# Elasticsearch

**URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1581

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 1582

---

## [Could we monitor multiple ES clusters using a single Monitoring ES cluster?](https://discuss.elastic.co/t/could-we-monitor-multiple-es-clusters-using-a-single-monitoring-es-cluster/142472)

<div class="topic-metadata">

**Author:** [@sahil\_sawhney](https://discuss.elastic.co/u/sahil_sawhney)\
**Replies:** 6\
**Last updated:** [August 14, 2018, 12:03pm UTC](https://discuss.elastic.co/t/could-we-monitor-multiple-es-clusters-using-a-single-monitoring-es-cluster/142472 "2018-08-14T12:03:06Z")

</div>

I have a use case that i have 2 ES clusters let us say es1 and es2, is it possible that i can monitor both of these clusters using a single monitring ES custer let us say esMonit1. So what happens is when we enable xpac…

---

## [Enabling audit in 6.3.0 writes to \<cluster\>.log not to \<cluster\>\_access.log](https://discuss.elastic.co/t/enabling-audit-in-6-3-0-writes-to-cluster-log-not-to-cluster-access-log/144336)

<div class="topic-metadata">

**Author:** [@JohanRask](https://discuss.elastic.co/u/JohanRask)\
**Replies:** 2\
**Last updated:** [August 14, 2018, 11:57am UTC](https://discuss.elastic.co/t/enabling-audit-in-6-3-0-writes-to-cluster-log-not-to-cluster-access-log/144336 "2018-08-14T11:57:47Z")

</div>

Hi, we have re-enabled audit on our elasticsearch cluster, we had it disabled for a while. The documentation says that there should be a specific audit file \<cluster\>\_access.log and I am pretty sure that we have seen th…

---

## [CPU Core binding on Elastissearch](https://discuss.elastic.co/t/cpu-core-binding-on-elastissearch/144308)

<div class="topic-metadata">

**Author:** [@amit.patra](https://discuss.elastic.co/u/amit.patra)\
**Replies:** 4\
**Last updated:** [August 14, 2018, 11:43am UTC](https://discuss.elastic.co/t/cpu-core-binding-on-elastissearch/144308 "2018-08-14T11:43:31Z")

</div>

We have single node server with 256 GB RAM and 32 core processor. We are running elasticsearch , logstash and kibana. We want to bind the no of cores (example 8) for elasticsearch process only. Is there any configurati…

---

## [Geoshape vs geo point for polygon search](https://discuss.elastic.co/t/geoshape-vs-geo-point-for-polygon-search/144332)

<div class="topic-metadata">

**Author:** [@davidbkemp](https://discuss.elastic.co/u/davidbkemp)\
**Replies:** 0\
**Last updated:** [August 14, 2018, 10:54am UTC](https://discuss.elastic.co/t/geoshape-vs-geo-point-for-polygon-search/144332 "2018-08-14T10:54:12Z")

</div>

The Elasticsearch Definitive Guide states that polygon searches are more efficient for geo shapes than for geo points. The guide hasn’t been updated since version 2, and so I’m wondering if this is still the case? htt…

---

## ["Invalid UTF-8 middle byte 0x22](https://discuss.elastic.co/t/invalid-utf-8-middle-byte-0x22/144330)

<div class="topic-metadata">

**Author:** [@Andrea\_Boccaforno](https://discuss.elastic.co/u/Andrea_Boccaforno)\
**Replies:** 0\
**Last updated:** [August 14, 2018, 10:45am UTC](https://discuss.elastic.co/t/invalid-utf-8-middle-byte-0x22/144330 "2018-08-14T10:45:12Z")

</div>

Good morning when I make this request: { "query": { "bool": { "must": { "match": { "titolo": "'.$titolo\_check.'" } }, "filter": \[ { "term": { "superficie": "'.$superficie.'" } }, …

---

## [Delete data folder](https://discuss.elastic.co/t/delete-data-folder/144307)

<div class="topic-metadata">

**Author:** [@Raghuveer\_SJ](https://discuss.elastic.co/u/Raghuveer_SJ)\
**Replies:** 3\
**Last updated:** [August 14, 2018, 10:40am UTC](https://discuss.elastic.co/t/delete-data-folder/144307 "2018-08-14T10:40:44Z")

</div>

I am experimenting, I got some bad data loaded on to elasticsearch so thought to reload and deleted the path.data folder. The command rm -rf \* removed many things but ls: cannot access global-12.st: No such file or dire…

---

## [Es crashes with "Native controller process has stopped - no new native processes can be started"](https://discuss.elastic.co/t/es-crashes-with-native-controller-process-has-stopped-no-new-native-processes-can-be-started/143870)

<div class="topic-metadata">

**Author:** [@Andrea\_Boccaforno](https://discuss.elastic.co/u/Andrea_Boccaforno)\
**Replies:** 2\
**Last updated:** [August 13, 2018, 3:38pm UTC](https://discuss.elastic.co/t/es-crashes-with-native-controller-process-has-stopped-no-new-native-processes-can-be-started/143870 "2018-08-13T15:38:05Z")

</div>

Hello everyone, when I run the ./bin/elasticsearch command I get the following logs: \[...........\] \[2018-08-10T08:14:57,579\]\[INFO \]\[o.e.p.PluginsService \] \[ZGgC7Hb\] loaded module \[aggs-matrix-stats\] \[2018-08-10T0…

---

## [Ingest processor failure when accessing nested field](https://discuss.elastic.co/t/ingest-processor-failure-when-accessing-nested-field/144194)

<div class="topic-metadata">

**Author:** [@bukem](https://discuss.elastic.co/u/bukem)\
**Replies:** 8\
**Last updated:** [August 14, 2018, 9:57am UTC](https://discuss.elastic.co/t/ingest-processor-failure-when-accessing-nested-field/144194 "2018-08-14T09:57:26Z")

</div>

Hello, I'm facing the following problem: accessing nested field within ingest processor fails with an error. Simple example on how to reproduce the problem: Create 'nest\_test' index with mapping containing nested fie…

---

## [Regexp query is not working in elastaicsearch5.6](https://discuss.elastic.co/t/regexp-query-is-not-working-in-elastaicsearch5-6/144300)

<div class="topic-metadata">

**Author:** [@Vishnu\_P\_S](https://discuss.elastic.co/u/Vishnu_P_S)\
**Replies:** 0\
**Last updated:** [August 14, 2018, 8:37am UTC](https://discuss.elastic.co/t/regexp-query-is-not-working-in-elastaicsearch5-6/144300 "2018-08-14T08:37:37Z")

</div>

Hi I am working on elasticsearch 5.6.3, when I search with a query like ?q = Sample schema 3. Then this will return all records having any of these words sample,schema. Then I tried to search with ?q= \*Sample\*schema\*3\* …

---

## [ES: How to I delete the whole database contents and start clean again, without losing indexes & dashboards?](https://discuss.elastic.co/t/es-how-to-i-delete-the-whole-database-contents-and-start-clean-again-without-losing-indexes-dashboards/144310)

<div class="topic-metadata">

**Author:** [@minidan](https://discuss.elastic.co/u/minidan)\
**Replies:** 0\
**Last updated:** [August 14, 2018, 9:30am UTC](https://discuss.elastic.co/t/es-how-to-i-delete-the-whole-database-contents-and-start-clean-again-without-losing-indexes-dashboards/144310 "2018-08-14T09:30:02Z")

</div>

Ok, my server is still hosed (see below)... massive amount of unfixed shards etc https://discuss.elastic.co/t/elasticsearch-cluster-of-4-nodes-has-master-not-discovered-exception/124984/18 How do I delete the whole dat…

---

## [Keys in range aggregation](https://discuss.elastic.co/t/keys-in-range-aggregation/144309)

<div class="topic-metadata">

**Author:** [@dunaeth](https://discuss.elastic.co/u/dunaeth)\
**Replies:** 0\
**Last updated:** [August 14, 2018, 9:11am UTC](https://discuss.elastic.co/t/keys-in-range-aggregation/144309 "2018-08-14T09:11:39Z")

</div>

Hi, is there a particular reason behind the choice to use aggregation keys as bucket keys instead of bucket properties when using range aggregation ? Example : { ... "aggs": { "range0-4": { …

---

## [Cluster Status Red & Bootstrap Check Failed](https://discuss.elastic.co/t/cluster-status-red-bootstrap-check-failed/143189)

<div class="topic-metadata">

**Author:** [@Giuseppe\_Merlo](https://discuss.elastic.co/u/Giuseppe_Merlo)\
**Replies:** 3\
**Last updated:** [August 14, 2018, 8:42am UTC](https://discuss.elastic.co/t/cluster-status-red-bootstrap-check-failed/143189 "2018-08-14T08:42:12Z")

</div>

Hi guys, i'm using Elasticsearch with a custom application to save data and get analytics. My Elasticsearch is formed by only a node with so many indexes. This node contains unassigned shards that caused cluster healt…

---

## [Elastic platinum license and number of nodes](https://discuss.elastic.co/t/elastic-platinum-license-and-number-of-nodes/144221)

<div class="topic-metadata">

**Author:** [@mruthyu](https://discuss.elastic.co/u/mruthyu)\
**Replies:** 2\
**Last updated:** [August 14, 2018, 8:25am UTC](https://discuss.elastic.co/t/elastic-platinum-license-and-number-of-nodes/144221 "2018-08-14T08:25:17Z")

</div>

Let me know if the platinum license includes which all nodes? (Elasticsearch - hot and warm data nodes, Coordinating only nodes, Master nodes, Kibana, Logstash, Beats , X-Pack)

---

## [How to define field's name later?](https://discuss.elastic.co/t/how-to-define-fields-name-later/144209)

<div class="topic-metadata">

**Author:** [@sebastienf](https://discuss.elastic.co/u/sebastienf)\
**Replies:** 3\
**Last updated:** [August 14, 2018, 8:05am UTC](https://discuss.elastic.co/t/how-to-define-fields-name-later/144209 "2018-08-14T08:05:35Z")

</div>

I receive strings like this : "type|v1|v2|v3|v4|..." I split this one according the "|" and I insert in an index "index\_{type}" a document with fields named "v1" : {v1}, "v2" : {v2}, etc. Later (days, weeks...), labels…

---

## [\[ERROR\] Cannot race. Fatal track or load generator indication 	Child Aborted](https://discuss.elastic.co/t/error-cannot-race-fatal-track-or-load-generator-indication-child-aborted/144267)

<div class="topic-metadata">

**Author:** [@rui\_dong](https://discuss.elastic.co/u/rui_dong)\
**Replies:** 1\
**Last updated:** [August 14, 2018, 7:45am UTC](https://discuss.elastic.co/t/error-cannot-race-fatal-track-or-load-generator-indication-child-aborted/144267 "2018-08-14T07:45:20Z")

</div>

I am trying to put max load on my cluster with distributed load-drivers. I start “benchmark coordinator” on 10.3.75.152 esrally race --pipeline=benchmark-only --target-hosts=x.x.x.x:9200,y.y.y.y:9200,z,z,z,z:9200 --loa…

---

## [Can we update or delete document in ES latest version 6.3.2](https://discuss.elastic.co/t/can-we-update-or-delete-document-in-es-latest-version-6-3-2/144176)

<div class="topic-metadata">

**Author:** [@RameshNagargoje](https://discuss.elastic.co/u/RameshNagargoje)\
**Replies:** 3\
**Last updated:** [August 14, 2018, 4:52am UTC](https://discuss.elastic.co/t/can-we-update-or-delete-document-in-es-latest-version-6-3-2/144176 "2018-08-14T04:52:38Z")

</div>

Hi, I want to update existing documents as like sql query with where clause. UPDATE CUSTOMERS SET ADDRESS = 'Pune' WHERE ID = 6; And how we can delete documents as like sql quey DELETE FROM \*table\_name\* WHERE \*cond…

---

## [Not able to detect ES version](https://discuss.elastic.co/t/not-able-to-detect-es-version/142340)

<div class="topic-metadata">

**Author:** [@sheryl](https://discuss.elastic.co/u/sheryl)\
**Replies:** 1\
**Last updated:** [August 14, 2018, 3:55am UTC](https://discuss.elastic.co/t/not-able-to-detect-es-version/142340 "2018-08-14T03:55:58Z")

</div>

Exception in thread "main" org.elasticsearch.hadoop.EsHadoopIllegalArgumentException: Cannot detect ES version - typically this happens if the network/Elasticsearch cluster is not accessible or when targeting a WAN/Cloud…

---

## [Regexp character '!' doesnt work in ES dsl query even on type set as 'keyword' in mappings](https://discuss.elastic.co/t/regexp-character-doesnt-work-in-es-dsl-query-even-on-type-set-as-keyword-in-mappings/143842)

<div class="topic-metadata">

**Author:** [@nikitag](https://discuss.elastic.co/u/nikitag)\
**Replies:** 11\
**Last updated:** [August 14, 2018, 3:52am UTC](https://discuss.elastic.co/t/regexp-character-doesnt-work-in-es-dsl-query-even-on-type-set-as-keyword-in-mappings/143842 "2018-08-14T03:52:59Z")

</div>

The mapping of my Elastic search looks like below: { "settings": { "index": { "number\_of\_shards": "5", "number\_of\_replicas": "1" } }, "mappings": { "node": { "properties": { "…

---

## [How to save spark scala dataframe to elastic search](https://discuss.elastic.co/t/how-to-save-spark-scala-dataframe-to-elastic-search/142315)

<div class="topic-metadata">

**Author:** [@sheryl](https://discuss.elastic.co/u/sheryl)\
**Replies:** 1\
**Last updated:** [August 14, 2018, 3:45am UTC](https://discuss.elastic.co/t/how-to-save-spark-scala-dataframe-to-elastic-search/142315 "2018-08-14T03:45:57Z")

</div>

i am using this df to save into elasticsearch but it showing error --- ERROR NetworkClient: Node \[192.168.0.1:9200\] failed (Connection timed out: connect); no other nodes left - aborting... -- df.write.format("org.elas…

---

## [Could not index event to Elasticsearch - ES 6.3.2 Failed Mapping](https://discuss.elastic.co/t/could-not-index-event-to-elasticsearch-es-6-3-2-failed-mapping/144230)

<div class="topic-metadata">

**Author:** [@bsixel](https://discuss.elastic.co/u/bsixel)\
**Replies:** 1\
**Last updated:** [August 14, 2018, 2:53am UTC](https://discuss.elastic.co/t/could-not-index-event-to-elasticsearch-es-6-3-2-failed-mapping/144230 "2018-08-14T02:53:24Z")

</div>

Hello, I've been working on getting some dates parsed in Elasticsearch and have been occasionally getting errors from elasticsearch/logstash about a failure to index one of my documents. I suspect it has something to do …

---

## [Different docFreq and docCount for the same shard](https://discuss.elastic.co/t/different-docfreq-and-doccount-for-the-same-shard/144083)

<div class="topic-metadata">

**Author:** [@laigood](https://discuss.elastic.co/u/laigood)\
**Replies:** 0\
**Last updated:** [August 13, 2018, 6:56am UTC](https://discuss.elastic.co/t/different-docfreq-and-doccount-for-the-same-shard/144083 "2018-08-13T06:56:02Z")

</div>

I try to figure out why my docs are ranked not as expect.I found that the 1st doc docFreq=1 and docCount=621,the other docs docFreq=29 and docCount=599,this index have only one shard and no replica.If i reindex the 1s…

---

## [Unable to start ES on Ubuntu 16.04.5 LTS](https://discuss.elastic.co/t/unable-to-start-es-on-ubuntu-16-04-5-lts/143910)

<div class="topic-metadata">

**Author:** [@mawinkattiv](https://discuss.elastic.co/u/mawinkattiv)\
**Replies:** 3\
**Last updated:** [August 14, 2018, 2:30am UTC](https://discuss.elastic.co/t/unable-to-start-es-on-ubuntu-16-04-5-lts/143910 "2018-08-14T02:30:02Z")

</div>

I am trying to install Elastic Search in Ubuntu 16.04.5 LTS but getting following errors. Please help. root@vmawinkatti:/opt/elasticsearch-6.3.2/logs# /opt/elasticsearch-6.3.2/bin/elasticsearch warning: ignoring JAVA\_O…

---

## [Can the latest version of Fluentd, only work with ES-6, or also with ElasticSearch-2?](https://discuss.elastic.co/t/can-the-latest-version-of-fluentd-only-work-with-es-6-or-also-with-elasticsearch-2/144246)

<div class="topic-metadata">

**Author:** [@ujjain](https://discuss.elastic.co/u/ujjain)\
**Replies:** 1\
**Last updated:** [August 14, 2018, 1:28am UTC](https://discuss.elastic.co/t/can-the-latest-version-of-fluentd-only-work-with-es-6-or-also-with-elasticsearch-2/144246 "2018-08-14T01:28:18Z")

</div>

Can the latest version of Fluentd, only work with ES-6, or also with ElasticSearch-2? Background: We want to know if we can temporarily build a new ELK-6 stack, update fluentd and have updated fluend send all data also…

---

## [System.OutOfMemoryException on Bulk Insert](https://discuss.elastic.co/t/system-outofmemoryexception-on-bulk-insert/143865)

<div class="topic-metadata">

**Author:** [@aneesh](https://discuss.elastic.co/u/aneesh)\
**Replies:** 3\
**Last updated:** [August 14, 2018, 12:49am UTC](https://discuss.elastic.co/t/system-outofmemoryexception-on-bulk-insert/143865 "2018-08-14T00:49:54Z")

</div>

Hi While bulk insert data into elastic search, I am getting System.OutOfMemoryException. Each object is little large, if the number of properties in object is less then data getting inserted. (C# coding) Is there any…

---

## [Php query issue with elasticsearch](https://discuss.elastic.co/t/php-query-issue-with-elasticsearch/144257)

<div class="topic-metadata">

**Author:** [@Realz](https://discuss.elastic.co/u/Realz)\
**Replies:** 0\
**Last updated:** [August 13, 2018, 11:26pm UTC](https://discuss.elastic.co/t/php-query-issue-with-elasticsearch/144257 "2018-08-13T23:26:37Z")

</div>

Hello everyone, I need some help for a query, there is my query and i will explain my issues below (i work in PHP): $client = ClientBuilder::create()-\>build(); $params = \[ 'index' =\> 'formations', 'type' =\> 'f…

---

## [Kibana 5.4 timing out while searching the elastic search data](https://discuss.elastic.co/t/kibana-5-4-timing-out-while-searching-the-elastic-search-data/144188)

<div class="topic-metadata">

**Author:** [@chakri276](https://discuss.elastic.co/u/chakri276)\
**Replies:** 2\
**Last updated:** [August 13, 2018, 11:22pm UTC](https://discuss.elastic.co/t/kibana-5-4-timing-out-while-searching-the-elastic-search-data/144188 "2018-08-13T23:22:56Z")

</div>

Hello we are using kibana 5.4 as a viewer to see data, but the viewer keeps getting timing out and unable to do any operations. Here is the clusterstats, { "\_nodes" : { "total" : 7, "successful" : 7, "fai…

---

## [Rolling upgrade from 5.5.2 to 5.6 fails with no plugins installed](https://discuss.elastic.co/t/rolling-upgrade-from-5-5-2-to-5-6-fails-with-no-plugins-installed/141454)

<div class="topic-metadata">

**Author:** [@asvishen](https://discuss.elastic.co/u/asvishen)\
**Replies:** 4\
**Last updated:** [August 13, 2018, 11:04pm UTC](https://discuss.elastic.co/t/rolling-upgrade-from-5-5-2-to-5-6-fails-with-no-plugins-installed/141454 "2018-08-13T23:04:19Z")

</div>

Hi, I am trying to do a rolling upgrade for elasticsearch. I do not have any plugins installed but i still see this exception when trying to upgrade. The documentation on the rolling upgrade page lists out one of the st…

---

## [Ingest attachment plugin (Index files multiple time to same \_id)](https://discuss.elastic.co/t/ingest-attachment-plugin-index-files-multiple-time-to-same-id/138006)

<div class="topic-metadata">

**Author:** [@workland](https://discuss.elastic.co/u/workland)\
**Replies:** 15\
**Last updated:** [August 13, 2018, 10:29pm UTC](https://discuss.elastic.co/t/ingest-attachment-plugin-index-files-multiple-time-to-same-id/138006 "2018-08-13T22:29:31Z")

</div>

I had a document stored in Elastic Search under unique id which has an array of pdf files indexed in it along with other information(Name, Phone No, etc...). Now i want to update same document(\_id) by adding new pdf file…

---

## [Is sniff necessary with an ELB?](https://discuss.elastic.co/t/is-sniff-necessary-with-an-elb/144248)

<div class="topic-metadata">

**Author:** [@suanmeiguo](https://discuss.elastic.co/u/suanmeiguo)\
**Replies:** 0\
**Last updated:** [August 13, 2018, 10:21pm UTC](https://discuss.elastic.co/t/is-sniff-necessary-with-an-elb/144248 "2018-08-13T22:21:41Z")

</div>

Hi, I have a cluster with 3 master nodes. An elb points to the three master nodes and they're in an auto scalling group so if one of them is down we'll replace it with a new one. With this architecture, is sniff still …

---

## [Filter aggregation results](https://discuss.elastic.co/t/filter-aggregation-results/144247)

<div class="topic-metadata">

**Author:** [@snigdharao](https://discuss.elastic.co/u/snigdharao)\
**Replies:** 0\
**Last updated:** [August 13, 2018, 10:19pm UTC](https://discuss.elastic.co/t/filter-aggregation-results/144247 "2018-08-13T22:19:10Z")

</div>

HI , I have a use case where i have to perform autocomplete for field commodity line.For example when i try to match-'3' and "commodity\_line" is \["11","32","35"\] When i am doing a terms aggregation it returns 35,32…

[Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1580)

[Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1582)
