# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1583 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1584 --- ## [Elasticsearch 6.3.2 the index is automatically deleted](https://discuss.elastic.co/t/elasticsearch-6-3-2-the-index-is-automatically-deleted/143848)
**Author:** [@1e64d27745019f309346](https://discuss.elastic.co/u/1e64d27745019f309346)\ **Replies:** 10\ **Last updated:** [August 13, 2018, 3:01am UTC](https://discuss.elastic.co/t/elasticsearch-6-3-2-the-index-is-automatically-deleted/143848 "2018-08-13T03:01:03Z")
I have set up elk version 6.3.2, all the services can work normally, but the index of es is automatically deleted. In each index, I can only view the last 5 records, and more than 5 will be deleted. --- ## [Are buckets persistent?](https://discuss.elastic.co/t/are-buckets-persistent/143780)
**Author:** [@Jose\_Ramierez](https://discuss.elastic.co/u/Jose_Ramierez)\ **Replies:** 7\ **Last updated:** [August 13, 2018, 2:47am UTC](https://discuss.elastic.co/t/are-buckets-persistent/143780 "2018-08-13T02:47:47Z")
ES 6.3 Related to this thread: Are contents of a bucket held in the same shard? Discussing Bucket Aggregations: https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-bucket.html I thought… --- ## [Security research on XPack settings for ES,LogSta & Kib](https://discuss.elastic.co/t/security-research-on-xpack-settings-for-es-logsta-kib/143988)
**Author:** [@Kaustav\_Gupta](https://discuss.elastic.co/u/Kaustav_Gupta)\ **Replies:** 1\ **Last updated:** [August 13, 2018, 1:24am UTC](https://discuss.elastic.co/t/security-research-on-xpack-settings-for-es-logsta-kib/143988 "2018-08-13T01:24:59Z")
I am conducting a research on the recommended XPack parameters and their settings after i install it for version 6.2. I made this list based on the study i have done so far. My objective is to compile a list in order to… --- ## [Reindexing data - Novice Question](https://discuss.elastic.co/t/reindexing-data-novice-question/144057)
**Author:** [@CCJ](https://discuss.elastic.co/u/CCJ)\ **Replies:** 1\ **Last updated:** [August 13, 2018, 1:22am UTC](https://discuss.elastic.co/t/reindexing-data-novice-question/144057 "2018-08-13T01:22:28Z")
Hi there, I'm currently using ELK to index and visualise my data. At the moment, the data that I'm working with is sitting in a CSV file. once the below data is in ES i can visualise it in a metrics graph in kibana, 12 r… --- ## [Exclude a series from timelion query result](https://discuss.elastic.co/t/exclude-a-series-from-timelion-query-result/144009)
**Author:** [@malli1246](https://discuss.elastic.co/u/malli1246)\ **Replies:** 0\ **Last updated:** [August 11, 2018, 9:57pm UTC](https://discuss.elastic.co/t/exclude-a-series-from-timelion-query-result/144009 "2018-08-11T21:57:00Z")
Hi All, I am new to Kibana and Elasticsearch areas. I am working on creating a timeseries visualization in which I need to display conversion rate from "Details" to "Confirmation". For few cases, from "Details" we go to… --- ## [How to describe this aggregation using the Nest .NET Library?](https://discuss.elastic.co/t/how-to-describe-this-aggregation-using-the-nest-net-library/143907)
**Author:** [@rgelb](https://discuss.elastic.co/u/rgelb)\ **Replies:** 1\ **Last updated:** [August 12, 2018, 11:52pm UTC](https://discuss.elastic.co/t/how-to-describe-this-aggregation-using-the-nest-net-library/143907 "2018-08-12T23:52:06Z")
I have an aggregation that also has a filter and I am having trouble composing it with the .NET Nest Library: { "aggs": { "positive\_lat": { "filter": { "bool": { "must\_not": \[ … --- ## [Are contents of a bucket held in the same shard?](https://discuss.elastic.co/t/are-contents-of-a-bucket-held-in-the-same-shard/141059)
**Author:** [@Jose\_Ramierez](https://discuss.elastic.co/u/Jose_Ramierez)\ **Replies:** 3\ **Last updated:** [July 23, 2018, 7:05am UTC](https://discuss.elastic.co/t/are-contents-of-a-bucket-held-in-the-same-shard/141059 "2018-07-23T07:05:49Z")
We are evaluating using buckets to keep data by user account in a single bucket (e.g. the bucket becomes the "accountid" container, holding all documents for that account) The question has arisen: If we have a 20 or 100… --- ## [Field Mapping index false vs true](https://discuss.elastic.co/t/field-mapping-index-false-vs-true/143991)
**Author:** [@west415](https://discuss.elastic.co/u/west415)\ **Replies:** 2\ **Last updated:** [August 12, 2018, 9:12pm UTC](https://discuss.elastic.co/t/field-mapping-index-false-vs-true/143991 "2018-08-12T21:12:48Z")
I am using Elastic 6.x... Is there any reason to not just go with the default of "index" : true for field mappings? There are some fields that I don't believe I will need to perform a search on so my thought is set ind… --- ## [How to diff multiple arrays in ES?](https://discuss.elastic.co/t/how-to-diff-multiple-arrays-in-es/143856)
**Author:** [@chuckoh](https://discuss.elastic.co/u/chuckoh)\ **Replies:** 1\ **Last updated:** [August 12, 2018, 5:03pm UTC](https://discuss.elastic.co/t/how-to-diff-multiple-arrays-in-es/143856 "2018-08-12T17:03:30Z")
I am using Elasticsearch 6.0.1 and I have the following 3 indexes. index1 { 'id': 1, 'list': \[ 1, 2, 3, 4, 5, 6, 7, 8, 9 \] } index2 { 'id': 1, 'list': \[ 1, 2, 3, 100, 101, 102, ... \] } index3 { 'id': 1, 'l… --- ## [Caused by: java.lang.NoClassDefFoundError: org/apache/lucene/search/join/ToParentBlockJoinQuery](https://discuss.elastic.co/t/caused-by-java-lang-noclassdeffounderror-org-apache-lucene-search-join-toparentblockjoinquery/143974)
**Author:** [@f3b989beb926855a2d41](https://discuss.elastic.co/u/f3b989beb926855a2d41)\ **Replies:** 1\ **Last updated:** [August 12, 2018, 5:44pm UTC](https://discuss.elastic.co/t/caused-by-java-lang-noclassdeffounderror-org-apache-lucene-search-join-toparentblockjoinquery/143974 "2018-08-12T17:44:32Z")
Elasticsearch version : elasticsearch.jar:6.3.2 Exception: Caused by: java.lang.NoClassDefFoundError: org/apache/lucene/search/join/ToParentBlockJoinQuery Problem Description I was trying to sort a field of a documen… --- ## [Search api or metadata that illustrates the size of the query result (eg in in KB)](https://discuss.elastic.co/t/search-api-or-metadata-that-illustrates-the-size-of-the-query-result-eg-in-in-kb/144038)
**Author:** [@0xFFFFFF](https://discuss.elastic.co/u/0xFFFFFF)\ **Replies:** 0\ **Last updated:** [August 12, 2018, 2:28pm UTC](https://discuss.elastic.co/t/search-api-or-metadata-that-illustrates-the-size-of-the-query-result-eg-in-in-kb/144038 "2018-08-12T14:28:14Z")
Hi all, I have a quick question , is there any search API or a metadata that illustrates the size in kilobytes of the query's response? , this feature is needed to tune our parser that consume more storage space Thank… --- ## [DSL or in match](https://discuss.elastic.co/t/dsl-or-in-match/144037)
**Author:** [@waitangi](https://discuss.elastic.co/u/waitangi)\ **Replies:** 0\ **Last updated:** [August 12, 2018, 2:25pm UTC](https://discuss.elastic.co/t/dsl-or-in-match/144037 "2018-08-12T14:25:45Z")
I need a query that returns all documents where "QueryString" property contains "id=20" or "ad = 20". I tried: GET /logs/\_search { "query": { "match": { "QueryString": "id=20 ad=20" } } } but it does not work. A… --- ## [Does word order matter in my query?](https://discuss.elastic.co/t/does-word-order-matter-in-my-query/143947)
**Author:** [@pemfir](https://discuss.elastic.co/u/pemfir)\ **Replies:** 1\ **Last updated:** [August 12, 2018, 9:40am UTC](https://discuss.elastic.co/t/does-word-order-matter-in-my-query/143947 "2018-08-12T09:40:15Z")
I am trying to put together a query. field1 is a big text field. I am looking for key words in there. order of keywords do not matter. I would like to know if the query below achieves that. Thank you ! query\_template = … --- ## [Trouble Reindexing Child Documents with join field in ES 5.6](https://discuss.elastic.co/t/trouble-reindexing-child-documents-with-join-field-in-es-5-6/143568)
**Author:** [@mstruve](https://discuss.elastic.co/u/mstruve)\ **Replies:** 7\ **Last updated:** [August 12, 2018, 8:24am UTC](https://discuss.elastic.co/t/trouble-reindexing-child-documents-with-join-field-in-es-5-6/143568 "2018-08-12T08:24:15Z")
My issue is similar to this closed topic. I am trying to reindex parent/child documents in ES 5.6 in preparation for an ES 6.x upgrade. I was able to reindex the parent documents without a problem, however when I try to … --- ## [Aggregation over top N hits](https://discuss.elastic.co/t/aggregation-over-top-n-hits/144021)
**Author:** [@sreelalkm](https://discuss.elastic.co/u/sreelalkm)\ **Replies:** 1\ **Last updated:** [August 12, 2018, 8:22am UTC](https://discuss.elastic.co/t/aggregation-over-top-n-hits/144021 "2018-08-12T08:22:55Z")
I want to do a terms aggregation followed by some numeric metric aggregations over top N hits. Lets say we have the following docs: {"rank": 1, "price": 10, "name": "A"}, {"rank": 2, "price": 20, "name": "B"}, {"rank"… --- ## [How to get a json object in script queries](https://discuss.elastic.co/t/how-to-get-a-json-object-in-script-queries/143959)
**Author:** [@jackiecookie](https://discuss.elastic.co/u/jackiecookie)\ **Replies:** 1\ **Last updated:** [August 12, 2018, 6:45am UTC](https://discuss.elastic.co/t/how-to-get-a-json-object-in-script-queries/143959 "2018-08-12T06:45:19Z")
my elasticsearch version is 6.3.0,and here is my query: { "query":{ "bool" : { "must" : \[ { "script" : { "script" : { "source" : "double minPrice=-1;int userLevel=params.defau… --- ## [Initial Upload ElasticSearch 6.3 Bulk insert slows to a crawl](https://discuss.elastic.co/t/initial-upload-elasticsearch-6-3-bulk-insert-slows-to-a-crawl/143924)
**Author:** [@bach942](https://discuss.elastic.co/u/bach942)\ **Replies:** 2\ **Last updated:** [August 12, 2018, 4:05am UTC](https://discuss.elastic.co/t/initial-upload-elasticsearch-6-3-bulk-insert-slows-to-a-crawl/143924 "2018-08-12T04:05:23Z")
I'm trying to upload about 7 million documents to ES 6.3 and I've been running into and issue where the bulk upload slows to a crawl at about 1 million docs (I have no documents previous to this in the index). I have a … --- ## [Feeding a query results to another one](https://discuss.elastic.co/t/feeding-a-query-results-to-another-one/143930)
**Author:** [@Masoumeh\_Shavikloo](https://discuss.elastic.co/u/Masoumeh_Shavikloo)\ **Replies:** 1\ **Last updated:** [August 11, 2018, 7:53pm UTC](https://discuss.elastic.co/t/feeding-a-query-results-to-another-one/143930 "2018-08-11T19:53:02Z")
I want to know, is there any way to feed results of a query to another one? I want to use stop token filter in the first query and then feed the results to the second query without stop token filter. In this case, fewer … --- ## [I can't delete my document by bluk,please help](https://discuss.elastic.co/t/i-cant-delete-my-document-by-bluk-please-help/143979)
**Author:** [@Wang\_Lao](https://discuss.elastic.co/u/Wang_Lao)\ **Replies:** 0\ **Last updated:** [August 11, 2018, 2:32pm UTC](https://discuss.elastic.co/t/i-cant-delete-my-document-by-bluk-please-help/143979 "2018-08-11T14:32:46Z")
I try to delete my document using bluk api（es version 5.6.2), the requestis: POST \_bulk { "delete" : { "\_index" : "logdb\_dwc", "\_type" : "pumpOnlineGaming", "\_id" : "5b6ee6e20e1f39d201e625e8" } } I got the request: … --- ## [Get a size of query](https://discuss.elastic.co/t/get-a-size-of-query/143970)
**Author:** [@raouf.berrebiha](https://discuss.elastic.co/u/raouf.berrebiha)\ **Replies:** 0\ **Last updated:** [August 11, 2018, 10:21am UTC](https://discuss.elastic.co/t/get-a-size-of-query/143970 "2018-08-11T10:21:01Z")
Hi I have an issue with my index. The index take a lot of memory disk about 64gb for one index and i want to debug how many of memory take packet beat for example to optimize my parser is there any tips to get a idea of… --- ## [Routing to a specific shard](https://discuss.elastic.co/t/routing-to-a-specific-shard/143688)
**Author:** [@Andrea\_Ranieri](https://discuss.elastic.co/u/Andrea_Ranieri)\ **Replies:** 12\ **Last updated:** [August 11, 2018, 9:33am UTC](https://discuss.elastic.co/t/routing-to-a-specific-shard/143688 "2018-08-11T09:33:31Z")
Hi, i have an index with 10 shards. My application has 10 users. I'd like to assign each shard to a specific user, avoiding the possible collisions in the hash function used in the formula that computes the shard numbe… --- ## [Head plugin](https://discuss.elastic.co/t/head-plugin/143829)
**Author:** [@Arun\_Murugappan](https://discuss.elastic.co/u/Arun_Murugappan)\ **Replies:** 3\ **Last updated:** [August 11, 2018, 9:29am UTC](https://discuss.elastic.co/t/head-plugin/143829 "2018-08-11T09:29:09Z")
Head plugin is used to check the status of the cluster (servers/indices/ shards). Are they up and running? But this is not supported in elasticsearch 5.x. Are there alternatives to serve the same purpose? --- ## [Rollover api : How to Run it 30 min wise](https://discuss.elastic.co/t/rollover-api-how-to-run-it-30-min-wise/143318)
**Author:** [@BoffinPanda](https://discuss.elastic.co/u/BoffinPanda)\ **Replies:** 6\ **Last updated:** [August 11, 2018, 3:09am UTC](https://discuss.elastic.co/t/rollover-api-how-to-run-it-30-min-wise/143318 "2018-08-11T03:09:01Z")
Suppose I do : POST /indexname/\_rollover { "conditions": { "max\_age": "30m", "max\_docs": 1000, "max\_size": "5gb" } } Will it work? If not what is the correct way of generating indices every 30 mins. --- ## [Recommend a way to do nested field aggregation](https://discuss.elastic.co/t/recommend-a-way-to-do-nested-field-aggregation/143952)
**Author:** [@wangweiching](https://discuss.elastic.co/u/wangweiching)\ **Replies:** 0\ **Last updated:** [August 11, 2018, 1:10am UTC](https://discuss.elastic.co/t/recommend-a-way-to-do-nested-field-aggregation/143952 "2018-08-11T01:10:37Z")
i have the multiple documents query response with multiple dates as followed, I would like to know if we can do aggregation on those documents for example, I like to aggregate all the predictions elements with same date… --- ## [Search for a file with the ID](https://discuss.elastic.co/t/search-for-a-file-with-the-id/143896)
**Author:** [@sah](https://discuss.elastic.co/u/sah)\ **Replies:** 3\ **Last updated:** [August 10, 2018, 9:00pm UTC](https://discuss.elastic.co/t/search-for-a-file-with-the-id/143896 "2018-08-10T21:00:18Z")
I am trying to search for a file with the ID "fe4cec0f-4c57-4371-9828-a8ab01192285" How would I do that? I suck as elastic :frowning: Here is an example what is stored contentType":{"name":"Asset"},"createdModifiedBy"… --- ## [Proper way to configure Elastic cluster](https://discuss.elastic.co/t/proper-way-to-configure-elastic-cluster/143929)
**Author:** [@mladen](https://discuss.elastic.co/u/mladen)\ **Replies:** 0\ **Last updated:** [August 10, 2018, 8:06pm UTC](https://discuss.elastic.co/t/proper-way-to-configure-elastic-cluster/143929 "2018-08-10T20:06:14Z")
Hello, in a past few months I was gathering logs from different sources (applications, vmware, databases) using one machine with ELK stack in my company for proof of concept. Our goal is to gather logs in one place usin… --- ## [Elasticsearch 6.3: snapshot rate limiting not working](https://discuss.elastic.co/t/elasticsearch-6-3-snapshot-rate-limiting-not-working/143926)
**Author:** [@etfeet](https://discuss.elastic.co/u/etfeet)\ **Replies:** 0\ **Last updated:** [August 10, 2018, 7:44pm UTC](https://discuss.elastic.co/t/elasticsearch-6-3-snapshot-rate-limiting-not-working/143926 "2018-08-10T19:44:40Z")
I have a 23 node elasticsearch cluster running 6.3.2. I have 20 data only nodes and 3 master only nodes. All the hosts are running centos 7. There is a dedicated network vlan that has been setup for the elasticsearch c… --- ## [Unable to install on Ubuntu 18.04](https://discuss.elastic.co/t/unable-to-install-on-ubuntu-18-04/142770)
**Author:** [@eutychus](https://discuss.elastic.co/u/eutychus)\ **Replies:** 2\ **Last updated:** [August 10, 2018, 5:44pm UTC](https://discuss.elastic.co/t/unable-to-install-on-ubuntu-18-04/142770 "2018-08-10T17:44:14Z")
It seems the deb Package can not be unpacked: Vorbereitung zum Entpacken von .../elasticsearch\_6.3.2\_all.deb ... dpkg: Fehler beim Bearbeiten des Archivs /var/cache/apt/archives/elasticsearch\_6.3.2\_all.deb (--unpack): … --- ## [Doc can be found by query but not by get](https://discuss.elastic.co/t/doc-can-be-found-by-query-but-not-by-get/143860)
**Author:** [@Cristi\_Boariu](https://discuss.elastic.co/u/Cristi_Boariu)\ **Replies:** 7\ **Last updated:** [August 10, 2018, 4:24pm UTC](https://discuss.elastic.co/t/doc-can-be-found-by-query-but-not-by-get/143860 "2018-08-10T16:24:14Z")
I have indexed a few documents for some users and I can find any of them by id, eg: GET /athlete/\_search?q=id:19 (returns my athlete in \_source): { "took": 2, "timed\_out": false, "\_shards": { "total": 5, … --- ## [Fluent-bit config changes to connect to xpack securitiy enabled elasticsearch running in kubernetes](https://discuss.elastic.co/t/fluent-bit-config-changes-to-connect-to-xpack-securitiy-enabled-elasticsearch-running-in-kubernetes/143900)
**Author:** [@DStorck](https://discuss.elastic.co/u/DStorck)\ **Replies:** 0\ **Last updated:** [August 10, 2018, 4:14pm UTC](https://discuss.elastic.co/t/fluent-bit-config-changes-to-connect-to-xpack-securitiy-enabled-elasticsearch-running-in-kubernetes/143900 "2018-08-10T16:14:03Z")
I was able to set up my elasticsearch to use xpack, and the es -\> kibana connection is working just fine, but I am unsure of what config changes need to be made to fluent-bit to be able to send logs to elasticsearch. The… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1582) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1584)