# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1627 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1628 --- ## [Creating multiple query\_string](https://discuss.elastic.co/t/creating-multiple-query-string/138851)
**Author:** [@shubham\_kumar1](https://discuss.elastic.co/u/shubham_kumar1)\ **Replies:** 1\ **Last updated:** [July 6, 2018, 10:03am UTC](https://discuss.elastic.co/t/creating-multiple-query-string/138851 "2018-07-06T10:03:21Z")
Hi, I want query data form elasticsearch based on some value of the string, i wrote following query for that. GET \_search { "query": { "bool": { "filter":{ "bool":{ "should": \[ { … --- ## [ES 6.3.0 RestClient ConnectionException while executing BulkProcessor](https://discuss.elastic.co/t/es-6-3-0-restclient-connectionexception-while-executing-bulkprocessor/137840)
**Author:** [@gmarshall56](https://discuss.elastic.co/u/gmarshall56)\ **Replies:** 1\ **Last updated:** [July 6, 2018, 9:42am UTC](https://discuss.elastic.co/t/es-6-3-0-restclient-connectionexception-while-executing-bulkprocessor/137840 "2018-07-06T09:42:19Z")
Hello: I am running a process that builds an index by reading a relational database table containing over 26,000 rows. The indexing process appears to have run successfully however after looking through the log file - … --- ## [Multi Word Synonyms](https://discuss.elastic.co/t/multi-word-synonyms/138531)
**Author:** [@atom](https://discuss.elastic.co/u/atom)\ **Replies:** 1\ **Last updated:** [July 6, 2018, 9:19am UTC](https://discuss.elastic.co/t/multi-word-synonyms/138531 "2018-07-06T09:19:07Z")
Hi :slight\_smile: my synonyms file has currently only explicit and equivalent synonyms with only one word. Can elasticsearch handle multi word synonyms? E.g.: this is a sentence, another one, something else =\> fancy s… --- ## [Match Prefix not giving any result](https://discuss.elastic.co/t/match-prefix-not-giving-any-result/138866)
**Author:** [@aneesh](https://discuss.elastic.co/u/aneesh)\ **Replies:** 1\ **Last updated:** [July 6, 2018, 9:08am UTC](https://discuss.elastic.co/t/match-prefix-not-giving-any-result/138866 "2018-07-06T09:08:05Z")
Hi i want to do substring search (Like operation) get state/\_search { "from":0, "size": 1000 "query": { "bool": { "must": \[ { "match\_phrase\_prefix": { "StateName" : "… --- ## [Index created with out adding any data](https://discuss.elastic.co/t/index-created-with-out-adding-any-data/137954)
**Author:** [@aneesh](https://discuss.elastic.co/u/aneesh)\ **Replies:** 4\ **Last updated:** [July 6, 2018, 9:03am UTC](https://discuss.elastic.co/t/index-created-with-out-adding-any-data/137954 "2018-07-06T09:03:06Z")
Hi Sometimes when adding new data to elastic. index is created but data not added. Success is coming as true. Where I can check these kind of error. I am using ElasticSearch.Net 5.5.0 and NEST 5.5.0 (.Net) Thanks A… --- ## [Fulltext search in different datatypes (different indexes)](https://discuss.elastic.co/t/fulltext-search-in-different-datatypes-different-indexes/138860)
**Author:** [@Ulrik\_Pedersen](https://discuss.elastic.co/u/Ulrik_Pedersen)\ **Replies:** 0\ **Last updated:** [July 6, 2018, 8:49am UTC](https://discuss.elastic.co/t/fulltext-search-in-different-datatypes-different-indexes/138860 "2018-07-06T08:49:21Z")
Our usecase is a webapp with a Google like search page where people can search in a single query field. The data source is different database tables but with some fields recurring in the different tables. eg. { "ind… --- ## [Moving average on derivative](https://discuss.elastic.co/t/moving-average-on-derivative/138764)
**Author:** [@uyth](https://discuss.elastic.co/u/uyth)\ **Replies:** 1\ **Last updated:** [July 6, 2018, 8:45am UTC](https://discuss.elastic.co/t/moving-average-on-derivative/138764 "2018-07-06T08:45:40Z")
Elasticsearch version: 6.2 I'm trying to get the moving average of a derivative of the remaining bytes. However, I want to exclude positive results from the derivative. I have tried to add a bucket\_selector, but it give… --- ## [Update elasticsearch](https://discuss.elastic.co/t/update-elasticsearch/138849)
**Author:** [@asalma](https://discuss.elastic.co/u/asalma)\ **Replies:** 1\ **Last updated:** [July 6, 2018, 8:24am UTC](https://discuss.elastic.co/t/update-elasticsearch/138849 "2018-07-06T08:24:52Z")
Hi, Please I just install the update of all package but I have a problem with elasticsearch : --- ## [Multiple Condition using ctx.execution\_time](https://discuss.elastic.co/t/multiple-condition-using-ctx-execution-time/138762)
**Author:** [@arkandel](https://discuss.elastic.co/u/arkandel)\ **Replies:** 1\ **Last updated:** [July 6, 2018, 7:57am UTC](https://discuss.elastic.co/t/multiple-condition-using-ctx-execution-time/138762 "2018-07-06T07:57:37Z")
Hey there, I am currently polling an endpoint over https for the cluster's health status, and I would like an alert sent if the returned status is a certain value and if it's not between certain times in the day (when o… --- ## [Nested query in elasticsearch](https://discuss.elastic.co/t/nested-query-in-elasticsearch/138843)
**Author:** [@Lucky1408](https://discuss.elastic.co/u/Lucky1408)\ **Replies:** 0\ **Last updated:** [July 6, 2018, 7:49am UTC](https://discuss.elastic.co/t/nested-query-in-elasticsearch/138843 "2018-07-06T07:49:53Z")
Hi, for our service we need an nested query. The problem is that iam not so familiar with elasticsearch language and i can only explain my needs in SQL language. SELECT \* FROM index WHERE attribute IN (SELECT attribute… --- ## [System Requirements for Elasticsearch server](https://discuss.elastic.co/t/system-requirements-for-elasticsearch-server/138831)
**Author:** [@stackoverflow\_s](https://discuss.elastic.co/u/stackoverflow_s)\ **Replies:** 1\ **Last updated:** [July 6, 2018, 6:34am UTC](https://discuss.elastic.co/t/system-requirements-for-elasticsearch-server/138831 "2018-07-06T06:34:08Z")
Eg. I have data close to 500GB to be indexed using fsCrawler through default configurations. How can i calculate the system requirements for the following, How much disk storage is required on the device ? What will be… --- ## [Is ML capable to detect RAM saturation?](https://discuss.elastic.co/t/is-ml-capable-to-detect-ram-saturation/138185)
**Author:** [@genPz01](https://discuss.elastic.co/u/genPz01)\ **Replies:** 9\ **Last updated:** [July 6, 2018, 6:03am UTC](https://discuss.elastic.co/t/is-ml-capable-to-detect-ram-saturation/138185 "2018-07-06T06:03:40Z")
Hi, I test with ML a situation where RAM usage keeps increasing linearly and eats almost all RAM capacity. The Machine Learning constructs the appropriate model but doesn't consider the fact that RAM usage is so close … --- ## [Connecting to a Elasticsearch running on a remote host](https://discuss.elastic.co/t/connecting-to-a-elasticsearch-running-on-a-remote-host/138453)
**Author:** [@Pritom\_Ahmed](https://discuss.elastic.co/u/Pritom_Ahmed)\ **Replies:** 9\ **Last updated:** [July 6, 2018, 5:59am UTC](https://discuss.elastic.co/t/connecting-to-a-elasticsearch-running-on-a-remote-host/138453 "2018-07-06T05:59:33Z")
Hi, I want to connect to an Elasticsearch running on a remote host. My code is as follows String host = "10.169.149.134"; byte\[\]ip = new byte\[\]{(byte)10, (byte) 169, (byte) 149, (byte) 134}; in… --- ## [Rolling back to ELK 6.2.4](https://discuss.elastic.co/t/rolling-back-to-elk-6-2-4/138769)
**Author:** [@dalamar666](https://discuss.elastic.co/u/dalamar666)\ **Replies:** 4\ **Last updated:** [July 6, 2018, 5:38am UTC](https://discuss.elastic.co/t/rolling-back-to-elk-6-2-4/138769 "2018-07-06T05:38:20Z")
Hi, With not being able to get Logstash working in the monitoring portion I was wondering if it is possible to roll back to 6.2.4 and then install x-pack without losing databases and see if that works? --- ## [Elasticsearch bulk index missing some records](https://discuss.elastic.co/t/elasticsearch-bulk-index-missing-some-records/138634)
**Author:** [@Dilip\_Kumar](https://discuss.elastic.co/u/Dilip_Kumar)\ **Replies:** 17\ **Last updated:** [July 5, 2018, 11:56am UTC](https://discuss.elastic.co/t/elasticsearch-bulk-index-missing-some-records/138634 "2018-07-05T11:56:12Z")
Hi, i am using es 5.6 with python client and doing bulk index with some frequent log files. what i need to care when going to bulk index and should not miss records. pls help --- ## [Upgraded data nodes and now seeing volatile JVM memory pressure](https://discuss.elastic.co/t/upgraded-data-nodes-and-now-seeing-volatile-jvm-memory-pressure/138791)
**Author:** [@nodesocket](https://discuss.elastic.co/u/nodesocket)\ **Replies:** 1\ **Last updated:** [July 6, 2018, 12:57am UTC](https://discuss.elastic.co/t/upgraded-data-nodes-and-now-seeing-volatile-jvm-memory-pressure/138791 "2018-07-06T00:57:25Z")
Hello. We have a two data node and three dedicated master node cluster on AWS Elasticsearch service. Currently have about 3 billion documents (1.1TB of data) and data nodes were previously running 2 cpus and 15GB of mem… --- ## [Exists query on \_uid field gives incorrect result on Elasticsearch 6.0.0](https://discuss.elastic.co/t/exists-query-on-uid-field-gives-incorrect-result-on-elasticsearch-6-0-0/138797)
**Author:** [@tonyyanga](https://discuss.elastic.co/u/tonyyanga)\ **Replies:** 2\ **Last updated:** [July 5, 2018, 11:44pm UTC](https://discuss.elastic.co/t/exists-query-on-uid-field-gives-incorrect-result-on-elasticsearch-6-0-0/138797 "2018-07-05T23:44:42Z")
I think I am getting incorrect results when I run an Exists query on \_uid field on Elasticsearch 6.0.0. I believe the result is incorrect because I got different (and correct by common sense) results on Elasticsearch 6.2… --- ## [Need help to create a suspicious domains indicator (please)!](https://discuss.elastic.co/t/need-help-to-create-a-suspicious-domains-indicator-please/138735)
**Author:** [@lutundula\_jeanchris](https://discuss.elastic.co/u/lutundula_jeanchris)\ **Replies:** 1\ **Last updated:** [July 5, 2018, 10:07pm UTC](https://discuss.elastic.co/t/need-help-to-create-a-suspicious-domains-indicator-please/138735 "2018-07-05T22:07:42Z")
Hello Everyone , I have been looking for a way to realize the following task : To compare two indentical fields from the same index , but different have different dates ( data1\[\]= from now to now-24h) and (data2\[\]= fro… --- ## [Low-level Lucene queries in Scripts Plugins](https://discuss.elastic.co/t/low-level-lucene-queries-in-scripts-plugins/137834)
**Author:** [@franck.lefebure](https://discuss.elastic.co/u/franck.lefebure)\ **Replies:** 3\ **Last updated:** [July 5, 2018, 8:33pm UTC](https://discuss.elastic.co/t/low-level-lucene-queries-in-scripts-plugins/137834 "2018-07-05T20:33:27Z")
Hi, During the last Paris Elastic On , I've met Adrien & Jim to talk about our usecase. In our platform we use ES to store hierarchical data and nor ES nor Lucene are very good with this kind of documents. So I wanted… --- ## [Dedup in Kibana search](https://discuss.elastic.co/t/dedup-in-kibana-search/138041)
**Author:** [@Rohit\_Jawle](https://discuss.elastic.co/u/Rohit_Jawle)\ **Replies:** 3\ **Last updated:** [July 5, 2018, 8:00pm UTC](https://discuss.elastic.co/t/dedup-in-kibana-search/138041 "2018-07-05T20:00:14Z")
In splunk, there is a command called dedup, followed by a field name. How do you do this in elk? --- ## [Basic license after upgrading to 6.3](https://discuss.elastic.co/t/basic-license-after-upgrading-to-6-3/138750)
**Author:** [@lpic10](https://discuss.elastic.co/u/lpic10)\ **Replies:** 2\ **Last updated:** [July 5, 2018, 6:01pm UTC](https://discuss.elastic.co/t/basic-license-after-upgrading-to-6-3/138750 "2018-07-05T18:01:32Z")
Hello, I had a 6.x cluster running with basic license, and it had expired few weeks ago. I took the opportunity to upgrade the cluster to 6.3 but I was still seeing warnings about the expired license, and before upgrad… --- ## [No active\_primary\_shards](https://discuss.elastic.co/t/no-active-primary-shards/138598)
**Author:** [@eric\_Igbinosun](https://discuss.elastic.co/u/eric_Igbinosun)\ **Replies:** 2\ **Last updated:** [July 5, 2018, 5:03pm UTC](https://discuss.elastic.co/t/no-active-primary-shards/138598 "2018-07-05T17:03:31Z")
hello guys i have set up an elasticsearch cluster with 1 master and 2 data nodes. the master run elasticsearch, logstash and filebeat, now when i run the cmd " curl localhost:9200/\_cluster/health?pretty=true" i do no… --- ## [ElasticSearch with SSL and F5 url](https://discuss.elastic.co/t/elasticsearch-with-ssl-and-f5-url/138771)
**Author:** [@ashok.gadiraju](https://discuss.elastic.co/u/ashok.gadiraju)\ **Replies:** 0\ **Last updated:** [July 5, 2018, 4:27pm UTC](https://discuss.elastic.co/t/elasticsearch-with-ssl-and-f5-url/138771 "2018-07-05T16:27:59Z")
HI, I am facing issue with connecting to ElasticSearch cluster that is secured with SSL and using a F5 on top of that. My code without F5 and connecting directly to a node is as follows private SSLContext getSocketFac… --- ## [Apply license to 6.3 causes security exception](https://discuss.elastic.co/t/apply-license-to-6-3-causes-security-exception/138436)
**Author:** [@KeninHouston](https://discuss.elastic.co/u/KeninHouston)\ **Replies:** 3\ **Last updated:** [July 5, 2018, 3:58pm UTC](https://discuss.elastic.co/t/apply-license-to-6-3-causes-security-exception/138436 "2018-07-05T15:58:00Z")
Hi, I've deployed a new ElasicSearch 6.3 cluster with Kibana. All works fine until I apply the production license to turn on the SSL features, then the cluster refuses to talk to itself and anyone. The method work fine … --- ## [Can multiple add/delete of document to an index make it inconsistent?](https://discuss.elastic.co/t/can-multiple-add-delete-of-document-to-an-index-make-it-inconsistent/137030)
**Author:** [@nuketro0p3r](https://discuss.elastic.co/u/nuketro0p3r)\ **Replies:** 4\ **Last updated:** [July 5, 2018, 3:53pm UTC](https://discuss.elastic.co/t/can-multiple-add-delete-of-document-to-an-index-make-it-inconsistent/137030 "2018-07-05T15:53:38Z")
For a use-case, I'll need to add and remove multiple documents to an elastic search index. My understanding is that the tf-idf or BM25 scores are affected by the frequencies that are calculated using the postings list (?… --- ## [NeedQuickHelp: java.lang.NoSuchFieldError: LUCENE\_7\_3\_1](https://discuss.elastic.co/t/needquickhelp-java-lang-nosuchfielderror-lucene-7-3-1/138766)
**Author:** [@pokaleshrey](https://discuss.elastic.co/u/pokaleshrey)\ **Replies:** 1\ **Last updated:** [July 5, 2018, 3:51pm UTC](https://discuss.elastic.co/t/needquickhelp-java-lang-nosuchfielderror-lucene-7-3-1/138766 "2018-07-05T15:51:31Z")
I am upgrading from 6.1.3 to 6.3.0 I am trying to initialize: SearchSourceBuilder ssb = new SearchSourceBuilder(); Getting this error on above line: java.lang.NoSuchFieldError: LUCENE\_7\_3\_1 at org.elasticsearch.Vers… --- ## [Need to integrate threat Intel with ELK, which solution shall i look for, any opensource suggestion?](https://discuss.elastic.co/t/need-to-integrate-threat-intel-with-elk-which-solution-shall-i-look-for-any-opensource-suggestion/138765)
**Author:** [@addanuj](https://discuss.elastic.co/u/addanuj)\ **Replies:** 0\ **Last updated:** [July 5, 2018, 3:31pm UTC](https://discuss.elastic.co/t/need-to-integrate-threat-intel-with-elk-which-solution-shall-i-look-for-any-opensource-suggestion/138765 "2018-07-05T15:31:47Z")
Hi All, I am working on a project where we are trying to USE ELK as SIEM but i need some threat Intel sources which i can use as IOC and feeds to correlate SOC devices logs to detect Malicious Activities. i believe this… --- ## [Restore a snapshot: RemoteTransportException](https://discuss.elastic.co/t/restore-a-snapshot-remotetransportexception/138732)
**Author:** [@mohammedEssabri](https://discuss.elastic.co/u/mohammedEssabri)\ **Replies:** 2\ **Last updated:** [July 5, 2018, 3:25pm UTC](https://discuss.elastic.co/t/restore-a-snapshot-remotetransportexception/138732 "2018-07-05T15:25:17Z")
Dear Elasticsearch team, I'm using Elasticsearch 1.7, and I've created a snapshot named snapshot20180625 in an environment and i copied it into another environment, then i tried to register the repository using: curl -… --- ## [Backup repository missing exception](https://discuss.elastic.co/t/backup-repository-missing-exception/136538)
**Author:** [@mohammedEssabri](https://discuss.elastic.co/u/mohammedEssabri)\ **Replies:** 7\ **Last updated:** [July 5, 2018, 3:23pm UTC](https://discuss.elastic.co/t/backup-repository-missing-exception/136538 "2018-07-05T15:23:08Z")
Hi Elasticsearch Team, After redeploying Elasticsearch 1.7 in our server, data has been removed. and when we use \_snapshot api to restore created backup using: curl -X GET "localhost:9200/\_snapshot/test\_backup" it sh… --- ## [org.locationtech.Spatial4j dependency missing in ES 6.3.0?](https://discuss.elastic.co/t/org-locationtech-spatial4j-dependency-missing-in-es-6-3-0/138718)
**Author:** [@pokaleshrey](https://discuss.elastic.co/u/pokaleshrey)\ **Replies:** 2\ **Last updated:** [July 5, 2018, 3:07pm UTC](https://discuss.elastic.co/t/org-locationtech-spatial4j-dependency-missing-in-es-6-3-0/138718 "2018-07-05T15:07:29Z")
I have upgraded from 6.1.3 to 6.3.0. Code by using 6.1.3: final CircleBuilder circleBuilder = ShapeBuilders.newCircleBuilder(); circleBuilder.radius(String.valueOf(radius)); circleBuilder.center(longitude, latitude); C… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1626) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1628)