# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1580 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1581 --- ## [My Geo Distance Query](https://discuss.elastic.co/t/my-geo-distance-query/144096)
**Author:** [@orange-jacky](https://discuss.elastic.co/u/orange-jacky)\ **Replies:** 3\ **Last updated:** [August 15, 2018, 6:52am UTC](https://discuss.elastic.co/t/my-geo-distance-query/144096 "2018-08-15T06:52:47Z")
hello, anyone i have a geo distance query function, and anyone can tell me how to realize it with elastichsearch. hope replies. thank you description: there are lots of records, one record one line, every record has … --- ## [Guide to getting assistance](https://discuss.elastic.co/t/guide-to-getting-assistance/144399)
**Author:** [@bigdamhero](https://discuss.elastic.co/u/bigdamhero)\ **Replies:** 2\ **Last updated:** [August 15, 2018, 6:37am UTC](https://discuss.elastic.co/t/guide-to-getting-assistance/144399 "2018-08-15T06:37:11Z")
I have been tasked with setting up a production Elastic Stack. I work in Health Care and have many security concerns. We just purchased an Elastic Licence. Is the provided Support enough to get set up or should I be l… --- ## [Query function script score if multiple values in a field](https://discuss.elastic.co/t/query-function-script-score-if-multiple-values-in-a-field/144181)
**Author:** [@atom](https://discuss.elastic.co/u/atom)\ **Replies:** 2\ **Last updated:** [August 15, 2018, 6:31am UTC](https://discuss.elastic.co/t/query-function-script-score-if-multiple-values-in-a-field/144181 "2018-08-15T06:31:44Z")
Hi, I have a question about creating the following query: My field location can store multiple values in it, e.g.: "geolocations": \[ "51.2171728, 8.654843", "50.2171728, 8.645487", \] Is it possible to incre… --- ## [Painless Script to Concat in ReIndex API](https://discuss.elastic.co/t/painless-script-to-concat-in-reindex-api/143203)
**Author:** [@code\_blue](https://discuss.elastic.co/u/code_blue)\ **Replies:** 2\ **Last updated:** [August 15, 2018, 5:49am UTC](https://discuss.elastic.co/t/painless-script-to-concat-in-reindex-api/143203 "2018-08-15T05:49:52Z")
I am trying to concat 2 fields using painless script during ReIndex API call. However not able to get the correct syntax. field3=field1,field2. The below code is throwing a parsing exception POST \_reindex { "sour… --- ## [Offload cold data to s3 in cloud](https://discuss.elastic.co/t/offload-cold-data-to-s3-in-cloud/144441)
**Author:** [@yiguolei](https://discuss.elastic.co/u/yiguolei)\ **Replies:** 5\ **Last updated:** [August 15, 2018, 5:23am UTC](https://discuss.elastic.co/t/offload-cold-data-to-s3-in-cloud/144441 "2018-08-15T05:23:51Z")
In log analysis scenario, user could offload the cold data to s3 to reduce the cost. For example, vertica has support this feature. Does es have the plan to do this? --- ## [Create index can use connector with '-', but X-Pack error](https://discuss.elastic.co/t/create-index-can-use-connector-with-but-x-pack-error/144443)
**Author:** [@Crab2died](https://discuss.elastic.co/u/Crab2died)\ **Replies:** 0\ **Last updated:** [August 15, 2018, 3:21am UTC](https://discuss.elastic.co/t/create-index-can-use-connector-with-but-x-pack-error/144443 "2018-08-15T03:21:29Z")
Create index can use connector with '-', but X-Pack search error : { "error": { "root\_cause": \[ { "type": "parsing\_exception", "reason": "line 1:19: mismatched input '-' expecting {\, ',', 'F… --- ## [How to manage the permission of indices](https://discuss.elastic.co/t/how-to-manage-the-permission-of-indices/144350)
**Author:** [@talon](https://discuss.elastic.co/u/talon)\ **Replies:** 2\ **Last updated:** [August 15, 2018, 1:12am UTC](https://discuss.elastic.co/t/how-to-manage-the-permission-of-indices/144350 "2018-08-15T01:12:22Z")
Hi I have a requirement i have enable SAML authentication in ELK, i have assigned user in different group on the AD side. so the SAML attributes contain the group message of user. so i want to assigned user different… --- ## [Alert when no messages are recieved](https://discuss.elastic.co/t/alert-when-no-messages-are-recieved/144283)
**Author:** [@cowensel](https://discuss.elastic.co/u/cowensel)\ **Replies:** 1\ **Last updated:** [August 15, 2018, 12:53am UTC](https://discuss.elastic.co/t/alert-when-no-messages-are-recieved/144283 "2018-08-15T00:53:39Z")
I am currently looking at the possibility of being alerted when no messages being received from the heartbeat input from logstash. Has anyone got any suggestion on how to do it without paying for x-pack or installing ela… --- ## [Wildcard query in multi match cross fields](https://discuss.elastic.co/t/wildcard-query-in-multi-match-cross-fields/144434)
**Author:** [@Realz](https://discuss.elastic.co/u/Realz)\ **Replies:** 0\ **Last updated:** [August 15, 2018, 12:34am UTC](https://discuss.elastic.co/t/wildcard-query-in-multi-match-cross-fields/144434 "2018-08-15T00:34:53Z")
Hello, Is there a way to add a wildcard option in a multi match type cross field query? "query" =\> \[ "bool" =\> \[ "should" =\> \[ "multi\_match" =\>… --- ## [Ability to stop and start a cluster without shard movement part2](https://discuss.elastic.co/t/ability-to-stop-and-start-a-cluster-without-shard-movement-part2/143767)
**Author:** [@antonpious](https://discuss.elastic.co/u/antonpious)\ **Replies:** 4\ **Last updated:** [August 14, 2018, 11:50pm UTC](https://discuss.elastic.co/t/ability-to-stop-and-start-a-cluster-without-shard-movement-part2/143767 "2018-08-14T23:50:13Z")
Had to park this issue as we had other things, restarting this thread. . We tested ES cluster stop and start again with the equal number of shards (204) in all the 7 nodes. \[root@elasticsearch2 share\]# curl 'elas… --- ## [Aggregation count are not matching with bucket results](https://discuss.elastic.co/t/aggregation-count-are-not-matching-with-bucket-results/144426)
**Author:** [@snigdharao](https://discuss.elastic.co/u/snigdharao)\ **Replies:** 0\ **Last updated:** [August 14, 2018, 11:31pm UTC](https://discuss.elastic.co/t/aggregation-count-are-not-matching-with-bucket-results/144426 "2018-08-14T23:31:52Z")
I have a scenario where a field is of array data type and i need to perform autocomplete. I have to filter my aggregation results.I am not able to do it for some reason , Attaching my query and results.Please let me kno… --- ## [Applying license for one node](https://discuss.elastic.co/t/applying-license-for-one-node/144395)
**Author:** [@chandra0651](https://discuss.elastic.co/u/chandra0651)\ **Replies:** 1\ **Last updated:** [August 14, 2018, 9:47pm UTC](https://discuss.elastic.co/t/applying-license-for-one-node/144395 "2018-08-14T21:47:42Z")
Hello Cluster License got expired in my cluster , i applied the license through kibana , but during that time one of my Elasticsearch node is down and the license was not applied to that particular node. How can i apply … --- ## [Elasticseach index problem - closing randomly](https://discuss.elastic.co/t/elasticseach-index-problem-closing-randomly/143917)
**Author:** [@Sanj\_Gunetileke](https://discuss.elastic.co/u/Sanj_Gunetileke)\ **Replies:** 5\ **Last updated:** [August 14, 2018, 9:37pm UTC](https://discuss.elastic.co/t/elasticseach-index-problem-closing-randomly/143917 "2018-08-14T21:37:38Z")
Hello, I have a node with 3 indexes and each index has 3 shards. Total disk usage is about 9GB. OS: Windows server 2016 (virtual machine) ES: 6.2.4 memory: 16GB HD: 250GB. Virusscanner: mcafee. Some indexes close… --- ## [Downgrading Elasticsearch and Kibana 6.3.2 to 6.2 under Windows](https://discuss.elastic.co/t/downgrading-elasticsearch-and-kibana-6-3-2-to-6-2-under-windows/144130)
**Author:** [@aeimbeck](https://discuss.elastic.co/u/aeimbeck)\ **Replies:** 1\ **Last updated:** [August 14, 2018, 9:04pm UTC](https://discuss.elastic.co/t/downgrading-elasticsearch-and-kibana-6-3-2-to-6-2-under-windows/144130 "2018-08-14T21:04:37Z")
For testing purposes, I want to install Canvas to my ES 6.3.2 installation. As I get the error message, that I need a lower version of Kibana, I need to downgrade my ES 6.3.2 to 6.2 installation. As I do not want to lose… --- ## [Some questions regarding dedicated monitoring cluster](https://discuss.elastic.co/t/some-questions-regarding-dedicated-monitoring-cluster/144218)
**Author:** [@voiprodrigo](https://discuss.elastic.co/u/voiprodrigo)\ **Replies:** 1\ **Last updated:** [August 14, 2018, 9:01pm UTC](https://discuss.elastic.co/t/some-questions-regarding-dedicated-monitoring-cluster/144218 "2018-08-14T21:01:08Z")
Hi, I've setup a dedicated 3-node monitoring cluster. Using 6.3.2 throughout. Currently I can see monitoring data about the monitoring cluster itself. Q1: With Basic license, can I setup one other cluster to export mon… --- ## [Best Practice for Multiple ES Nodes Setup in Production](https://discuss.elastic.co/t/best-practice-for-multiple-es-nodes-setup-in-production/144391)
**Author:** [@samwzm](https://discuss.elastic.co/u/samwzm)\ **Replies:** 1\ **Last updated:** [August 14, 2018, 8:40pm UTC](https://discuss.elastic.co/t/best-practice-for-multiple-es-nodes-setup-in-production/144391 "2018-08-14T20:40:21Z")
Hi, there, I would greatly appreciate if anyone can share some insight about the elastic search cluster setup for the production environment. First question is about the data node numbers and hardware guidance to meet … --- ## [Correct Way to Execute Not Exists and Not Empty Query for Not\_Analyzed Fields in Nested Document](https://discuss.elastic.co/t/correct-way-to-execute-not-exists-and-not-empty-query-for-not-analyzed-fields-in-nested-document/143390)
**Author:** [@shalini\_hemachandran](https://discuss.elastic.co/u/shalini_hemachandran)\ **Replies:** 2\ **Last updated:** [August 14, 2018, 8:13pm UTC](https://discuss.elastic.co/t/correct-way-to-execute-not-exists-and-not-empty-query-for-not-analyzed-fields-in-nested-document/143390 "2018-08-14T20:13:56Z")
Hi, I have a "not\_analyzed" field as part of a nested document in my schema. A sample document is given below "\_source": { "identifier": 123, . . "nested\_doc\_name\_xyz":\[ { "not\_analyzed\_fi… --- ## [Script fields in nested query](https://discuss.elastic.co/t/script-fields-in-nested-query/144235)
**Author:** [@andreacfm](https://discuss.elastic.co/u/andreacfm)\ **Replies:** 1\ **Last updated:** [August 14, 2018, 8:09pm UTC](https://discuss.elastic.co/t/script-fields-in-nested-query/144235 "2018-08-14T20:09:49Z")
Is there a way to run a "script\_fields" adding fields to the returned inner\_hits? Example: { "nested": { "inner\_hits": {}, "path": "companies", "score\_mode": "sum", "query": {}, "script\_… --- ## [Setting up Active Directory Authentication Realm in 6.3](https://discuss.elastic.co/t/setting-up-active-directory-authentication-realm-in-6-3/144167)
**Author:** [@bigdamhero](https://discuss.elastic.co/u/bigdamhero)\ **Replies:** 15\ **Last updated:** [August 14, 2018, 7:54pm UTC](https://discuss.elastic.co/t/setting-up-active-directory-authentication-realm-in-6-3/144167 "2018-08-14T19:54:45Z")
I have realm settings in my elasticsearch.yml, elasticsearch is working without errors (so I think) as a single node. I have the realms configured as follows: xpack.security.authc.realms: realm1: type: native … --- ## [Detecting shifts in count in ELK with field](https://discuss.elastic.co/t/detecting-shifts-in-count-in-elk-with-field/144303)
**Author:** [@waqark3389](https://discuss.elastic.co/u/waqark3389)\ **Replies:** 2\ **Last updated:** [August 14, 2018, 7:00pm UTC](https://discuss.elastic.co/t/detecting-shifts-in-count-in-elk-with-field/144303 "2018-08-14T19:00:51Z")
Hi, I have some data inside 6.3 ELK. I wanted to monitor a particular field called 'hostname' and the count of this field over time (for example past 24 hours), which is easy enough to do. However is there a way to ale… --- ## [Script sort by descending order](https://discuss.elastic.co/t/script-sort-by-descending-order/144254)
**Author:** [@Xiaofeng\_Zhan](https://discuss.elastic.co/u/Xiaofeng_Zhan)\ **Replies:** 1\ **Last updated:** [August 14, 2018, 6:45pm UTC](https://discuss.elastic.co/t/script-sort-by-descending-order/144254 "2018-08-14T18:45:00Z")
Hello, I need to write a painless sorting script, sorting by first name and last name, descending order. The existing script is sorting by first name and last name, ascending order. The script is like below String AL… --- ## [Delete old indices](https://discuss.elastic.co/t/delete-old-indices/144385)
**Author:** [@riteshun](https://discuss.elastic.co/u/riteshun)\ **Replies:** 1\ **Last updated:** [August 14, 2018, 6:43pm UTC](https://discuss.elastic.co/t/delete-old-indices/144385 "2018-08-14T18:43:35Z")
In our system we have rollover indices named in the pattern abc-logs-000001. We have rollover either on max\_age 1day or max\_size 5gb. Now overtime we have lot of old indices. We are already using curator for rollovers, b… --- ## [Filter results of bucket](https://discuss.elastic.co/t/filter-results-of-bucket/144387)
**Author:** [@snigdharao](https://discuss.elastic.co/u/snigdharao)\ **Replies:** 0\ **Last updated:** [August 14, 2018, 6:32pm UTC](https://discuss.elastic.co/t/filter-results-of-bucket/144387 "2018-08-14T18:32:40Z")
is there way to filter results of backet like facet.prefix in solr. GET contracts/doc/\_search { "\_source": "commodity\_line", "size":0, "query":{ "bool":{ "must":{ "match":{ "commodity\_line.k… --- ## [How to export data from elastic search per ETL?](https://discuss.elastic.co/t/how-to-export-data-from-elastic-search-per-etl/144343)
**Author:** [@Martin\_1982](https://discuss.elastic.co/u/Martin_1982)\ **Replies:** 1\ **Last updated:** [August 14, 2018, 6:24pm UTC](https://discuss.elastic.co/t/how-to-export-data-from-elastic-search-per-etl/144343 "2018-08-14T18:24:57Z")
Hi, recently i realised that there a lot of ways to import data to elasticsearch, but its kind of hard to export data if you want to join other data sources and do analytics outside elastic search. Are there any best p… --- ## [Field type keyword aggregation returns zero results](https://discuss.elastic.co/t/field-type-keyword-aggregation-returns-zero-results/144383)
**Author:** [@Akshay\_Deshpande](https://discuss.elastic.co/u/Akshay_Deshpande)\ **Replies:** 0\ **Last updated:** [August 14, 2018, 6:13pm UTC](https://discuss.elastic.co/t/field-type-keyword-aggregation-returns-zero-results/144383 "2018-08-14T18:13:53Z")
I have an index with below mapping { "image-removal-rcpt-index-2018-07-02-1": { "mappings": { "imageremovalrcpt": { "properties": { "blacklist\_id": { "type": "long" }, "customer\_id": { "type": "text", "fields"… --- ## [X-pack License info](https://discuss.elastic.co/t/x-pack-license-info/143630)
**Author:** [@Tek\_Chand](https://discuss.elastic.co/u/Tek_Chand)\ **Replies:** 4\ **Last updated:** [August 14, 2018, 5:21pm UTC](https://discuss.elastic.co/t/x-pack-license-info/143630 "2018-08-14T17:21:08Z")
Hello All, I am running Elasticsearch cluster with 3 nodes. All are working as master node as well as data node. Now i want to monitor my cluster. But i want to know the cost of X-pack license and how we use them means … --- ## [Architecture Validation for Production ES Environmet](https://discuss.elastic.co/t/architecture-validation-for-production-es-environmet/144008)
**Author:** [@preraktiwari](https://discuss.elastic.co/u/preraktiwari)\ **Replies:** 6\ **Last updated:** [August 14, 2018, 2:17pm UTC](https://discuss.elastic.co/t/architecture-validation-for-production-es-environmet/144008 "2018-08-14T14:17:25Z")
We are migrating our old system to ElasticSearch. We have our data centers distributed across two location (one primary and one DR). We are thinking of keeping following structure in Production: We have existing data … --- ## [Machine Learning Multiple Split Data Fields](https://discuss.elastic.co/t/machine-learning-multiple-split-data-fields/144344)
**Author:** [@ryanrossiter](https://discuss.elastic.co/u/ryanrossiter)\ **Replies:** 1\ **Last updated:** [August 14, 2018, 1:45pm UTC](https://discuss.elastic.co/t/machine-learning-multiple-split-data-fields/144344 "2018-08-14T13:45:00Z")
Hi I'm working on creating Machine Learning jobs and was wondering if there is any way to use multiple fields in the "Split Data" field? I ask this because I would like one series to represent an individual node, but mul… --- ## [Elasticsearch curator ( python module) curator\_cli not working](https://discuss.elastic.co/t/elasticsearch-curator-python-module-curator-cli-not-working/144156)
**Author:** [@prasadkkl](https://discuss.elastic.co/u/prasadkkl)\ **Replies:** 5\ **Last updated:** [August 14, 2018, 12:07pm UTC](https://discuss.elastic.co/t/elasticsearch-curator-python-module-curator-cli-not-working/144156 "2018-08-14T12:07:33Z")
I am using Elasticsearch version : 5.6.10 . I am using python curator\_cli ( version 5.5.4) for deleting indexs only 1 day old. But getting error as "Singleton action failed due to empty index list". But when we do show… --- ## [Forecast Jobs API - expires\_in minutes(m) doesn't work](https://discuss.elastic.co/t/forecast-jobs-api-expires-in-minutes-m-doesnt-work/144148)
**Author:** [@Angelos](https://discuss.elastic.co/u/Angelos)\ **Replies:** 4\ **Last updated:** [August 14, 2018, 12:07pm UTC](https://discuss.elastic.co/t/forecast-jobs-api-expires-in-minutes-m-doesnt-work/144148 "2018-08-14T12:07:17Z")
Hello! I am trying to create a forecast job via console and when I set expires\_in to "1m", it creates the job ("acknowledged": true) but then it doesn't expire after 1 minute. The documentation redirect us to Time unit… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1579) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1581)