23:39Z")

</div>

Hi team I have .watches replica in UNASSIGNED state due to which my cluster in showing Yellow .watches 0 p STARTED .watches 0 r UNASSIGNED I restarted t…

---

## [About intersection functionality](https://discuss.elastic.co/t/about-intersection-functionality/145153)

<div class="topic-metadata">

**Author:** [@Acepcs](https://discuss.elastic.co/u/Acepcs)\
**Replies:** 13\
**Last updated:** [August 23, 2018, 2:02am UTC](https://discuss.elastic.co/t/about-intersection-functionality/145153 "2018-08-23T02:02:44Z")

</div>

Hi all, I am encountering a problem about intersection functionality. I have the following mapping: { "message": {"type": "text"}, "created\_at": {"type": "date", "format": "yyyy-MM-dd HH:mm:ss||yyyy-MM-dd||epoch\_mill…

---

## [How to add keyword field on elasticsearch mapping](https://discuss.elastic.co/t/how-to-add-keyword-field-on-elasticsearch-mapping/145627)

<div class="topic-metadata">

**Author:** [@bamboo2222](https://discuss.elastic.co/u/bamboo2222)\
**Replies:** 0\
**Last updated:** [August 23, 2018, 1:16am UTC](https://discuss.elastic.co/t/how-to-add-keyword-field-on-elasticsearch-mapping/145627 "2018-08-23T01:16:58Z")

</div>

I want to do aggregation on text keyword field, but accidentally delete all keyword field of the index on Kibana. Can I fix this in the mapping by adding keyword field? Thanks!

---

## [Range query become slower in elasticsearch benchmark](https://discuss.elastic.co/t/range-query-become-slower-in-elasticsearch-benchmark/145572)

<div class="topic-metadata">

**Author:** [@ginger](https://discuss.elastic.co/u/ginger)\
**Replies:** 1\
**Last updated:** [August 23, 2018, 12:54am UTC](https://discuss.elastic.co/t/range-query-become-slower-in-elasticsearch-benchmark/145572 "2018-08-23T00:54:18Z")

</div>

Hi, all. we are now using ES 5.6.4 and plan to upgrade to ES 6.3.2. During test, we found that the range query has become slower when using ES 6.3.2. Then we check Elasticsearch Benchmarks. The benchmarks also show rang…

---

## [How to scale the Coordinator nodes in ES](https://discuss.elastic.co/t/how-to-scale-the-coordinator-nodes-in-es/145615)

<div class="topic-metadata">

**Author:** [@john\_99](https://discuss.elastic.co/u/john_99)\
**Replies:** 0\
**Last updated:** [August 22, 2018, 9:36pm UTC](https://discuss.elastic.co/t/how-to-scale-the-coordinator-nodes-in-es/145615 "2018-08-22T21:36:14Z")

</div>

Hi, We are trying to add coordinator nodes in our current ES cluster V6. How to scale or estimate this nodes for enough query load in introducing dedicated coordinator nodes. the current search rate was 2000 and indic…

---

## [Write heavy cluster, more RAM or CPU?](https://discuss.elastic.co/t/write-heavy-cluster-more-ram-or-cpu/145612)

<div class="topic-metadata">

**Author:** [@suanmeiguo](https://discuss.elastic.co/u/suanmeiguo)\
**Replies:** 1\
**Last updated:** [August 22, 2018, 8:43pm UTC](https://discuss.elastic.co/t/write-heavy-cluster-more-ram-or-cpu/145612 "2018-08-22T20:43:39Z")

</div>

I'm using EC2 instance. Looking at i3.2xlarge which gives a tons of storage, but wondering if that's the best for write heavy cluster. There will be maybe 70% insert/upsert, and 20% scan query, with probably just 10% ge…

---

## [Dev tools vs filter query. Two different totals](https://discuss.elastic.co/t/dev-tools-vs-filter-query-two-different-totals/145611)

<div class="topic-metadata">

**Author:** [@chapmantrain](https://discuss.elastic.co/u/chapmantrain)\
**Replies:** 0\
**Last updated:** [August 22, 2018, 8:36pm UTC](https://discuss.elastic.co/t/dev-tools-vs-filter-query-two-different-totals/145611 "2018-08-22T20:36:37Z")

</div>

This is the query in question. { "query": { "bool": { "filter": { "range": { "@timestamp": { "gte": "now-12h" } } }, "must": \[{ "match": { "type.keyword": "camunda.log" } }, { …

---

## [How to sort based on sum of multiple field value counts](https://discuss.elastic.co/t/how-to-sort-based-on-sum-of-multiple-field-value-counts/145602)

<div class="topic-metadata">

**Author:** [@elpaisa](https://discuss.elastic.co/u/elpaisa)\
**Replies:** 1\
**Last updated:** [August 22, 2018, 7:03pm UTC](https://discuss.elastic.co/t/how-to-sort-based-on-sum-of-multiple-field-value-counts/145602 "2018-08-22T19:03:01Z")

</div>

Hi, I have a use case for sorting documents based on the sum of counts of values for an specific field, lets say i have a field rating, and the search query gives 20 docs with rating:High, and 30 with rating:Critical, f…

---

## [Feature request: Could the docker image allow more customization so that we don't have to keep making custom images based on this one](https://discuss.elastic.co/t/feature-request-could-the-docker-image-allow-more-customization-so-that-we-dont-have-to-keep-making-custom-images-based-on-this-one/145210)

<div class="topic-metadata">

**Author:** [@yokhahn](https://discuss.elastic.co/u/yokhahn)\
**Replies:** 2\
**Last updated:** [August 22, 2018, 4:34pm UTC](https://discuss.elastic.co/t/feature-request-could-the-docker-image-allow-more-customization-so-that-we-dont-have-to-keep-making-custom-images-based-on-this-one/145210 "2018-08-22T16:34:38Z")

</div>

I'm trying to use the official docker image, via a helm chart. One of the problems that I keep running into is that the architecture of the current image requires customizing the docker image to make many configurations …

---

## [Word ngrams with match phrase](https://discuss.elastic.co/t/word-ngrams-with-match-phrase/145582)

<div class="topic-metadata">

**Author:** [@peterbe](https://discuss.elastic.co/u/peterbe)\
**Replies:** 0\
**Last updated:** [August 22, 2018, 3:44pm UTC](https://discuss.elastic.co/t/word-ngrams-with-match-phrase/145582 "2018-08-22T15:44:17Z")

</div>

I've indexed my documents with a common\_grams token filter. It's working well. If I search for kiss the frog it will find documents, when searching with match phrase query, that contains text like you must kiss the frog…

---

## [Way to apply date range on date math indices](https://discuss.elastic.co/t/way-to-apply-date-range-on-date-math-indices/145410)

<div class="topic-metadata">

**Author:** [@Indrani](https://discuss.elastic.co/u/Indrani)\
**Replies:** 3\
**Last updated:** [August 22, 2018, 3:31pm UTC](https://discuss.elastic.co/t/way-to-apply-date-range-on-date-math-indices/145410 "2018-08-22T15:31:43Z")

</div>

Is there a way to query data from multiple date math indices by date range ? I have only seen by giving comma separated date math indices for searching, If I have to search over a year, it is difficult keep all the indi…

---

## [Get index number in the bucket of specific key](https://discuss.elastic.co/t/get-index-number-in-the-bucket-of-specific-key/145524)

<div class="topic-metadata">

**Author:** [@Izek](https://discuss.elastic.co/u/Izek)\
**Replies:** 2\
**Last updated:** [August 22, 2018, 2:00pm UTC](https://discuss.elastic.co/t/get-index-number-in-the-bucket-of-specific-key/145524 "2018-08-22T14:00:46Z")

</div>

"daily\_rank": { "buckets": \[ { "key\_as\_string": "2018-08-20T00:00:00.000Z", "key": 1534723200000, "doc\_count": 2878, "game": { "doc\_count\_error\_upper\_bound": 0, "sum\_other\_do…

---

## [Restore-elastic-search-snapshot-from-2-2-1-to-6-3-0](https://discuss.elastic.co/t/restore-elastic-search-snapshot-from-2-2-1-to-6-3-0/145529)

<div class="topic-metadata">

**Author:** [@deepsing](https://discuss.elastic.co/u/deepsing)\
**Replies:** 8\
**Last updated:** [August 22, 2018, 12:51pm UTC](https://discuss.elastic.co/t/restore-elastic-search-snapshot-from-2-2-1-to-6-3-0/145529 "2018-08-22T12:51:34Z")

</div>

I read that we can directly upgrade indices from 2.2.1 to 6.3.0. So First I upgraded it from 2.2.1 to 5.6.0 Now I am Trying to restore elastic search backup from 5.6.0 to 6.3.0 Following the below steps: update elas…

---

## [What is the current recommendation for creating integration tests that need a cluster?](https://discuss.elastic.co/t/what-is-the-current-recommendation-for-creating-integration-tests-that-need-a-cluster/145406)

<div class="topic-metadata">

**Author:** [@Marco\_Costantini](https://discuss.elastic.co/u/Marco_Costantini)\
**Replies:** 4\
**Last updated:** [August 22, 2018, 12:49pm UTC](https://discuss.elastic.co/t/what-is-the-current-recommendation-for-creating-integration-tests-that-need-a-cluster/145406 "2018-08-22T12:49:39Z")

</div>

We are using ES versoin 5.5. We have a very simple program that transforms some data and writes it to ES. I want to create some integration tests but am having much trouble. My trouble is that nothing is working or worki…

---

## [Size parameter - how to check all stats in field](https://discuss.elastic.co/t/size-parameter-how-to-check-all-stats-in-field/145525)

<div class="topic-metadata">

**Author:** [@\_Sergey](https://discuss.elastic.co/u/_Sergey)\
**Replies:** 1\
**Last updated:** [August 22, 2018, 12:47pm UTC](https://discuss.elastic.co/t/size-parameter-how-to-check-all-stats-in-field/145525 "2018-08-22T12:47:24Z")

</div>

Hey community, Can you advise how correctly use parameter "size". I faced with situation when I need to use size (e.g, for field user, where a lot of user\_names are presented). When I use size: 500, I only will see 500 …

[Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1570)

[Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1572)
