# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1587 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1588 --- ## [Best reasons to motivate company to update from ElasticSearch 2.1.1 to ElasticSearch 6.3.2?](https://discuss.elastic.co/t/best-reasons-to-motivate-company-to-update-from-elasticsearch-2-1-1-to-elasticsearch-6-3-2/143472)
**Author:** [@ujjain](https://discuss.elastic.co/u/ujjain)\ **Replies:** 1\ **Last updated:** [August 8, 2018, 2:54pm UTC](https://discuss.elastic.co/t/best-reasons-to-motivate-company-to-update-from-elasticsearch-2-1-1-to-elasticsearch-6-3-2/143472 "2018-08-08T14:54:15Z")
I'm looking to convince management of updating from ElasticSearch 2.1.1 to 6.3.2. What would be primary reasons? I already have these: Not EOL Faster Less buggy Alerting for Monitoring & Security purposes Upgrading wi… --- ## [Recovery after network disconnection](https://discuss.elastic.co/t/recovery-after-network-disconnection/143547)
**Author:** [@YanivKH](https://discuss.elastic.co/u/YanivKH)\ **Replies:** 0\ **Last updated:** [August 8, 2018, 2:48pm UTC](https://discuss.elastic.co/t/recovery-after-network-disconnection/143547 "2018-08-08T14:48:23Z")
I've ES 6.2.4 installed on a 4 nodes cluster, all work fantastic. We had a network outage for several ours where all the nodes couldn't communicate between them. The master decided that all the rest of the 3 nodes ar… --- ## [objSearch.getresult returns null](https://discuss.elastic.co/t/objsearch-getresult-returns-null/143483)
**Author:** [@Sebastiaan\_Leeflang](https://discuss.elastic.co/u/Sebastiaan_Leeflang)\ **Replies:** 2\ **Last updated:** [August 8, 2018, 2:48pm UTC](https://discuss.elastic.co/t/objsearch-getresult-returns-null/143483 "2018-08-08T14:48:08Z")
UnitTestElasticsearchSample.Elasticsearch objSearch = new UnitTestElasticsearchSample.Elasticsearch(); \< objSearch.AddNewIndex(new City(1, "delhi", "delhi", "India", "9.879 million")); objSearch.AddNewIndex(new City(2… --- ## [Elasticsearch order issue](https://discuss.elastic.co/t/elasticsearch-order-issue/143541)
**Author:** [@aliyesami](https://discuss.elastic.co/u/aliyesami)\ **Replies:** 0\ **Last updated:** [August 8, 2018, 2:33pm UTC](https://discuss.elastic.co/t/elasticsearch-order-issue/143541 "2018-08-08T14:33:35Z")
In the following query I want to order the total amount , how can I ? \[elasticsearch@hadoop1 bin\]$ curl -X POST http://hadoop1:9200/\_xpack/sql?format=txt -H 'Content-Type: application/json' -d '{"query": "SELECT acct\_n… --- ## [Getting a result with a specific sequence of words in it](https://discuss.elastic.co/t/getting-a-result-with-a-specific-sequence-of-words-in-it/143538)
**Author:** [@eilon](https://discuss.elastic.co/u/eilon)\ **Replies:** 0\ **Last updated:** [August 8, 2018, 2:25pm UTC](https://discuss.elastic.co/t/getting-a-result-with-a-specific-sequence-of-words-in-it/143538 "2018-08-08T14:25:12Z")
Hey all, I'm trying to get all the results that contains some keywords in a specific order. For example: GET /\_myIndex/\_search { "query": { "bool": { "must": \[ {"match\_phrase\_prefix": {"CommandL… --- ## [Running into problems moving from Logstash ingestion to Filebeat harvesting](https://discuss.elastic.co/t/running-into-problems-moving-from-logstash-ingestion-to-filebeat-harvesting/143381)
**Author:** [@byoungman](https://discuss.elastic.co/u/byoungman)\ **Replies:** 1\ **Last updated:** [August 8, 2018, 2:03pm UTC](https://discuss.elastic.co/t/running-into-problems-moving-from-logstash-ingestion-to-filebeat-harvesting/143381 "2018-08-08T14:03:15Z")
I'm trying to move from logstash ingestion of log files using the file input filter to using Filebeat to harvest the log files and the problem I'm running into is that when I get filebeat and logstash set up and restart … --- ## [User specific ranking](https://discuss.elastic.co/t/user-specific-ranking/143529)
**Author:** [@kurt1](https://discuss.elastic.co/u/kurt1)\ **Replies:** 0\ **Last updated:** [August 8, 2018, 1:54pm UTC](https://discuss.elastic.co/t/user-specific-ranking/143529 "2018-08-08T13:54:06Z")
I'm very new to elasticsearch and would like some guidance on the best approach to handle my problem. I have a million articles that I want to search. Each article is ranked beforehand for each user using a custom funct… --- ## [Cluster Recovery took long time](https://discuss.elastic.co/t/cluster-recovery-took-long-time/143489)
**Author:** [@mahmoud\_moharam](https://discuss.elastic.co/u/mahmoud_moharam)\ **Replies:** 7\ **Last updated:** [August 8, 2018, 12:57pm UTC](https://discuss.elastic.co/t/cluster-recovery-took-long-time/143489 "2018-08-08T12:57:37Z")
I have a cluster with 2 nodes on AWS , then I release one of them and keep another so my cluster now had 1 master node , with active\_primary\_shards 38180 the problem is when I test failover time recovery it took 12 hour… --- ## [CircuitBreakingException: \[parent\] Data too large, data for \[\\]](https://discuss.elastic.co/t/circuitbreakingexception-parent-data-too-large-data-for-transport-request/143486)
**Author:** [@Guigoz](https://discuss.elastic.co/u/Guigoz)\ **Replies:** 6\ **Last updated:** [August 8, 2018, 12:54pm UTC](https://discuss.elastic.co/t/circuitbreakingexception-parent-data-too-large-data-for-transport-request/143486 "2018-08-08T12:54:37Z")
Hi, I'm working on a 6.2.4 ES cluster with 8 VMs (2 physical servers). Each VM has 28Go of memory, and 15Go are dedicated to ES. My cluster contains 80 billions documents ( Store size = 16.11 TB / Fielddata size = 21.… --- ## [ES is rounding keyword values](https://discuss.elastic.co/t/es-is-rounding-keyword-values/143012)
**Author:** [@piotrskowron](https://discuss.elastic.co/u/piotrskowron)\ **Replies:** 8\ **Last updated:** [August 8, 2018, 12:51pm UTC](https://discuss.elastic.co/t/es-is-rounding-keyword-values/143012 "2018-08-08T12:51:37Z")
Got an issue with field keyword. Mapping for it looks like: "user\_id": { "type": "keyword" } value for user\_id is: 9221662934816997716 but ES is returning it in kibana our even in cur… --- ## [Connection to ElasticSearch with Groovy](https://discuss.elastic.co/t/connection-to-elasticsearch-with-groovy/143458)
**Author:** [@chetansk](https://discuss.elastic.co/u/chetansk)\ **Replies:** 4\ **Last updated:** [August 8, 2018, 12:39pm UTC](https://discuss.elastic.co/t/connection-to-elasticsearch-with-groovy/143458 "2018-08-08T12:39:32Z")
Hi, I am quite beginner in ElasticSearch and Groovy. I have to perform CRUD (Create,Retrieve,Update and Delete) operations in ElasticSearch using Groovy.I am using IntelliJ for Groovy. I have found few lines of codes bu… --- ## [Date time format recognition](https://discuss.elastic.co/t/date-time-format-recognition/143510)
**Author:** [@jvidin](https://discuss.elastic.co/u/jvidin)\ **Replies:** 0\ **Last updated:** [August 8, 2018, 12:18pm UTC](https://discuss.elastic.co/t/date-time-format-recognition/143510 "2018-08-08T12:18:15Z")
Hello, Im very new to ELK. I inserted some documents on my index and one of the fields is date\_created. I did not create a mapping in advance so was hopping my time format to be recognized, it ends not in this case. … --- ## [Cross Cluster Search skip\_unavailable](https://discuss.elastic.co/t/cross-cluster-search-skip-unavailable/143509)
**Author:** [@danfisk](https://discuss.elastic.co/u/danfisk)\ **Replies:** 0\ **Last updated:** [August 8, 2018, 12:16pm UTC](https://discuss.elastic.co/t/cross-cluster-search-skip-unavailable/143509 "2018-08-08T12:16:10Z")
I am having a little trouble working with cross cluster search.. To start with my environment is as follows: ElasticSearch 6.2.3 with Java EE client using: earlib 'org.elasticsearch.client:elasticsearch-rest-high-level… --- ## [How to ingest searchservice in Plugin](https://discuss.elastic.co/t/how-to-ingest-searchservice-in-plugin/141945)
**Author:** [@hiral2cool](https://discuss.elastic.co/u/hiral2cool)\ **Replies:** 6\ **Last updated:** [August 8, 2018, 11:59am UTC](https://discuss.elastic.co/t/how-to-ingest-searchservice-in-plugin/141945 "2018-08-08T11:59:57Z")
I want to create a REST Plugin in that I want to inject SearchService to play around with the tokens and frequencies so please suggest how to achieve the same --- ## [Exact Search on multiple wildcard-fields](https://discuss.elastic.co/t/exact-search-on-multiple-wildcard-fields/141921)
**Author:** [@cherry-wave](https://discuss.elastic.co/u/cherry-wave)\ **Replies:** 22\ **Last updated:** [August 8, 2018, 11:26am UTC](https://discuss.elastic.co/t/exact-search-on-multiple-wildcard-fields/141921 "2018-08-08T11:26:41Z")
Hello guys, I have to do searches on fields with wildcards in it. Like for example: { "query\_string": { "fields": \["variations.generalData\*", "variations.addresses\*"\], "query": "Müll" } } But I didn'… --- ## [Configure Elasticsearch high level client with JSON parser](https://discuss.elastic.co/t/configure-elasticsearch-high-level-client-with-json-parser/143479)
**Author:** [@Drusev](https://discuss.elastic.co/u/Drusev)\ **Replies:** 1\ **Last updated:** [August 8, 2018, 11:22am UTC](https://discuss.elastic.co/t/configure-elasticsearch-high-level-client-with-json-parser/143479 "2018-08-08T11:22:25Z")
Is it possible to configure Elasticsearch Java High Level REST Client with a JSON parser? The specific problem I'm experiencing is the following: I'm sending big insert bulk requests to Elasticsearch and they are proces… --- ## [Elasticsearch 6 remove an element from nested array of objects](https://discuss.elastic.co/t/elasticsearch-6-remove-an-element-from-nested-array-of-objects/143499)
**Author:** [@Mohammad\_Jilani](https://discuss.elastic.co/u/Mohammad_Jilani)\ **Replies:** 0\ **Last updated:** [August 8, 2018, 11:20am UTC](https://discuss.elastic.co/t/elasticsearch-6-remove-an-element-from-nested-array-of-objects/143499 "2018-08-08T11:20:28Z")
Here is the index structure. { "\_index": "my\_index2", "\_type": "\_doc", "\_id": "5", "\_score": 1, "\_source": { "group": "fans", "user": \[ { "first": "rayachoty-loki-one", "last": "Smith" }, { "first": "hydera… --- ## [How to index substrings](https://discuss.elastic.co/t/how-to-index-substrings/142997)
**Author:** [@anjireddy543](https://discuss.elastic.co/u/anjireddy543)\ **Replies:** 4\ **Last updated:** [August 8, 2018, 11:03am UTC](https://discuss.elastic.co/t/how-to-index-substrings/142997 "2018-08-08T11:03:21Z")
Hi, I am having some problem with indexing below data. Documents :- CPC, 1908 — Order 43 Rule 1(r ), Order 39 Rule 1, 2 CPC, 1908 — Section 96, 105(1), Order 9 Rule 7 CPC, 1908 — Order 39 Rules 1, Order 39 Rules 1, … --- ## [Average\_bucket , max\_bucket and min\_bucket return invalid results](https://discuss.elastic.co/t/average-bucket-max-bucket-and-min-bucket-return-invalid-results/143488)
**Author:** [@Manoj\_Hettiarachchi](https://discuss.elastic.co/u/Manoj_Hettiarachchi)\ **Replies:** 0\ **Last updated:** [August 8, 2018, 10:18am UTC](https://discuss.elastic.co/t/average-bucket-max-bucket-and-min-bucket-return-invalid-results/143488 "2018-08-08T10:18:54Z")
In my system, I am using Filebeat, Logstash, Elasticsearch, and Kibana. For every transaction in the system, a log is printed in the log file and it is saved in the Elasticsearch db. Sample logline: TID: \[-1234\] \[\] \[20… --- ## [How to improve precision of information retrieval](https://discuss.elastic.co/t/how-to-improve-precision-of-information-retrieval/143487)
**Author:** [@Nick\_Evans](https://discuss.elastic.co/u/Nick_Evans)\ **Replies:** 0\ **Last updated:** [August 8, 2018, 10:16am UTC](https://discuss.elastic.co/t/how-to-improve-precision-of-information-retrieval/143487 "2018-08-08T10:16:53Z")
Maybe this question is too general but.. I have a dataset of 30k+ documents which is loosely based on the gov2 dataset (I think it may be a subset). I am struggling to improve the precision@10 metric, which is how this… --- ## [Courier fetch: 15 of 38 shards failed](https://discuss.elastic.co/t/courier-fetch-15-of-38-shards-failed/143269)
**Author:** [@Tusune](https://discuss.elastic.co/u/Tusune)\ **Replies:** 1\ **Last updated:** [August 8, 2018, 10:03am UTC](https://discuss.elastic.co/t/courier-fetch-15-of-38-shards-failed/143269 "2018-08-08T10:03:19Z")
Hello, as you can see in the title, i got this famous error, let me explain : I've created a data table, created a sub-bucket for timestamp, then created a other with beat.name, but when i create a sub-bucket with bea… --- ## [Basic License - Features](https://discuss.elastic.co/t/basic-license-features/143466)
**Author:** [@vishnuduttpv](https://discuss.elastic.co/u/vishnuduttpv)\ **Replies:** 2\ **Last updated:** [August 8, 2018, 9:47am UTC](https://discuss.elastic.co/t/basic-license-features/143466 "2018-08-08T09:47:37Z")
Hi, I was using the trial version for the last couple of days. I had elk authentication and all the features was enabled in the trial. After the Trial expiry I went for a basic license. At the time of licensing ,it wa… --- ## [When SQL JOIN command will be available in ElasticSearch?](https://discuss.elastic.co/t/when-sql-join-command-will-be-available-in-elasticsearch/142772)
**Author:** [@Md\_Ghulam\_khaja](https://discuss.elastic.co/u/Md_Ghulam_khaja)\ **Replies:** 13\ **Last updated:** [August 8, 2018, 9:39am UTC](https://discuss.elastic.co/t/when-sql-join-command-will-be-available-in-elasticsearch/142772 "2018-08-08T09:39:00Z")
Any guesses? --- ## [Transform free bytes into GB in ES watch for hard disk utilisation](https://discuss.elastic.co/t/transform-free-bytes-into-gb-in-es-watch-for-hard-disk-utilisation/143162)
**Author:** [@sahil\_sawhney](https://discuss.elastic.co/u/sahil_sawhney)\ **Replies:** 7\ **Last updated:** [August 8, 2018, 9:31am UTC](https://discuss.elastic.co/t/transform-free-bytes-into-gb-in-es-watch-for-hard-disk-utilisation/143162 "2018-08-08T09:31:31Z")
In my scenario i want to simply transform free bytes of Hard disk into GB(wrt to .monitoring-es-6\* index). Doing this operation in groovy was a bit easy. But wrt to v5.6 of ES i need to use java 8 to do so. Applieng map… --- ## [Querying nested objects with same id and status](https://discuss.elastic.co/t/querying-nested-objects-with-same-id-and-status/143465)
**Author:** [@Marko\_Muric](https://discuss.elastic.co/u/Marko_Muric)\ **Replies:** 0\ **Last updated:** [August 8, 2018, 9:23am UTC](https://discuss.elastic.co/t/querying-nested-objects-with-same-id-and-status/143465 "2018-08-08T09:23:48Z")
Hi everyone, this is my first post here, and I'll try to describe problem best way I can. If you need any additional info please let me know. Here is the mapping of my document: PUT test { "settings" : { "n… --- ## [Setup-passwords ERROR: Unknown error](https://discuss.elastic.co/t/setup-passwords-error-unknown-error/143283)
**Author:** [@ssolanoballester](https://discuss.elastic.co/u/ssolanoballester)\ **Replies:** 6\ **Last updated:** [August 8, 2018, 9:08am UTC](https://discuss.elastic.co/t/setup-passwords-error-unknown-error/143283 "2018-08-08T09:08:03Z")
Hi all, I recently installed elastic 6.2.2 with xpack. I'm trying to set password to elastic user, but I got an Unknow error. There is no messages in cluster log. \[elastic@elastic\]$ bin/x-pack/setup-passwords interact… --- ## [Using aggregation based filter DSL](https://discuss.elastic.co/t/using-aggregation-based-filter-dsl/143456)
**Author:** [@emil.mirzayev](https://discuss.elastic.co/u/emil.mirzayev)\ **Replies:** 0\ **Last updated:** [August 8, 2018, 8:47am UTC](https://discuss.elastic.co/t/using-aggregation-based-filter-dsl/143456 "2018-08-08T08:47:31Z")
Hey there all, I have an event index where I have several fields of interest: Device id Device type Event type Event sub-type (every type has up to 4 sub-types, some only 1) My initial goal was to build a data table … --- ## [Rejected execution log messages](https://discuss.elastic.co/t/rejected-execution-log-messages/143455)
**Author:** [@liviu.ioan](https://discuss.elastic.co/u/liviu.ioan)\ **Replies:** 0\ **Last updated:** [August 8, 2018, 8:47am UTC](https://discuss.elastic.co/t/rejected-execution-log-messages/143455 "2018-08-08T08:47:03Z")
Hello, We receive a lot of "rejected execution" messages in our ES logs. E.g.: 2018-06-21 03:50:11,996\]\[DEBUG\]\[action.count \] \[04c4efb4-9365-45d3-9c7b-162e3cbcc051\] \[logstash-2017.07.16\]\[2\], node\[ac07Vu3JSl6vogmMAT4… --- ## [Filtered wildcard query](https://discuss.elastic.co/t/filtered-wildcard-query/143259)
**Author:** [@cleaner](https://discuss.elastic.co/u/cleaner)\ **Replies:** 5\ **Last updated:** [August 8, 2018, 8:33am UTC](https://discuss.elastic.co/t/filtered-wildcard-query/143259 "2018-08-08T08:33:30Z")
Hi, I need your help/advice to increase performance of wildcard query. The same question was here Performance of filtered wildcard queries , but is closed now. We have to use wildcard for data that is filtered by cus… --- ## [How to suppress watches alerts](https://discuss.elastic.co/t/how-to-suppress-watches-alerts/143342)
**Author:** [@addanuj](https://discuss.elastic.co/u/addanuj)\ **Replies:** 1\ **Last updated:** [August 8, 2018, 8:29am UTC](https://discuss.elastic.co/t/how-to-suppress-watches-alerts/143342 "2018-08-08T08:29:20Z")
Is their any way which i can use to suppress watch alerts I am using ELK AS A SIEM, and this seems to be a major problem as i get multiple alerts when ever watch condition gets true, for example if i am getting alerts … [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1586) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1588)