# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1622 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1623 --- ## [Ends with operator in elastic search](https://discuss.elastic.co/t/ends-with-operator-in-elastic-search/139352)
**Author:** [@ivar](https://discuss.elastic.co/u/ivar)\ **Replies:** 2\ **Last updated:** [July 10, 2018, 9:12pm UTC](https://discuss.elastic.co/t/ends-with-operator-in-elastic-search/139352 "2018-07-10T21:12:48Z")
I'm using elastic search 5.6 is there an ends with operator ? is wildcard:"\*suffix" the only option to search for a field ending with suffix ? --- ## [Parse Exception while executing has\_child query in Embedded Elastic Search Server](https://discuss.elastic.co/t/parse-exception-while-executing-has-child-query-in-embedded-elastic-search-server/138977)
**Author:** [@shalini\_hemachandran](https://discuss.elastic.co/u/shalini_hemachandran)\ **Replies:** 4\ **Last updated:** [July 10, 2018, 6:07pm UTC](https://discuss.elastic.co/t/parse-exception-while-executing-has-child-query-in-embedded-elastic-search-server/138977 "2018-07-10T18:07:33Z")
Hi, I am getting the following exception while executing a has\_child query in Embedded Elastic Search Server. at org.elasticsearch.rest.BytesRestResponse.errorFromXContent(BytesRestResponse.java:177) at org.elasticse… --- ## [Optimising Elasticsearch Search Queries](https://discuss.elastic.co/t/optimising-elasticsearch-search-queries/139320)
**Author:** [@puneetkhushwani](https://discuss.elastic.co/u/puneetkhushwani)\ **Replies:** 9\ **Last updated:** [July 10, 2018, 5:45pm UTC](https://discuss.elastic.co/t/optimising-elasticsearch-search-queries/139320 "2018-07-10T17:45:30Z")
Hi all, We have an ES cluster setup on AWS with 3 master nodes (c4.xlarge.elasticsearch) & 3 data nodes (c4.xlarge.elasticsearch) with a single index using 5 shards. Our mapping looks like this. { "mappings": { "\_do… --- ## [Disaster Planning](https://discuss.elastic.co/t/disaster-planning/139405)
**Author:** [@mikeme1988](https://discuss.elastic.co/u/mikeme1988)\ **Replies:** 1\ **Last updated:** [July 10, 2018, 5:51pm UTC](https://discuss.elastic.co/t/disaster-planning/139405 "2018-07-10T17:51:02Z")
Hi everyone! First off let me in advance apologize for the probably dumb question but I am fairly new to Elasticsearch. This all assumes that the master nodes are dedicated and running. I am trying to do disaster reco… --- ## [\[ERROR\]\[o.e.x.m.c.n.NodeStatsCollector\] \[data02\] collector \[node\_stats\] timed out when collecting data](https://discuss.elastic.co/t/error-o-e-x-m-c-n-nodestatscollector-data02-collector-node-stats-timed-out-when-collecting-data/139404)
**Author:** [@bt\_scotth](https://discuss.elastic.co/u/bt_scotth)\ **Replies:** 2\ **Last updated:** [July 10, 2018, 5:14pm UTC](https://discuss.elastic.co/t/error-o-e-x-m-c-n-nodestatscollector-data02-collector-node-stats-timed-out-when-collecting-data/139404 "2018-07-10T17:14:00Z")
I am looking to get rid of this error. \[2018-07-10T16:36:42,048\]\[ERROR\]\[o.e.x.m.c.n.NodeStatsCollector\] \[data02\] collector \[node\_stats\] timed out when collecting data \[2018-07-10T16:37:02,049\]\[ERROR\]\[o.e.x.m.c.n.NodeSta… --- ## [Version 6.3 \_flush not flushing](https://discuss.elastic.co/t/version-6-3-flush-not-flushing/139386)
**Author:** [@L8apex32](https://discuss.elastic.co/u/L8apex32)\ **Replies:** 3\ **Last updated:** [July 10, 2018, 4:28pm UTC](https://discuss.elastic.co/t/version-6-3-flush-not-flushing/139386 "2018-07-10T16:28:17Z")
We are having trouble with flushing our translog now that we are on version 6.x. We are using default settings, other than our index has refresh\_interval set to 60s. Indices often have huge translogs (1GB) at the end of… --- ## [Monitoring Gaps in Marvel Data](https://discuss.elastic.co/t/monitoring-gaps-in-marvel-data/139394)
**Author:** [@tebriel](https://discuss.elastic.co/u/tebriel)\ **Replies:** 0\ **Last updated:** [July 10, 2018, 3:52pm UTC](https://discuss.elastic.co/t/monitoring-gaps-in-marvel-data/139394 "2018-07-10T15:52:04Z")
So...first, yes, I know that I'm using 2.4.6 and that's old and out of date. I'm on an upgrade path to 6.3.1, we're waiting on rolling out logstash updates everywhere. That said, when I had all my traffic being mirrored … --- ## [Elasticsearch recovering deleted nodes unprompted](https://discuss.elastic.co/t/elasticsearch-recovering-deleted-nodes-unprompted/139391)
**Author:** [@snewman](https://discuss.elastic.co/u/snewman)\ **Replies:** 0\ **Last updated:** [July 10, 2018, 3:38pm UTC](https://discuss.elastic.co/t/elasticsearch-recovering-deleted-nodes-unprompted/139391 "2018-07-10T15:38:53Z")
I'm running a single node cluster of elasticsearch 6.3. I have some old, bad data that I am trying to remove from the system. I delete the index containing the data and it shows as deleted. Then about 12 hours later, th… --- ## [Cannot start services after restart](https://discuss.elastic.co/t/cannot-start-services-after-restart/139388)
**Author:** [@L33T](https://discuss.elastic.co/u/L33T)\ **Replies:** 0\ **Last updated:** [July 10, 2018, 3:36pm UTC](https://discuss.elastic.co/t/cannot-start-services-after-restart/139388 "2018-07-10T15:36:21Z")
Hi, I have been running a 3 node elasticsearch cluster for a couple of months but since restarting the machines I now cannot start the service :frowning: Log is as follows: \[2018-07-10T16:29:48,065\]\[INFO \]\[o.e.n.Node … --- ## [\[JAVA API\] Sorting on field return error "active fielddata"](https://discuss.elastic.co/t/java-api-sorting-on-field-return-error-active-fielddata/139170)
**Author:** [@younesbenallal](https://discuss.elastic.co/u/younesbenallal)\ **Replies:** 2\ **Last updated:** [July 10, 2018, 3:00pm UTC](https://discuss.elastic.co/t/java-api-sorting-on-field-return-error-active-fielddata/139170 "2018-07-10T15:00:29Z")
Hey, I'm using the Java API to do some search on an Elastic base. I have differents functions of listing, filtering etc,.. (all working). But, when I want to sort by a field, I have this error : \`Elasticsearch exceptio… --- ## [Disappointing insert throughput (non-bulk)](https://discuss.elastic.co/t/disappointing-insert-throughput-non-bulk/139369)
**Author:** [@jaki\_tori](https://discuss.elastic.co/u/jaki_tori)\ **Replies:** 2\ **Last updated:** [July 10, 2018, 2:46pm UTC](https://discuss.elastic.co/t/disappointing-insert-throughput-non-bulk/139369 "2018-07-10T14:46:46Z")
To get acquainted with Elasticsearch and test it's write throughput I've set up a simple PHP script that inserts a JSON with 3 fields, like so: private function registerName($name) { $ip = $\_SERVER\['REMOTE\_ADDR'\]; $d… --- ## [ES Gradle plugin](https://discuss.elastic.co/t/es-gradle-plugin/139366)
**Author:** [@vvelichkovich](https://discuss.elastic.co/u/vvelichkovich)\ **Replies:** 2\ **Last updated:** [July 10, 2018, 2:41pm UTC](https://discuss.elastic.co/t/es-gradle-plugin/139366 "2018-07-10T14:41:14Z")
I am have trouble to find anything about "ES Gradle plugin". I am finding in different posts recommendation to use this plugin for integration tests that I need (when I want to start my ES node and run different tests … --- ## [Role Mapping API not working](https://discuss.elastic.co/t/role-mapping-api-not-working/139298)
**Author:** [@sukeshss](https://discuss.elastic.co/u/sukeshss)\ **Replies:** 3\ **Last updated:** [July 10, 2018, 2:03pm UTC](https://discuss.elastic.co/t/role-mapping-api-not-working/139298 "2018-07-10T14:03:33Z")
I have configured X-Pack with LDAP in my ES Cluster. I am able to create the roles and role mappings using APIs. But role mapping is not taking effect in ES Cluster. It is working only If I update the role\_mapping,yml … --- ## [Courier fetch: 5 of 10 of shard fail](https://discuss.elastic.co/t/courier-fetch-5-of-10-of-shard-fail/139106)
**Author:** [@asalma](https://discuss.elastic.co/u/asalma)\ **Replies:** 8\ **Last updated:** [July 10, 2018, 1:32pm UTC](https://discuss.elastic.co/t/courier-fetch-5-of-10-of-shard-fail/139106 "2018-07-10T13:32:14Z")
Hi, Can someone explain to me whay I have this error ? --- ## [Search after - unique sort fields](https://discuss.elastic.co/t/search-after-unique-sort-fields/139355)
**Author:** [@wmazur](https://discuss.elastic.co/u/wmazur)\ **Replies:** 0\ **Last updated:** [July 10, 2018, 1:31pm UTC](https://discuss.elastic.co/t/search-after-unique-sort-fields/139355 "2018-07-10T13:31:43Z")
I'm trying to use search after pagination in my project, using index with over 10M records. I wonder what's the easiest way to obtain unique search\_after parameter if i don't mind about sort order and I don't want to d… --- ## [Best option for setting Master and Data nodes in Elasticsearch cluster](https://discuss.elastic.co/t/best-option-for-setting-master-and-data-nodes-in-elasticsearch-cluster/139327)
**Author:** [@clash\_of\_clanss](https://discuss.elastic.co/u/clash_of_clanss)\ **Replies:** 1\ **Last updated:** [July 10, 2018, 1:16pm UTC](https://discuss.elastic.co/t/best-option-for-setting-master-and-data-nodes-in-elasticsearch-cluster/139327 "2018-07-10T13:16:00Z")
Hi, which is the best option for making elasticsearch cluster high performance, do I need to increase number of master nodes or need to increase data nodes? Thanks, --- ## [Slash could't save in query?](https://discuss.elastic.co/t/slash-couldt-save-in-query/139252)
**Author:** [@JackJun](https://discuss.elastic.co/u/JackJun)\ **Replies:** 2\ **Last updated:** [July 10, 2018, 12:58pm UTC](https://discuss.elastic.co/t/slash-couldt-save-in-query/139252 "2018-07-10T12:58:48Z")
i'm writing a rule to watch the log in watcher,i want query regular expression to match the query body,like: rq:POST /Web/Public/login HTTP/1.1 part of the rule code is "query\_string": { "fields": \[ … --- ## [How do I filter a regexp query by timestamp?](https://discuss.elastic.co/t/how-do-i-filter-a-regexp-query-by-timestamp/139238)
**Author:** [@Ryan\_McGauley](https://discuss.elastic.co/u/Ryan_McGauley)\ **Replies:** 1\ **Last updated:** [July 10, 2018, 11:43am UTC](https://discuss.elastic.co/t/how-do-i-filter-a-regexp-query-by-timestamp/139238 "2018-07-10T11:43:39Z")
I'm trying to make a query that will search based on a regular expression, then filter out the results based on a timestamp eventTimeStamp Here is the link to the query I was trying to execute and the error that result… --- ## [Non-numeric idetifiers](https://discuss.elastic.co/t/non-numeric-idetifiers/139329)
**Author:** [@LesioS](https://discuss.elastic.co/u/LesioS)\ **Replies:** 2\ **Last updated:** [July 10, 2018, 11:35am UTC](https://discuss.elastic.co/t/non-numeric-idetifiers/139329 "2018-07-10T11:35:22Z")
Correct me, if I'm wrong: As I understand there's no need to have 1, 2, 3,... identifiers in index. So it's possible that GUID is doc ID. ID hg8ns65gy is good also. The most important question, if all above is correct:… --- ## [Xpack anomaly detect theory](https://discuss.elastic.co/t/xpack-anomaly-detect-theory/138995)
**Author:** [@Eric\_Yin](https://discuss.elastic.co/u/Eric_Yin)\ **Replies:** 3\ **Last updated:** [July 10, 2018, 10:31am UTC](https://discuss.elastic.co/t/xpack-anomaly-detect-theory/138995 "2018-07-10T10:31:47Z")
Dear X-Pack developers, I have already checked the open source code of Xpack for personal interest, I am not sure which kinds of algorithm is used for machine learning and I also found move average aggregation algorithm… --- ## [Elastic 6.3 Field mapping of "IPORHOST"](https://discuss.elastic.co/t/elastic-6-3-field-mapping-of-iporhost/139304)
**Author:** [@MarcusCaepio](https://discuss.elastic.co/u/MarcusCaepio)\ **Replies:** 2\ **Last updated:** [July 10, 2018, 9:43am UTC](https://discuss.elastic.co/t/elastic-6-3-field-mapping-of-iporhost/139304 "2018-07-10T09:43:48Z")
Hi all, how do I have to do the field mapping in my index template to map the logstash output, which is grokked as "IPORHOST" ? Mapping as IP drops all results with a hostname ('xyz' is not an IP string literal.). So I … --- ## [Keywords for IP fields?](https://discuss.elastic.co/t/keywords-for-ip-fields/139144)
**Author:** [@MarcusCaepio](https://discuss.elastic.co/u/MarcusCaepio)\ **Replies:** 1\ **Last updated:** [July 10, 2018, 9:16am UTC](https://discuss.elastic.co/t/keywords-for-ip-fields/139144 "2018-07-10T09:16:15Z")
Hi all, by default logstash creates a field and a field.keyword. When I map e.g. IP fields as fieldtype ip, the ip.keyword field disappears. Is it usefull to map fields like them with a keyfield again? E.g.: \[...\] … --- ## [Remove old incidies and back it up](https://discuss.elastic.co/t/remove-old-incidies-and-back-it-up/139171)
**Author:** [@rog\_NB](https://discuss.elastic.co/u/rog_NB)\ **Replies:** 1\ **Last updated:** [July 10, 2018, 8:47am UTC](https://discuss.elastic.co/t/remove-old-incidies-and-back-it-up/139171 "2018-07-10T08:47:56Z")
Hello all I'm pretty new on Elasticsearch. I'm looking for a way to backup old indicies. I'm trying this with curator. It is like a hot/cold setup. I know, it looks like straight forward and easy evry-day-task - but I… --- ## ['timed out waiting for all nodes to process published state' and cluster unavailability](https://discuss.elastic.co/t/timed-out-waiting-for-all-nodes-to-process-published-state-and-cluster-unavailability/138590)
**Author:** [@mim](https://discuss.elastic.co/u/mim)\ **Replies:** 2\ **Last updated:** [July 10, 2018, 8:36am UTC](https://discuss.elastic.co/t/timed-out-waiting-for-all-nodes-to-process-published-state-and-cluster-unavailability/138590 "2018-07-10T08:36:03Z")
Hi all, I am setting up Elasticsearch 3-nodes cluster with docker. This is my docker compose file: version: '2.0' services: elasticsearch: image: docker.elastic.co/elasticsearch/elasticsearch-oss:6.3.0 enviro… --- ## [Elasticsearch 6.3 ingest-user-agent](https://discuss.elastic.co/t/elasticsearch-6-3-ingest-user-agent/139288)
**Author:** [@drjackal](https://discuss.elastic.co/u/drjackal)\ **Replies:** 2\ **Last updated:** [July 10, 2018, 8:17am UTC](https://discuss.elastic.co/t/elasticsearch-6-3-ingest-user-agent/139288 "2018-07-10T08:17:51Z")
Hi There, I am new to the ELK Stack and I have been experimenting with it for the last few days. What I would like to do now is ingest my IIS Logs. Unfortunately, it looks like the ingest-user-agent module and the inge… --- ## [Multi Field query with query\_string over property and nested object](https://discuss.elastic.co/t/multi-field-query-with-query-string-over-property-and-nested-object/139194)
**Author:** [@MarcusK](https://discuss.elastic.co/u/MarcusK)\ **Replies:** 0\ **Last updated:** [July 9, 2018, 2:23pm UTC](https://discuss.elastic.co/t/multi-field-query-with-query-string-over-property-and-nested-object/139194 "2018-07-09T14:23:24Z")
I'm trying to solve the following high level requirement: save arbitrary number of key value pairs on a document with properties: name and description values can be numbers which should be 'range searchable' values can… --- ## [How much disk space should be in available to get a better elasticsearch cluster performance?](https://discuss.elastic.co/t/how-much-disk-space-should-be-in-available-to-get-a-better-elasticsearch-cluster-performance/139226)
**Author:** [@clash\_of\_clanss](https://discuss.elastic.co/u/clash_of_clanss)\ **Replies:** 3\ **Last updated:** [July 10, 2018, 7:43am UTC](https://discuss.elastic.co/t/how-much-disk-space-should-be-in-available-to-get-a-better-elasticsearch-cluster-performance/139226 "2018-07-10T07:43:49Z")
Hi, I have one master node (150Gb) and two data nodes (2\* 110 GB) in my elasticsearch cluster. And I would like to know how much free disk space I have to maintain to perform a better elasticsearch performance like incr… --- ## [Dangling Index after running Curator](https://discuss.elastic.co/t/dangling-index-after-running-curator/139268)
**Author:** [@james5](https://discuss.elastic.co/u/james5)\ **Replies:** 7\ **Last updated:** [July 10, 2018, 7:31am UTC](https://discuss.elastic.co/t/dangling-index-after-running-curator/139268 "2018-07-10T07:31:14Z")
I have a situation where deleted indexes are not deleted from all nodes. As such, when ES is restarted, this Dangling Shard is imported as a Dangling Index and is thus UNASSIGNED and causes the cluster to enter "red" sta… --- ## [User-based synonyms in ElasticSearch](https://discuss.elastic.co/t/user-based-synonyms-in-elasticsearch/139275)
**Author:** [@YvesPeirsman](https://discuss.elastic.co/u/YvesPeirsman)\ **Replies:** 0\ **Last updated:** [July 10, 2018, 6:49am UTC](https://discuss.elastic.co/t/user-based-synonyms-in-elasticsearch/139275 "2018-07-10T06:49:12Z")
I have a data set of many small user-based text collections that I would like to search. There are 1000s of users with between 10 to 1000 texts each (100 or so on average). My initial idea was to create an index per user… --- ## [Access to documents in ScriptEngine plugin](https://discuss.elastic.co/t/access-to-documents-in-scriptengine-plugin/138278)
**Author:** [@Cameron\_VandenBerg](https://discuss.elastic.co/u/Cameron_VandenBerg)\ **Replies:** 5\ **Last updated:** [July 10, 2018, 6:46am UTC](https://discuss.elastic.co/t/access-to-documents-in-scriptengine-plugin/138278 "2018-07-10T06:46:35Z")
Is it possible to access document fields or termvectors within a plugin that implements ScriptEngine? I have a field for each document which contains the length of the document, and I would like to use that value as wel… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1621) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1623)