# Elasticsearch

**URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1592

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 1593

---

## [Help Optimizing Terms Aggregation](https://discuss.elastic.co/t/help-optimizing-terms-aggregation/142661)

<div class="topic-metadata">

**Author:** [@sudhanne](https://discuss.elastic.co/u/sudhanne)\
**Replies:** 2\
**Last updated:** [August 2, 2018, 2:51pm UTC](https://discuss.elastic.co/t/help-optimizing-terms-aggregation/142661 "2018-08-02T14:51:06Z")

</div>

Trying to design a query that will return customer data bucketed into various time ranges. The total number of documents being aggregated on will always be scoped to a given client, which in practice should never exceed …

---

## [Intermittent connection closure when performing GET operations](https://discuss.elastic.co/t/intermittent-connection-closure-when-performing-get-operations/142978)

<div class="topic-metadata">

**Author:** [@Ashish\_Goel1](https://discuss.elastic.co/u/Ashish_Goel1)\
**Replies:** 0\
**Last updated:** [August 3, 2018, 9:38pm UTC](https://discuss.elastic.co/t/intermittent-connection-closure-when-performing-get-operations/142978 "2018-08-03T21:38:19Z")

</div>

Hi there, We are experiencing some intermittent issues when performing GET operations with our cluster 6.2.3 and client is 6.2.x (JAVA). Every now and then we get a ConnectionClosedException. Below is the stack trace fo…

---

## [Scaling a cluster with multiple indices](https://discuss.elastic.co/t/scaling-a-cluster-with-multiple-indices/142977)

<div class="topic-metadata">

**Author:** [@username123](https://discuss.elastic.co/u/username123)\
**Replies:** 0\
**Last updated:** [August 3, 2018, 9:25pm UTC](https://discuss.elastic.co/t/scaling-a-cluster-with-multiple-indices/142977 "2018-08-03T21:25:08Z")

</div>

Hi, I have an elastic 2.3 legacy cluster that I have to scale up to prepare for a significant seasonal load. I observe that there are 2 indices on the cluster with the following configs: Index P: "number\_of\_shards": "4…

---

## [Inability to set up Shield/Security within X-Pack Trial](https://discuss.elastic.co/t/inability-to-set-up-shield-security-within-x-pack-trial/142924)

<div class="topic-metadata">

**Author:** [@tvoll](https://discuss.elastic.co/u/tvoll)\
**Replies:** 6\
**Last updated:** [August 3, 2018, 8:48pm UTC](https://discuss.elastic.co/t/inability-to-set-up-shield-security-within-x-pack-trial/142924 "2018-08-03T20:48:43Z")

</div>

So, I'm currently testing out the trial of X-Pack on my test install, and i'm having an issue enabling the Security portion of X-Pack. From the guides provided, it is presented that it should be as easy as entering xpac…

---

## [Unable to join ES node with different cluster\_uuid](https://discuss.elastic.co/t/unable-to-join-es-node-with-different-cluster-uuid/142819)

<div class="topic-metadata">

**Author:** [@sc5283](https://discuss.elastic.co/u/sc5283)\
**Replies:** 2\
**Last updated:** [August 3, 2018, 8:21pm UTC](https://discuss.elastic.co/t/unable-to-join-es-node-with-different-cluster-uuid/142819 "2018-08-03T20:21:26Z")

</div>

I am unable to join ES node to a cluster (do not see it kibana monitoring / cluster nodes, and I can connect to the endpoint from all locations to the default port 9200). The only difference I found between all nodes is…

---

## [Elasticsearch 6.3.1 failure and netstat listening even after failure](https://discuss.elastic.co/t/elasticsearch-6-3-1-failure-and-netstat-listening-even-after-failure/142957)

<div class="topic-metadata">

**Author:** [@gmvvrphani](https://discuss.elastic.co/u/gmvvrphani)\
**Replies:** 2\
**Last updated:** [August 3, 2018, 7:24pm UTC](https://discuss.elastic.co/t/elasticsearch-6-3-1-failure-and-netstat-listening-even-after-failure/142957 "2018-08-03T19:24:59Z")

</div>

systemd\[1\]: elasticsearch.service: control process exited, code=exited status=1 .com systemd\[1\]: Failed to start LSB: elasticsearch. .com systemd\[1\]: Unit elasticsearch.service entered failed state. .com systemd\[1\]: e…

---

## [Problem Advanced configuration for Dashboard Only mode](https://discuss.elastic.co/t/problem-advanced-configuration-for-dashboard-only-mode/142825)

<div class="topic-metadata">

**Author:** [@fabianlagos](https://discuss.elastic.co/u/fabianlagos)\
**Replies:** 2\
**Last updated:** [August 3, 2018, 7:23pm UTC](https://discuss.elastic.co/t/problem-advanced-configuration-for-dashboard-only-mode/142825 "2018-08-03T19:23:49Z")

</div>

Hi, i have two index in elastic cloud Added the new role for a custom dashboard Created and configured roled with index "chiporro" Created user and assigned role When I log in to user test1, I can't see the d…

---

## [Will All Template Fields be Present on an Index?](https://discuss.elastic.co/t/will-all-template-fields-be-present-on-an-index/142763)

<div class="topic-metadata">

**Author:** [@ryanrossiter](https://discuss.elastic.co/u/ryanrossiter)\
**Replies:** 3\
**Last updated:** [August 3, 2018, 6:18pm UTC](https://discuss.elastic.co/t/will-all-template-fields-be-present-on-an-index/142763 "2018-08-03T18:18:51Z")

</div>

Hi, I am wondering if when an index template has fields defined that aren't present on the data being inserted into an index (none of the data has the field present), will those fields still exist on the index? Or will t…

---

## [One of my nodes is offline](https://discuss.elastic.co/t/one-of-my-nodes-is-offline/142944)

<div class="topic-metadata">

**Author:** [@Diego\_Moreno](https://discuss.elastic.co/u/Diego_Moreno)\
**Replies:** 3\
**Last updated:** [August 3, 2018, 5:30pm UTC](https://discuss.elastic.co/t/one-of-my-nodes-is-offline/142944 "2018-08-03T17:30:09Z")

</div>

---

## [Uninstalled X-Pack but it's still there?](https://discuss.elastic.co/t/uninstalled-x-pack-but-its-still-there/142949)

<div class="topic-metadata">

**Author:** [@mathurin68](https://discuss.elastic.co/u/mathurin68)\
**Replies:** 3\
**Last updated:** [August 3, 2018, 5:19pm UTC](https://discuss.elastic.co/t/uninstalled-x-pack-but-its-still-there/142949 "2018-08-03T17:19:20Z")

</div>

Upgraded ES/LS/K to latest { "name": "qrSYXO4", "cluster\_name": "elasticsearch", "cluster\_uuid": "IVS7Fb\_fQ3mGxFbyqfM-NQ", "version": { "number": "6.3.2", "build\_flavor": "default", "build\_type": "de…

---

## [ElasticSearch Rest High Level Client - Mustache Template Call API Support](https://discuss.elastic.co/t/elasticsearch-rest-high-level-client-mustache-template-call-api-support/142810)

<div class="topic-metadata">

**Author:** [@aperavali0326](https://discuss.elastic.co/u/aperavali0326)\
**Replies:** 3\
**Last updated:** [August 3, 2018, 5:04pm UTC](https://discuss.elastic.co/t/elasticsearch-rest-high-level-client-mustache-template-call-api-support/142810 "2018-08-03T17:04:11Z")

</div>

Hello , I am trying to test Elasticsearch Rest Highlevel client 6.4 an the official build is not available in maven I have tried to build locally and I get errors like FAILURE: Build failed with an exception. Wher…

---

## [Composite, Nested, and Script Aggregation](https://discuss.elastic.co/t/composite-nested-and-script-aggregation/142950)

<div class="topic-metadata">

**Author:** [@Michael\_Hatch1](https://discuss.elastic.co/u/Michael_Hatch1)\
**Replies:** 0\
**Last updated:** [August 3, 2018, 4:29pm UTC](https://discuss.elastic.co/t/composite-nested-and-script-aggregation/142950 "2018-08-03T16:29:45Z")

</div>

How do I formulate a query to fetch the top discount (100 - price/value \*100) of each brand, returning the brand name and its max discount available? I'm using a script to calc the discount, but I'm having trouble compil…

---

## [Can a pipeline be managed by set/group of users](https://discuss.elastic.co/t/can-a-pipeline-be-managed-by-set-group-of-users/140834)

<div class="topic-metadata">

**Author:** [@Elango-mas](https://discuss.elastic.co/u/Elango-mas)\
**Replies:** 1\
**Last updated:** [August 3, 2018, 3:13pm UTC](https://discuss.elastic.co/t/can-a-pipeline-be-managed-by-set-group-of-users/140834 "2018-08-03T15:13:13Z")

</div>

Hello Experts, I want to enable a UserGroup to manage a set of pipelines in Logstash. At present i can configure a query to allows a user to view only the pipelines that he has created. But i am not able create query …

---

## [Does elasticsearch works with Symfony? How it is installed?](https://discuss.elastic.co/t/does-elasticsearch-works-with-symfony-how-it-is-installed/142931)

<div class="topic-metadata">

**Author:** [@Oliver\_Russell](https://discuss.elastic.co/u/Oliver_Russell)\
**Replies:** 1\
**Last updated:** [August 3, 2018, 3:07pm UTC](https://discuss.elastic.co/t/does-elasticsearch-works-with-symfony-how-it-is-installed/142931 "2018-08-03T15:07:09Z")

</div>

Guys I am new to Symfony and elasticsearch. I went through the documentation of both elasticsearch and symfony to get better understanding of it. I was able to install Symfony 4 on my system by following the linked guide…

---

## [Don't find elasticsearch page http://185.65.247.64:9200](https://discuss.elastic.co/t/dont-find-elasticsearch-page-http-185-65-247-64-9200/142932)

<div class="topic-metadata">

**Author:** [@Vadim\_Klimenko](https://discuss.elastic.co/u/Vadim_Klimenko)\
**Replies:** 1\
**Last updated:** [August 3, 2018, 3:06pm UTC](https://discuss.elastic.co/t/dont-find-elasticsearch-page-http-185-65-247-64-9200/142932 "2018-08-03T15:06:00Z")

</div>

It's VPS and when I start elasticsearch everything OK. But in browzer http://185.65.247.64:9200 site can’t be reached All files here http://185.65.247.64/elasticsearch-6.3.2/

---

## [Getting ML job with Java API on Elastic Cloud](https://discuss.elastic.co/t/getting-ml-job-with-java-api-on-elastic-cloud/142790)

<div class="topic-metadata">

**Author:** [@dbailey](https://discuss.elastic.co/u/dbailey)\
**Replies:** 4\
**Last updated:** [August 3, 2018, 2:40pm UTC](https://discuss.elastic.co/t/getting-ml-job-with-java-api-on-elastic-cloud/142790 "2018-08-03T14:40:03Z")

</div>

Hi there, I noticed that running a simple GET \_xpack/ml/anomaly\_detectors/job-that-does-not-exist through the Java low-level REST client against a trial Elastic Cloud deployment returns a 400 BAD\_REQUEST instead of a 404…

---

## [Retention of logfiles based on log level](https://discuss.elastic.co/t/retention-of-logfiles-based-on-log-level/142923)

<div class="topic-metadata">

**Author:** [@Veel\_Koffiedrinken](https://discuss.elastic.co/u/Veel_Koffiedrinken)\
**Replies:** 0\
**Last updated:** [August 3, 2018, 2:08pm UTC](https://discuss.elastic.co/t/retention-of-logfiles-based-on-log-level/142923 "2018-08-03T14:08:59Z")

</div>

Hi, We would like to keep log messages of type ERROR twice as long as the other log levels. How do we accomplish that with ElasticSearch 3.6.2 ? We are using your docker image.

---

## [Multiple boost queries](https://discuss.elastic.co/t/multiple-boost-queries/142917)

<div class="topic-metadata">

**Author:** [@NewScientists](https://discuss.elastic.co/u/NewScientists)\
**Replies:** 1\
**Last updated:** [August 3, 2018, 2:03pm UTC](https://discuss.elastic.co/t/multiple-boost-queries/142917 "2018-08-03T14:03:42Z")

</div>

Hello, i've been trying to find the right format for a mutliple boost query for the last hour, could someone assist me in writing this correctly? essentially it is a single query that can do the below many times. This W…

---

## [ES Takes CPU Hostage](https://discuss.elastic.co/t/es-takes-cpu-hostage/142831)

<div class="topic-metadata">

**Author:** [@mt9999](https://discuss.elastic.co/u/mt9999)\
**Replies:** 5\
**Last updated:** [August 3, 2018, 1:46pm UTC](https://discuss.elastic.co/t/es-takes-cpu-hostage/142831 "2018-08-03T13:46:59Z")

</div>

I have a pretty simple ES docker stack deployed with about 4 indexes. One has ~44m objects. I have tried to follow everyones suggestions on here like increase heap space, I even gave it 6 cpu's. It seems no matter wha…

---

## [ES 6.2.4 - ALLOCATION\_FAILED TranslogCorruptedException](https://discuss.elastic.co/t/es-6-2-4-allocation-failed-translogcorruptedexception/142182)

<div class="topic-metadata">

**Author:** [@ld\_pvl](https://discuss.elastic.co/u/ld_pvl)\
**Replies:** 1\
**Last updated:** [August 3, 2018, 1:35pm UTC](https://discuss.elastic.co/t/es-6-2-4-allocation-failed-translogcorruptedexception/142182 "2018-08-03T13:35:06Z")

</div>

Hi Elastic Team, There's a single unassigned shard in the cluster due to ALLOCATION\_FAILED error which I can't figure out how to resolve. I've already tried retrying several times using curl -XPOST 'localhost:9200/\_clu…

---

## [Error to setup Google Cloud Storage service auth](https://discuss.elastic.co/t/error-to-setup-google-cloud-storage-service-auth/142823)

<div class="topic-metadata">

**Author:** [@gutiago](https://discuss.elastic.co/u/gutiago)\
**Replies:** 1\
**Last updated:** [August 3, 2018, 1:20pm UTC](https://discuss.elastic.co/t/error-to-setup-google-cloud-storage-service-auth/142823 "2018-08-03T13:20:50Z")

</div>

Hello! I'm trying to configure the service auth of my Google Cloud bucket on Elasticsearch. My intention is to create a snapshot of my cluster in the bucket. I'm following this tutorial from the Elastic documentation. …

---

## [ML job not updating in real time](https://discuss.elastic.co/t/ml-job-not-updating-in-real-time/142709)

<div class="topic-metadata">

**Author:** [@chrillebile](https://discuss.elastic.co/u/chrillebile)\
**Replies:** 3\
**Last updated:** [August 3, 2018, 1:01pm UTC](https://discuss.elastic.co/t/ml-job-not-updating-in-real-time/142709 "2018-08-03T13:01:44Z")

</div>

Hey, I'm having a strange problem. I have an ML job (with a bucket span of 1 day) that are running in real time, but it has the "latest timestamp" on 2018-07-26 even though the latest data is from 2018-08-01. If I stop …

---

## [All shards failed for phase: \[query\] - messages after upgrade](https://discuss.elastic.co/t/all-shards-failed-for-phase-query-messages-after-upgrade/142900)

<div class="topic-metadata">

**Author:** [@Pimpek](https://discuss.elastic.co/u/Pimpek)\
**Replies:** 1\
**Last updated:** [August 3, 2018, 12:46pm UTC](https://discuss.elastic.co/t/all-shards-failed-for-phase-query-messages-after-upgrade/142900 "2018-08-03T12:46:29Z")

</div>

Hi, I recently upgraded elasticsearch from 5.6.10 to 6.3.2 (on centos6). It's a single testing instance so no replication is configured yet. I dump telegraf metrics from various hosts in here. Now after the upgrade whe…

---

## [Deny LDAP users without role mapping](https://discuss.elastic.co/t/deny-ldap-users-without-role-mapping/142898)

<div class="topic-metadata">

**Author:** [@programagor](https://discuss.elastic.co/u/programagor)\
**Replies:** 1\
**Last updated:** [August 3, 2018, 12:36pm UTC](https://discuss.elastic.co/t/deny-ldap-users-without-role-mapping/142898 "2018-08-03T12:36:10Z")

</div>

Greetings I have some of my nodes set up to accept users via LDAP authentication, with role mapping based on group membership. The relevant configuration looks like this. elasticsearch.yml: xpack.security.authc.realms…

---

## [Create properties with wildcard](https://discuss.elastic.co/t/create-properties-with-wildcard/142685)

<div class="topic-metadata">

**Author:** [@lvinyes](https://discuss.elastic.co/u/lvinyes)\
**Replies:** 7\
**Last updated:** [August 3, 2018, 12:32pm UTC](https://discuss.elastic.co/t/create-properties-with-wildcard/142685 "2018-08-03T12:32:14Z")

</div>

Hi, In a log from CISCO SFR there are two IP (source and destination) and I want to send with logstash to elasticsearch with geoip information. The logstash template in elasticsearch has only one property named geoip, …

---

## [Data missing when we are using doc value fields for a date type](https://discuss.elastic.co/t/data-missing-when-we-are-using-doc-value-fields-for-a-date-type/142907)

<div class="topic-metadata">

**Author:** [@satishmaddu](https://discuss.elastic.co/u/satishmaddu)\
**Replies:** 0\
**Last updated:** [August 3, 2018, 12:29pm UTC](https://discuss.elastic.co/t/data-missing-when-we-are-using-doc-value-fields-for-a-date-type/142907 "2018-08-03T12:29:52Z")

</div>

Data missing when we are using doc value fields for a "Date" Type. We are querying for dates and getting through doc values fields. Some times it is working fine and some times dates are missing even dates are availabl…

---

## [Unable to start filebeat agent](https://discuss.elastic.co/t/unable-to-start-filebeat-agent/142904)

<div class="topic-metadata">

**Author:** [@subbu5678](https://discuss.elastic.co/u/subbu5678)\
**Replies:** 0\
**Last updated:** [August 3, 2018, 12:12pm UTC](https://discuss.elastic.co/t/unable-to-start-filebeat-agent/142904 "2018-08-03T12:12:50Z")

</div>

Hi team, I am unable to start filebeat service on a centos 7 server. Here is my filebeat.yml file filebeat: ~ level: Error logging: files: keepfiles: 7 name: filebeat.log path: /var/log/filebeat rotateeverybyte…

---

## [Initial heap size \[199229440\] not equal to maximum heap size \[3187671040\]; this can cause resize pauses and prevents mlockall from locking the entire heap](https://discuss.elastic.co/t/initial-heap-size-199229440-not-equal-to-maximum-heap-size-3187671040-this-can-cause-resize-pauses-and-prevents-mlockall-from-locking-the-entire-heap/142282)

<div class="topic-metadata">

**Author:** [@Imrankhan](https://discuss.elastic.co/u/Imrankhan)\
**Replies:** 8\
**Last updated:** [August 3, 2018, 11:22am UTC](https://discuss.elastic.co/t/initial-heap-size-199229440-not-equal-to-maximum-heap-size-3187671040-this-can-cause-resize-pauses-and-prevents-mlockall-from-locking-the-entire-heap/142282 "2018-08-03T11:22:26Z")

</div>

I have installed elasticsearch 6.1.3 and below is the log while starting the server. (i have set -Xms2g -Xmx2g in jvm.options file) but still facing "initial heap size \[199229440\] not equal to maximum heap size \[3187671…

---

## [Hadoop and ES connectivity](https://discuss.elastic.co/t/hadoop-and-es-connectivity/139534)

<div class="topic-metadata">

**Author:** [@impu.vasudev](https://discuss.elastic.co/u/impu.vasudev)\
**Replies:** 6\
**Last updated:** [August 3, 2018, 10:54am UTC](https://discuss.elastic.co/t/hadoop-and-es-connectivity/139534 "2018-08-03T10:54:29Z")

</div>

Hi all, ES is installed in one of my node and i am running a trail version of ES but i am unable to connect it to Hadoop. My question is can we establish connectivity between ES and Hadoop in trail version.

---

## [By default Elasticsearch or Kibana does not support multiusers?](https://discuss.elastic.co/t/by-default-elasticsearch-or-kibana-does-not-support-multiusers/142863)

<div class="topic-metadata">

**Author:** [@Gosforth](https://discuss.elastic.co/u/Gosforth)\
**Replies:** 6\
**Last updated:** [August 3, 2018, 10:51am UTC](https://discuss.elastic.co/t/by-default-elasticsearch-or-kibana-does-not-support-multiusers/142863 "2018-08-03T10:51:24Z")

</div>

Without commercial x-pack I can have only one Kibana account and one Elasticserach account?

[Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1591)

[Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1593)
