# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1619 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1620 --- ## [Can X-Pack Watcher script conditions use other scripting languages?](https://discuss.elastic.co/t/can-x-pack-watcher-script-conditions-use-other-scripting-languages/139821)
**Author:** [@Rob2](https://discuss.elastic.co/u/Rob2)\ **Replies:** 2\ **Last updated:** [July 12, 2018, 10:36pm UTC](https://discuss.elastic.co/t/can-x-pack-watcher-script-conditions-use-other-scripting-languages/139821 "2018-07-12T22:36:49Z")
The current documentation at https://www.elastic.co/guide/en/x-pack/current/condition-script.html indicates in several places and examples that X-Pack Watcher script conditions can use other languages than "painless". I… --- ## [\_source variables in post\_filter](https://discuss.elastic.co/t/source-variables-in-post-filter/139841)
**Author:** [@Brian\_Keith](https://discuss.elastic.co/u/Brian_Keith)\ **Replies:** 1\ **Last updated:** [July 12, 2018, 10:34pm UTC](https://discuss.elastic.co/t/source-variables-in-post-filter/139841 "2018-07-12T22:34:10Z")
I was using ES 5.4 and upgraded to 6.3. In 5.4 using a painless script in a post\_filter I was able to access array data from a document like def lists = params.\_source\['lists'\];. Now in 6.3 I don't seem to be able to ac… --- ## [How to structure and map my data in ElasticSearch?](https://discuss.elastic.co/t/how-to-structure-and-map-my-data-in-elasticsearch/139816)
**Author:** [@moe.kazemi](https://discuss.elastic.co/u/moe.kazemi)\ **Replies:** 3\ **Last updated:** [July 12, 2018, 8:40pm UTC](https://discuss.elastic.co/t/how-to-structure-and-map-my-data-in-elasticsearch/139816 "2018-07-12T20:40:54Z")
I am very new with Elasticsearch & I want to use ELK to bring one our reports from SSMS and use Elasticsearch to expedite the processing time. In our current design in SSMS we have 3 store proc (Master, Report & Result… --- ## [More\_like\_this and fields with empty values (no matches)](https://discuss.elastic.co/t/more-like-this-and-fields-with-empty-values-no-matches/139822)
**Author:** [@orogvany](https://discuss.elastic.co/u/orogvany)\ **Replies:** 0\ **Last updated:** [July 12, 2018, 7:01pm UTC](https://discuss.elastic.co/t/more-like-this-and-fields-with-empty-values-no-matches/139822 "2018-07-12T19:01:14Z")
I am doing a more\_like\_this query as follows "more\_like\_this" : { "fields" : \[ "title", "keywords", "description" \], "like" : \[ { "\_index" : "indexName", "\_id" : "12354", "\_type": "Object" } \], "min\_term\_fre… --- ## [Switching lincese from Trial to Basic](https://discuss.elastic.co/t/switching-lincese-from-trial-to-basic/139814)
**Author:** [@Devesh\_Pandey](https://discuss.elastic.co/u/Devesh_Pandey)\ **Replies:** 2\ **Last updated:** [July 12, 2018, 7:07pm UTC](https://discuss.elastic.co/t/switching-lincese-from-trial-to-basic/139814 "2018-07-12T19:07:53Z")
Hi Team, I am working on Elasticsearch build and have used trial license to enable xpack for SSL and LDAP integration. Now after the trial is expired and am planning to switch to basic, would I still be able to use ssl/… --- ## [Can not Start Elasticsearch on CentOS 7](https://discuss.elastic.co/t/can-not-start-elasticsearch-on-centos-7/139749)
**Author:** [@leandro\_matos\_pereir](https://discuss.elastic.co/u/leandro_matos_pereir)\ **Replies:** 1\ **Last updated:** [July 12, 2018, 6:13pm UTC](https://discuss.elastic.co/t/can-not-start-elasticsearch-on-centos-7/139749 "2018-07-12T18:13:33Z")
I'm a beginner with elastic search, the same was put into production was with Kibana, search was working but due to some update its stop working and giving this error message while checking status. ===================… --- ## [Upgrade issue with path.data](https://discuss.elastic.co/t/upgrade-issue-with-path-data/139548)
**Author:** [@Ant](https://discuss.elastic.co/u/Ant)\ **Replies:** 3\ **Last updated:** [July 12, 2018, 4:16pm UTC](https://discuss.elastic.co/t/upgrade-issue-with-path-data/139548 "2018-07-12T16:16:11Z")
I've been given a go ahead to get some training which is great but first I need to get the cluster up to the version the training it all for. I've had some issues when I tried a test upgrade before but since then I've r… --- ## [Elasticsearch Won't Start](https://discuss.elastic.co/t/elasticsearch-wont-start/139276)
**Author:** [@jmounce](https://discuss.elastic.co/u/jmounce)\ **Replies:** 13\ **Last updated:** [July 12, 2018, 3:53pm UTC](https://discuss.elastic.co/t/elasticsearch-wont-start/139276 "2018-07-12T15:53:09Z")
Windows 10 - MSI installer - JAVA\_HOME is set Service starts but never registers on 9200. netstat -a -n confirms that no listener on 9200 Log shows that the DiscoveryModule never starts and setup doesn't proceed. What … --- ## [Compare difference in field over time](https://discuss.elastic.co/t/compare-difference-in-field-over-time/139780)
**Author:** [@shong](https://discuss.elastic.co/u/shong)\ **Replies:** 0\ **Last updated:** [July 12, 2018, 2:31pm UTC](https://discuss.elastic.co/t/compare-difference-in-field-over-time/139780 "2018-07-12T14:31:58Z")
HI, I have been trying to figure this out for few days, and I am still confused whether I can do this in logstash or in elasticsearch. I want to analyze a specific field (i.e. src\_ip) and compare with src\_ip on differen… --- ## [Geo-distance ranges](https://discuss.elastic.co/t/geo-distance-ranges/138368)
**Author:** [@Csanad\_Vereckei](https://discuss.elastic.co/u/Csanad_Vereckei)\ **Replies:** 4\ **Last updated:** [July 12, 2018, 2:10pm UTC](https://discuss.elastic.co/t/geo-distance-ranges/138368 "2018-07-12T14:10:35Z")
Hi! I'm somewhat new to Elastic and however I can now use the geo-distance queries and geo filters, I would like to ask if there is any way to get distance between areas. What I mean is, say I have a person at X:Y and … --- ## [Unable to match by value in array field](https://discuss.elastic.co/t/unable-to-match-by-value-in-array-field/139607)
**Author:** [@cweinberger](https://discuss.elastic.co/u/cweinberger)\ **Replies:** 1\ **Last updated:** [July 12, 2018, 2:10pm UTC](https://discuss.elastic.co/t/unable-to-match-by-value-in-array-field/139607 "2018-07-12T14:10:19Z")
Hello, I have a field where I store an array of strings (categories). When querying the categories I only receive a result when I'm searching for the first element of the categories' array (in my example below: hello). … --- ## [Suddenly Elastic Failure (Graphs Included)](https://discuss.elastic.co/t/suddenly-elastic-failure-graphs-included/139338)
**Author:** [@devday](https://discuss.elastic.co/u/devday)\ **Replies:** 8\ **Last updated:** [July 12, 2018, 1:56pm UTC](https://discuss.elastic.co/t/suddenly-elastic-failure-graphs-included/139338 "2018-07-12T13:56:02Z")
Hi, We are experiencing a strange problem. Everything with Elastic Search is fine but we get sudden deaths now and again. This may happen once a week or once a month or twice a day. During this time, I do not believe… --- ## [Where is the template that elasticsearch uses for syslog indexes? I am using logstash for ingestion](https://discuss.elastic.co/t/where-is-the-template-that-elasticsearch-uses-for-syslog-indexes-i-am-using-logstash-for-ingestion/138248)
**Author:** [@erikjsmith](https://discuss.elastic.co/u/erikjsmith)\ **Replies:** 4\ **Last updated:** [July 12, 2018, 1:44pm UTC](https://discuss.elastic.co/t/where-is-the-template-that-elasticsearch-uses-for-syslog-indexes-i-am-using-logstash-for-ingestion/138248 "2018-07-12T13:44:39Z")
I am getting the following error: \[2018-07-02T13:53:58,975\]\[DEBUG\]\[o.e.a.b.TransportShardBulkAction\] \[syslog-2018.07.02\]\[3\] failed to execute bulk item (index) BulkShardRequest \[\[syslog-2018.07.02\]\[3\]\] containing \[7\] re… --- ## [Not able to install elasticsearch](https://discuss.elastic.co/t/not-able-to-install-elasticsearch/139763)
**Author:** [@R\_H](https://discuss.elastic.co/u/R_H)\ **Replies:** 1\ **Last updated:** [July 12, 2018, 1:41pm UTC](https://discuss.elastic.co/t/not-able-to-install-elasticsearch/139763 "2018-07-12T13:41:10Z")
I'm trying to install elasticsearch following the instructions on this page: https://www.elastic.co/downloads/elasticsearch I downloaded elasticsearch-6.3.1. Added lib directory to my system path:C:\\ElasticSearch\\elast… --- ## [Field value equal "Unknown" get error](https://discuss.elastic.co/t/field-value-equal-unknown-get-error/139692)
**Author:** [@Izek](https://discuss.elastic.co/u/Izek)\ **Replies:** 3\ **Last updated:** [July 12, 2018, 1:25pm UTC](https://discuss.elastic.co/t/field-value-equal-unknown-get-error/139692 "2018-07-12T13:25:46Z")
I get the error message as below: "error"=\>{"type"=\>"mapper\_parsing\_exception", "reason"=\>"failed to parse \[details-RequestData-MessageTag\]", "caused\_by"=\>{"type"=\>"illegal\_argument\_exception", "reason"=\>"For input stri… --- ## [Problem with Deleting old indices using curator](https://discuss.elastic.co/t/problem-with-deleting-old-indices-using-curator/139635)
**Author:** [@ELK\_developer99](https://discuss.elastic.co/u/ELK_developer99)\ **Replies:** 5\ **Last updated:** [July 12, 2018, 1:24pm UTC](https://discuss.elastic.co/t/problem-with-deleting-old-indices-using-curator/139635 "2018-07-12T13:24:57Z")
Trying to delete old indices using curator. I have indices in the following format: {name}-{%m%d}. For example: "john-0709" or "jane-0702". Here is my action file: actions: 1: action: delete\_indices filters: … --- ## [Binary file indexing](https://discuss.elastic.co/t/binary-file-indexing/139498)
**Author:** [@sankar\_elastic](https://discuss.elastic.co/u/sankar_elastic)\ **Replies:** 6\ **Last updated:** [July 12, 2018, 1:24pm UTC](https://discuss.elastic.co/t/binary-file-indexing/139498 "2018-07-12T13:24:49Z")
Can we indexing the binary file through elastic which is not having any extension ? --- ## [Elasticsearch can not run as root](https://discuss.elastic.co/t/elasticsearch-can-not-run-as-root/139751)
**Author:** [@fabrice](https://discuss.elastic.co/u/fabrice)\ **Replies:** 1\ **Last updated:** [July 12, 2018, 12:46pm UTC](https://discuss.elastic.co/t/elasticsearch-can-not-run-as-root/139751 "2018-07-12T12:46:51Z")
I've installed elasticsearch with the .deb packages, I use it with sonar. When i try to start sonar, it not run. when i look the logfile (es.log), it is because elasticsearch can not run as root. I want help --- ## [Rollup, removing the rolled-up data safely?](https://discuss.elastic.co/t/rollup-removing-the-rolled-up-data-safely/138929)
**Author:** [@Damien\_Alexandre](https://discuss.elastic.co/u/Damien_Alexandre)\ **Replies:** 1\ **Last updated:** [July 12, 2018, 12:33pm UTC](https://discuss.elastic.co/t/rollup-removing-the-rolled-up-data-safely/138929 "2018-07-12T12:33:39Z")
I can't find a way to be sure a document or an index has been rolled-up before removing it. When using the Rollup API to gain space and get smaller indexes / longer data retention, there is obviously a removing process … --- ## [Elasticsearch 2.4 node changed after java heap crashed](https://discuss.elastic.co/t/elasticsearch-2-4-node-changed-after-java-heap-crashed/138969)
**Author:** [@motts](https://discuss.elastic.co/u/motts)\ **Replies:** 4\ **Last updated:** [July 12, 2018, 12:25pm UTC](https://discuss.elastic.co/t/elasticsearch-2-4-node-changed-after-java-heap-crashed/138969 "2018-07-12T12:25:02Z")
Hello, As the title suggests, the ES 2.4 instance I had running crashed due to out of java heap error. I increased the memory and restarted ES, but all of the data started showing up as analyzed. Did some more digging a… --- ## [Elasticsearch immediately stop after start](https://discuss.elastic.co/t/elasticsearch-immediately-stop-after-start/138341)
**Author:** [@mamta](https://discuss.elastic.co/u/mamta)\ **Replies:** 2\ **Last updated:** [July 12, 2018, 12:09pm UTC](https://discuss.elastic.co/t/elasticsearch-immediately-stop-after-start/138341 "2018-07-12T12:09:41Z")
I installed elasticsearch 5.6.8 on Redhat. I have started the elasticsearch by using systemctl start elasticsearch . After status change to running then it goes to the failure mode. I am sending you my elasticsearch log… --- ## [How to get elasticsearch minimum buckets count](https://discuss.elastic.co/t/how-to-get-elasticsearch-minimum-buckets-count/139739)
**Author:** [@SKumarMN](https://discuss.elastic.co/u/SKumarMN)\ **Replies:** 0\ **Last updated:** [July 12, 2018, 11:24am UTC](https://discuss.elastic.co/t/how-to-get-elasticsearch-minimum-buckets-count/139739 "2018-07-12T11:24:46Z")
I want to get results on an aggregation where buckets.length (number / count of buckets) has a minimum count, kind of like HAVING in SQL. (In this particular scenario site visitors who have visited at-least 5 different … --- ## [Low performance](https://discuss.elastic.co/t/low-performance/139574)
**Author:** [@shanmukha1499](https://discuss.elastic.co/u/shanmukha1499)\ **Replies:** 6\ **Last updated:** [July 12, 2018, 11:14am UTC](https://discuss.elastic.co/t/low-performance/139574 "2018-07-12T11:14:36Z")
Hi I have elastic cluster of 2 nodes with same hardware specifications hardware specs of each machine: RAM:16G No.of Cpu's : 2 node1- master+data node2- master+data discovery.zen.minimum\_master\_nodes: 1 Here are … --- ## [Number of active threads for bulk thread\_pool is equal to number of shards to which write is happening and not a single bulk request](https://discuss.elastic.co/t/number-of-active-threads-for-bulk-thread-pool-is-equal-to-number-of-shards-to-which-write-is-happening-and-not-a-single-bulk-request/139723)
**Author:** [@vineeth\_mohan\_2](https://discuss.elastic.co/u/vineeth_mohan_2)\ **Replies:** 4\ **Last updated:** [July 12, 2018, 10:39am UTC](https://discuss.elastic.co/t/number-of-active-threads-for-bulk-thread-pool-is-equal-to-number-of-shards-to-which-write-is-happening-and-not-a-single-bulk-request/139723 "2018-07-12T10:39:54Z")
Number of active threads for bulk thread\_pool is equal to number of shards to which write is happening and not a single bulk request. My understanding was that , active threads in thread\_pool = number of concurrent bulk… --- ## [Xpack setup-passwords gives java.net.BindException](https://discuss.elastic.co/t/xpack-setup-passwords-gives-java-net-bindexception/139702)
**Author:** [@rkparkar](https://discuss.elastic.co/u/rkparkar)\ **Replies:** 2\ **Last updated:** [July 12, 2018, 10:26am UTC](https://discuss.elastic.co/t/xpack-setup-passwords-gives-java-net-bindexception/139702 "2018-07-12T10:26:06Z")
I am following elastic guideto install xpack. (ref: https://www.elastic.co/guide/en/elasticsearch/reference/6.2/installing-xpack-es.html) but when i try to setup-password (command : bin/x-pack/setup-passwords interactiv… --- ## [How to search case sensitive in elasticsearch without mapping](https://discuss.elastic.co/t/how-to-search-case-sensitive-in-elasticsearch-without-mapping/139482)
**Author:** [@satyaveer1](https://discuss.elastic.co/u/satyaveer1)\ **Replies:** 14\ **Last updated:** [July 12, 2018, 10:13am UTC](https://discuss.elastic.co/t/how-to-search-case-sensitive-in-elasticsearch-without-mapping/139482 "2018-07-12T10:13:19Z")
I am creating an elasticsearch app where i need to case sensitive search without use of mapping. So please suggest me how to do this. --- ## [Elasticsearch split brain - adding a 3rd node with node.data=false](https://discuss.elastic.co/t/elasticsearch-split-brain-adding-a-3rd-node-with-node-data-false/139582)
**Author:** [@liviu.ioan](https://discuss.elastic.co/u/liviu.ioan)\ **Replies:** 11\ **Last updated:** [July 12, 2018, 9:58am UTC](https://discuss.elastic.co/t/elasticsearch-split-brain-adding-a-3rd-node-with-node-data-false/139582 "2018-07-12T09:58:44Z")
Hello, We have a 2 nodes ES cluster. Each node is in a separate datacenter. There has been an issue with the network that connects the 2 datacenters and now we have a split brain issue. To avoid the split brain probl… --- ## [Fluentd authentication to Elasticsearch API via X-Pack](https://discuss.elastic.co/t/fluentd-authentication-to-elasticsearch-api-via-x-pack/138226)
**Author:** [@helper](https://discuss.elastic.co/u/helper)\ **Replies:** 2\ **Last updated:** [July 12, 2018, 9:43am UTC](https://discuss.elastic.co/t/fluentd-authentication-to-elasticsearch-api-via-x-pack/138226 "2018-07-12T09:43:31Z")
Please could some one suggest me, How do I configure FluentD authentication to Elasticsearch API after installation of X-Pack. Any documentation or examples will be ideal. --- ## [How to calculate growth rate? (metric visualization)](https://discuss.elastic.co/t/how-to-calculate-growth-rate-metric-visualization/139712)
**Author:** [@PhilippeCourtemanche](https://discuss.elastic.co/u/PhilippeCourtemanche)\ **Replies:** 0\ **Last updated:** [July 12, 2018, 9:32am UTC](https://discuss.elastic.co/t/how-to-calculate-growth-rate-metric-visualization/139712 "2018-07-12T09:32:40Z")
Hi, I have this graph, which was built with this mysql data. I'd like to be able to calculate the growth rate in the past five months let's say. I'd like to be able to show this as a number next to a graph. I guess tha… --- ## [Unable to query hash value generated from (zero-allocation-hashing ) algorithm - from ES 2.3](https://discuss.elastic.co/t/unable-to-query-hash-value-generated-from-zero-allocation-hashing-algorithm-from-es-2-3/139553)
**Author:** [@subramani.new](https://discuss.elastic.co/u/subramani.new)\ **Replies:** 2\ **Last updated:** [July 12, 2018, 8:56am UTC](https://discuss.elastic.co/t/unable-to-query-hash-value-generated-from-zero-allocation-hashing-algorithm-from-es-2-3/139553 "2018-07-12T08:56:33Z")
I have stored array of hash values in a document but unable to query based on hash. Please help Here the index details Field name is bids and it stores array of hash values {"properties": {"bids":{"type":"long"}}} … [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1618) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1620)