# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1586 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1587 --- ## [Add score +30 if doc\['someField'\].value == "some"](https://discuss.elastic.co/t/add-score-30-if-doc-somefield-value-some/143516)
**Author:** [@ConConovaloff](https://discuss.elastic.co/u/ConConovaloff)\ **Replies:** 1\ **Last updated:** [August 9, 2018, 8:32am UTC](https://discuss.elastic.co/t/add-score-30-if-doc-somefield-value-some/143516 "2018-08-09T08:32:55Z")
Hello I have document: { "\_id": 111 "price": 1000 "color": "red" } I'm use function\_score with gauss function for get score by price. Now, i need add +30 score if color == "green". Preferably without use groovy … --- ## [Finding top users moving around vs stationary](https://discuss.elastic.co/t/finding-top-users-moving-around-vs-stationary/142844)
**Author:** [@Nikhil\_Utane](https://discuss.elastic.co/u/Nikhil_Utane)\ **Replies:** 16\ **Last updated:** [August 9, 2018, 8:33am UTC](https://discuss.elastic.co/t/finding-top-users-moving-around-vs-stationary/142844 "2018-08-09T08:33:30Z")
Hi, Let's say we have multiple servers providing a service. Users can connect to any of the server and get served. There is a unique ID for a user and the server. We have log when a user 'connects' to a particular serv… --- ## [How can set elastic search architecture? (master , data)](https://discuss.elastic.co/t/how-can-set-elastic-search-architecture-master-data/143646)
**Author:** [@kimchigood](https://discuss.elastic.co/u/kimchigood)\ **Replies:** 3\ **Last updated:** [August 9, 2018, 8:13am UTC](https://discuss.elastic.co/t/how-can-set-elastic-search-architecture-master-data/143646 "2018-08-09T08:13:56Z")
I want make 6 elasticsearch node for logging system. how can i set master and data node? 1-master / 5-data or 3-master / 3-data? i don't know what is the best setting. thank you. --- ## [Adding a specific score if has field with a specific value (nested)](https://discuss.elastic.co/t/adding-a-specific-score-if-has-field-with-a-specific-value-nested/143460)
**Author:** [@ConConovaloff](https://discuss.elastic.co/u/ConConovaloff)\ **Replies:** 1\ **Last updated:** [August 9, 2018, 8:10am UTC](https://discuss.elastic.co/t/adding-a-specific-score-if-has-field-with-a-specific-value-nested/143460 "2018-08-09T08:10:58Z")
Hello I have document with nested documents: { "\_id": 111 "price": 1000 "properties": \[ { "property\_id": 22, "property\_value": "gas"} { "property\_id": 23, "property\_value": "green"} \] } I have a requ… --- ## [Which RAID config for 2TB \* 12disks](https://discuss.elastic.co/t/which-raid-config-for-2tb-12disks/143245)
**Author:** [@jihun](https://discuss.elastic.co/u/jihun)\ **Replies:** 14\ **Last updated:** [August 9, 2018, 7:19am UTC](https://discuss.elastic.co/t/which-raid-config-for-2tb-12disks/143245 "2018-08-09T07:19:58Z")
Hello, There are 6 servers, and each have 64GB ram and 12 spinning disks (2 TB per disk. so 24TB in total). When I give 32GB RAM to ES, It seems that maximum storable index size for a node is around 4TB. So, If I set … --- ## [Should clause gives different weight to each term](https://discuss.elastic.co/t/should-clause-gives-different-weight-to-each-term/143282)
**Author:** [@zivari](https://discuss.elastic.co/u/zivari)\ **Replies:** 1\ **Last updated:** [August 9, 2018, 7:13am UTC](https://discuss.elastic.co/t/should-clause-gives-different-weight-to-each-term/143282 "2018-08-09T07:13:38Z")
Hey, Iv been having a hard time figuring out why different terms on my should clause has different "weight" without me stating it explicitly, and how can i avoid it. I have this should clause in my query: :should=\> \[… --- ## [What does "script.cache.max\_size" and "script.cache.max\_size" mean?](https://discuss.elastic.co/t/what-does-script-cache-max-size-and-script-cache-max-size-mean/142454)
**Author:** [@xyx](https://discuss.elastic.co/u/xyx)\ **Replies:** 2\ **Last updated:** [August 9, 2018, 6:53am UTC](https://discuss.elastic.co/t/what-does-script-cache-max-size-and-script-cache-max-size-mean/142454 "2018-08-09T06:53:40Z")
I want do update by script.But my scropt source is too large,about ten thousand characters. If I use Inline scripts,it is so heavy to http request(builk update).So I want use sotred scripts,but I see this. You can conf… --- ## [Lost Pipelines after ES restart](https://discuss.elastic.co/t/lost-pipelines-after-es-restart/143481)
**Author:** [@brais](https://discuss.elastic.co/u/brais)\ **Replies:** 5\ **Last updated:** [August 9, 2018, 6:39am UTC](https://discuss.elastic.co/t/lost-pipelines-after-es-restart/143481 "2018-08-09T06:39:23Z")
Everytime we restart our cluster, we lose all the pipelines. So we have to push them everytime we start it again. And we should do that everyday as we power off our kubermetes cluster every night. We have two kubernetes… --- ## [Individual alert for each message queried on Watcher](https://discuss.elastic.co/t/individual-alert-for-each-message-queried-on-watcher/143528)
**Author:** [@sbienert](https://discuss.elastic.co/u/sbienert)\ **Replies:** 3\ **Last updated:** [August 9, 2018, 6:31am UTC](https://discuss.elastic.co/t/individual-alert-for-each-message-queried-on-watcher/143528 "2018-08-09T06:31:53Z")
Hello, unfortunately I did not find any answered question for this relatively common use case so if there actually is one here, feel free just to link it. I want to have a single alert for each message that got through… --- ## [How to add timestamp and search old data](https://discuss.elastic.co/t/how-to-add-timestamp-and-search-old-data/143468)
**Author:** [@agrawal](https://discuss.elastic.co/u/agrawal)\ **Replies:** 0\ **Last updated:** [August 8, 2018, 9:39am UTC](https://discuss.elastic.co/t/how-to-add-timestamp-and-search-old-data/143468 "2018-08-08T09:39:02Z")
How to add current timestamp while indexing the data. Code: public class GetTestSuiteXML { String path = "resources/b6f1-testsuite.xml"; int testcaseCount = 0; int idCount = 1; Map\ map = new H… --- ## [Firewall - Block Port 9300](https://discuss.elastic.co/t/firewall-block-port-9300/143629)
**Author:** [@sanket.maru](https://discuss.elastic.co/u/sanket.maru)\ **Replies:** 0\ **Last updated:** [August 9, 2018, 4:45am UTC](https://discuss.elastic.co/t/firewall-block-port-9300/143629 "2018-08-09T04:45:08Z")
I have a multi node cluster with 3 masters, 4 data nodes, 2 ingest nodes. My cluster is working and I am blocking port 9300 on one of the data or master nodes. To block port 9300 which is used communicating between the … --- ## [How elasticsearch find data corruption](https://discuss.elastic.co/t/how-elasticsearch-find-data-corruption/143624)
**Author:** [@saiergon](https://discuss.elastic.co/u/saiergon)\ **Replies:** 0\ **Last updated:** [August 9, 2018, 3:56am UTC](https://discuss.elastic.co/t/how-elasticsearch-find-data-corruption/143624 "2018-08-09T03:56:52Z")
hi, all , i wonder how elasticsearch find data corruption. for example, if i have a index with a primary shard and a replica, if sometime, the replica data corrupted because of disk error, then when elasticsearch will fi… --- ## [How to set plugins custom folder?](https://discuss.elastic.co/t/how-to-set-plugins-custom-folder/143585)
**Author:** [@shabtaisharon](https://discuss.elastic.co/u/shabtaisharon)\ **Replies:** 2\ **Last updated:** [August 9, 2018, 3:33am UTC](https://discuss.elastic.co/t/how-to-set-plugins-custom-folder/143585 "2018-08-09T03:33:12Z")
Hi, I'm using ElasticSearch 6.3 and i'm trying to configure the plugin folder to use a custom location, while using path.plugins in the config file, but that doesn't work. Am i doing something wrong? Thanks, Sharon --- ## [Build source plugin Elasticsearch Vietnamese Java](https://discuss.elastic.co/t/build-source-plugin-elasticsearch-vietnamese-java/143622)
**Author:** [@trantrungtruc05](https://discuss.elastic.co/u/trantrungtruc05)\ **Replies:** 0\ **Last updated:** [August 9, 2018, 3:08am UTC](https://discuss.elastic.co/t/build-source-plugin-elasticsearch-vietnamese-java/143622 "2018-08-09T03:08:37Z")
Hi, This is source https://github.com/duydo/elasticsearch-analysis-vietnamese to analysis search Vietnamese but current it's build Elasticsearch 5.6.5. I want upgrade to 6.3.2 but It have many problem. Everyone can hel… --- ## [How to split file json real time tshark?](https://discuss.elastic.co/t/how-to-split-file-json-real-time-tshark/143617)
**Author:** [@nxdu93](https://discuss.elastic.co/u/nxdu93)\ **Replies:** 0\ **Last updated:** [August 9, 2018, 2:25am UTC](https://discuss.elastic.co/t/how-to-split-file-json-real-time-tshark/143617 "2018-08-09T02:25:32Z")
Hi all, Show yourself to convert pcap to json on wireshark centos7 All users for me ask to make up to split file json output each file 90mb I'm using tshark command -T ek -b filesize: 90000\> cannot write file Thank a… --- ## [Url too long, too many indices](https://discuss.elastic.co/t/url-too-long-too-many-indices/143593)
**Author:** [@LordMike](https://discuss.elastic.co/u/LordMike)\ **Replies:** 3\ **Last updated:** [August 9, 2018, 12:54am UTC](https://discuss.elastic.co/t/url-too-long-too-many-indices/143593 "2018-08-09T00:54:37Z")
Hi, We have a situation where we'll end up maintaining a large-ish set of indices in ES, and where we want to query on sets of these indices (chosen by users). Right now, we're seeing an issue where the search URL reach… --- ## [Online Interactive Analyzer Explorer](https://discuss.elastic.co/t/online-interactive-analyzer-explorer/143596)
**Author:** [@gtalarico](https://discuss.elastic.co/u/gtalarico)\ **Replies:** 1\ **Last updated:** [August 9, 2018, 12:28am UTC](https://discuss.elastic.co/t/online-interactive-analyzer-explorer/143596 "2018-08-09T00:28:23Z")
Hi, first time posting here. I started using elasticsearch just a few weeks ago and I love the product. I took me some a couple days to learn my way around and wrap my head around the concepts, in particular analyzers… --- ## [How to do a NOT IN like query in Elastic?](https://discuss.elastic.co/t/how-to-do-a-not-in-like-query-in-elastic/142793)
**Author:** [@Sewalita\_Duara](https://discuss.elastic.co/u/Sewalita_Duara)\ **Replies:** 3\ **Last updated:** [August 8, 2018, 10:19pm UTC](https://discuss.elastic.co/t/how-to-do-a-not-in-like-query-in-elastic/142793 "2018-08-08T22:19:10Z")
Hello Is NOT-IN like query doable in Elastic? Example, index has the following fields & data \_id, job\_id, transaction, data\_source 1, 123, read, RDBMS 2, 123, read, File 3, 123, write,… --- ## [Join on metadata](https://discuss.elastic.co/t/join-on-metadata/143600)
**Author:** [@pDonS](https://discuss.elastic.co/u/pDonS)\ **Replies:** 0\ **Last updated:** [August 8, 2018, 9:23pm UTC](https://discuss.elastic.co/t/join-on-metadata/143600 "2018-08-08T21:23:07Z")
Hi All, Could please confirm if below is possible? If yes please suggest best way to achieve it Need the ability to create new metadata on top of Elastic documents without having to re-index. The latter is a veeeery sl… --- ## [Elastic/Hadoop es.port setting -of 1](https://discuss.elastic.co/t/elastic-hadoop-es-port-setting-of-1/143598)
**Author:** [@mhohara](https://discuss.elastic.co/u/mhohara)\ **Replies:** 0\ **Last updated:** [August 8, 2018, 9:18pm UTC](https://discuss.elastic.co/t/elastic-hadoop-es-port-setting-of-1/143598 "2018-08-08T21:18:23Z")
I was working on connecting an AWS EMR to an AWS Managed Elastic cluster. I'd noticed that I could connect to the managed cluster using a curl, but that the curl could not use a port number. Putting either :80 or :9200 w… --- ## [Setting index.routing.allocation.total\_shards\_per\_node to 1 still results in data nodes getting more than one shard](https://discuss.elastic.co/t/setting-index-routing-allocation-total-shards-per-node-to-1-still-results-in-data-nodes-getting-more-than-one-shard/143590)
**Author:** [@Oferkes](https://discuss.elastic.co/u/Oferkes)\ **Replies:** 0\ **Last updated:** [August 8, 2018, 8:26pm UTC](https://discuss.elastic.co/t/setting-index-routing-allocation-total-shards-per-node-to-1-still-results-in-data-nodes-getting-more-than-one-shard/143590 "2018-08-08T20:26:41Z")
Hi, i have an index that is constantly created on the same data node, regardless of how many shards i assign to it. when using index.routing.allocation.total\_shards\_per\_node and setting it to 1, the shards are relocate… --- ## [How to find elasticsearch index store size based on the timestamp](https://discuss.elastic.co/t/how-to-find-elasticsearch-index-store-size-based-on-the-timestamp/143577)
**Author:** [@r.ganeshbabu](https://discuss.elastic.co/u/r.ganeshbabu)\ **Replies:** 0\ **Last updated:** [August 8, 2018, 6:29pm UTC](https://discuss.elastic.co/t/how-to-find-elasticsearch-index-store-size-based-on-the-timestamp/143577 "2018-08-08T18:29:48Z")
Hi All, I have an index in elasticsearch and I want to find the each day number of documents and index size using es query. Below is the query I tried for finding the no of docs for each day, curl -XPOST "http://loca… --- ## [Duplicate ID](https://discuss.elastic.co/t/duplicate-id/143502)
**Author:** [@Sulaiman](https://discuss.elastic.co/u/Sulaiman)\ **Replies:** 3\ **Last updated:** [August 8, 2018, 6:08pm UTC](https://discuss.elastic.co/t/duplicate-id/143502 "2018-08-08T18:08:00Z")
How to delete / avoid duplicate ID's cause I have few similar logs which are comming from wazuh, so I would like to remove duplicate ids . --- ## [Unable to send json data to elastic search](https://discuss.elastic.co/t/unable-to-send-json-data-to-elastic-search/143506)
**Author:** [@srdat](https://discuss.elastic.co/u/srdat)\ **Replies:** 5\ **Last updated:** [August 8, 2018, 6:03pm UTC](https://discuss.elastic.co/t/unable-to-send-json-data-to-elastic-search/143506 "2018-08-08T18:03:14Z")
I'm able to read data from mysql and print in json format but unable to send json data to elastic search. Below is my piece of code in python def exportTable(table\_name): query = "SELECT \* FROM "+table\_name data = ru… --- ## [Array\_Compare working with Nested Aggregations](https://discuss.elastic.co/t/array-compare-working-with-nested-aggregations/143374)
**Author:** [@Micah\_Hunsberger](https://discuss.elastic.co/u/Micah_Hunsberger)\ **Replies:** 3\ **Last updated:** [August 8, 2018, 5:52pm UTC](https://discuss.elastic.co/t/array-compare-working-with-nested-aggregations/143374 "2018-08-08T17:52:47Z")
I have a watch that is looking for a threshold number of login failures for hosts and their usernames for within a certain interval. I am having trouble with the condition section of the watch to determine if a certain … --- ## [Match query giving unexpected results](https://discuss.elastic.co/t/match-query-giving-unexpected-results/143555)
**Author:** [@Ashish\_Modi](https://discuss.elastic.co/u/Ashish_Modi)\ **Replies:** 2\ **Last updated:** [August 8, 2018, 5:04pm UTC](https://discuss.elastic.co/t/match-query-giving-unexpected-results/143555 "2018-08-08T17:04:26Z")
Hi, I have an index which has following two addresses indexed using standard analyzer (default): 132 BURNT ASH ROAD LONDON LEWISHAM SE12 8PU 132-134 BURNT ASH ROAD LONDON LEWISHAM SE12 8PU I am using following query … --- ## [Read/Write alias for Elastic search indices](https://discuss.elastic.co/t/read-write-alias-for-elastic-search-indices/143542)
**Author:** [@chandra0651](https://discuss.elastic.co/u/chandra0651)\ **Replies:** 3\ **Last updated:** [August 8, 2018, 4:46pm UTC](https://discuss.elastic.co/t/read-write-alias-for-elastic-search-indices/143542 "2018-08-08T16:46:47Z")
Hello i have a logstash configuration which will create the indices on monthly basis, i am creating an alias for each index through template which i am using it for reading the documents. I need another alias which is us… --- ## [Issue sorting nested documents indexed via Bulk](https://discuss.elastic.co/t/issue-sorting-nested-documents-indexed-via-bulk/139164)
**Author:** [@colinj](https://discuss.elastic.co/u/colinj)\ **Replies:** 3\ **Last updated:** [August 8, 2018, 3:43pm UTC](https://discuss.elastic.co/t/issue-sorting-nested-documents-indexed-via-bulk/139164 "2018-08-08T15:43:13Z")
Hello everyone, I recently came across a curious bug (i'm using version 6.2.3 of elasticsearch) occuring under very particular circumstances. The problem is on sorting parent documents based on a field from their neste… --- ## [Elastic Search with Special Characters](https://discuss.elastic.co/t/elastic-search-with-special-characters/143554)
**Author:** [@ktvasan](https://discuss.elastic.co/u/ktvasan)\ **Replies:** 0\ **Last updated:** [August 8, 2018, 3:16pm UTC](https://discuss.elastic.co/t/elastic-search-with-special-characters/143554 "2018-08-08T15:16:49Z")
I am using Elastic search api for python to pull some data for creating my own dashboards, Its working for several queries/dashboards no issues. But this below query string some how it's not returning any results or givi… --- ## [How to delete the old documnet from my index pattern?](https://discuss.elastic.co/t/how-to-delete-the-old-documnet-from-my-index-pattern/143376)
**Author:** [@vebabu](https://discuss.elastic.co/u/vebabu)\ **Replies:** 5\ **Last updated:** [August 8, 2018, 3:11pm UTC](https://discuss.elastic.co/t/how-to-delete-the-old-documnet-from-my-index-pattern/143376 "2018-08-08T15:11:42Z")
Hi All, I am collecting the data from IoT DEVICE every second and transferring the data to Elastic search. I wanted only last 7 days data in my index pattern. How do i delete the old document data from my Index pattern… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1585) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1587)