# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1642 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1643 --- ## [Query Routing Issue](https://discuss.elastic.co/t/query-routing-issue/137089)
**Author:** [@jgraves](https://discuss.elastic.co/u/jgraves)\ **Replies:** 3\ **Last updated:** [June 23, 2018, 4:34pm UTC](https://discuss.elastic.co/t/query-routing-issue/137089 "2018-06-23T16:34:33Z")
Hello, We have an ES cluster with 19 total nodes (3 master only, 16 data only) in two racks, A and B. We have allocation set to force on rack via cluster.allocation.awareness.force.rack, which is working properly (no re… --- ## [Elasticsearch efficiently cleaning up the indices to save space](https://discuss.elastic.co/t/elasticsearch-efficiently-cleaning-up-the-indices-to-save-space/137019)
**Author:** [@Saiprasad\_Krishnamur](https://discuss.elastic.co/u/Saiprasad_Krishnamur)\ **Replies:** 8\ **Last updated:** [June 23, 2018, 1:06pm UTC](https://discuss.elastic.co/t/elasticsearch-efficiently-cleaning-up-the-indices-to-save-space/137019 "2018-06-23T13:06:32Z")
0 down vote favorite v Elasticsearch 5.6.\*. I'm looking at a way to implement a mechanism by which one of my index (that grows big in no time about 1 million documents per day) to manage the storage constraints autom… --- ## [Date parsing error in ES - Invalid format](https://discuss.elastic.co/t/date-parsing-error-in-es-invalid-format/137067)
**Author:** [@ishantanu](https://discuss.elastic.co/u/ishantanu)\ **Replies:** 1\ **Last updated:** [June 23, 2018, 8:12am UTC](https://discuss.elastic.co/t/date-parsing-error-in-es-invalid-format/137067 "2018-06-23T08:12:29Z")
Hi, I am facing issue regarding parsing date field in ES. Here's what I am seeing in ES logs for the date: Caused by: java.lang.IllegalArgumentException: Invalid format: "04:08:02" is malformed at ":08:02" at o… --- ## [Include new cluster state attribute?](https://discuss.elastic.co/t/include-new-cluster-state-attribute/137091)
**Author:** [@abzter10690](https://discuss.elastic.co/u/abzter10690)\ **Replies:** 1\ **Last updated:** [June 23, 2018, 8:08am UTC](https://discuss.elastic.co/t/include-new-cluster-state-attribute/137091 "2018-06-23T08:08:07Z")
I want to customize ElasticSearch to include a cluster-wide state (for example a counter, readable via \_cluster/state) so that my ES plugin or other process can take actions based on that? How can the node publish that s… --- ## [Way tooooo many shards](https://discuss.elastic.co/t/way-tooooo-many-shards/135809)
**Author:** [@tsangdl](https://discuss.elastic.co/u/tsangdl)\ **Replies:** 3\ **Last updated:** [June 23, 2018, 7:15am UTC](https://discuss.elastic.co/t/way-tooooo-many-shards/135809 "2018-06-23T07:15:05Z")
Hi, I have been re-architecting my elastic cluster from a wee fledgling to this: 2 coordinating nodes 3 master nodes 12 data nodes In the process, I seem to have become the proud owner of 170 shards per index ! ... … --- ## [Lost with geo query](https://discuss.elastic.co/t/lost-with-geo-query/136929)
**Author:** [@Akli](https://discuss.elastic.co/u/Akli)\ **Replies:** 1\ **Last updated:** [June 23, 2018, 6:17am UTC](https://discuss.elastic.co/t/lost-with-geo-query/136929 "2018-06-23T06:17:45Z")
Hi elastic experts, I am experiencing some troubles making the following geo query to work: GET grille\_arome\_001/gridpt/\_search { "query": { "bool": { "filter": { "geo\_shape": { … --- ## [Archival strategy of indices](https://discuss.elastic.co/t/archival-strategy-of-indices/137085)
**Author:** [@gthang](https://discuss.elastic.co/u/gthang)\ **Replies:** 3\ **Last updated:** [June 22, 2018, 11:02pm UTC](https://discuss.elastic.co/t/archival-strategy-of-indices/137085 "2018-06-22T23:02:53Z")
Hello, We have about 40 different indices being produced everyday. We currently have an alias setup for to point to the current business day index, and every night when the day rolls over, we create a new index and rec… --- ## [Problem Statement](https://discuss.elastic.co/t/problem-statement/137073)
**Author:** [@Rakesh5216](https://discuss.elastic.co/u/Rakesh5216)\ **Replies:** 4\ **Last updated:** [June 22, 2018, 9:35pm UTC](https://discuss.elastic.co/t/problem-statement/137073 "2018-06-22T21:35:06Z")
I have 3 different files ( 3 diff csv files) - transaction data, card info data and user data. I need to merge all these data into single file (I mean to perform SQL type join based on a key). I am aware that we can’t p… --- ## [Synonym indexing VS Payload indexing (and queries)](https://discuss.elastic.co/t/synonym-indexing-vs-payload-indexing-and-queries/136753)
**Author:** [@ljak](https://discuss.elastic.co/u/ljak)\ **Replies:** 1\ **Last updated:** [June 22, 2018, 7:01pm UTC](https://discuss.elastic.co/t/synonym-indexing-vs-payload-indexing-and-queries/136753 "2018-06-22T19:01:55Z")
Hello everyone, I'm interested into adding meta-information "on" tokens/phrases (like tagging metrics info as "measures" or adding concept synonyms to written -- in the initial doc -- concepts). I just read about Synony… --- ## [Elasticsearch fast query but slow response time when retrieving \_source even if nested fields are in \_source\_exclude](https://discuss.elastic.co/t/elasticsearch-fast-query-but-slow-response-time-when-retrieving-source-even-if-nested-fields-are-in-source-exclude/136280)
**Author:** [@3v0k4](https://discuss.elastic.co/u/3v0k4)\ **Replies:** 1\ **Last updated:** [June 22, 2018, 6:55pm UTC](https://discuss.elastic.co/t/elasticsearch-fast-query-but-slow-response-time-when-retrieving-source-even-if-nested-fields-are-in-source-exclude/136280 "2018-06-22T18:55:07Z")
I have the following mapping { "yellows" : { "aliases" : { }, "mappings" : { "yellow" : { "properties" : { "ranges" : { "type" : "nested", "properties" : { … --- ## [Applying timezone for painless based time aggregation](https://discuss.elastic.co/t/applying-timezone-for-painless-based-time-aggregation/136785)
**Author:** [@Anil\_G](https://discuss.elastic.co/u/Anil_G)\ **Replies:** 1\ **Last updated:** [June 22, 2018, 6:29pm UTC](https://discuss.elastic.co/t/applying-timezone-for-painless-based-time-aggregation/136785 "2018-06-22T18:29:14Z")
I want to apply non standard time interval aggregation (hourOfDay, dayOfWeek etc.) on my date field. { "size":0, "aggregations":{ "groupby\_timeinterval":{ "terms":{ "script":{ … --- ## [Injecting RestController through the RestHandler](https://discuss.elastic.co/t/injecting-restcontroller-through-the-resthandler/136935)
**Author:** [@arul\_since1975](https://discuss.elastic.co/u/arul_since1975)\ **Replies:** 1\ **Last updated:** [June 22, 2018, 6:21pm UTC](https://discuss.elastic.co/t/injecting-restcontroller-through-the-resthandler/136935 "2018-06-22T18:21:24Z")
I have the following code in one of my plugins which works well with ES 5.1.2. However with ES 5.6.8 it compiles, but runs into problem as it is not possible to inject RestController directly. Please let me know the wor… --- ## [Elasticsearch screwing up the score with a date range filter](https://discuss.elastic.co/t/elasticsearch-screwing-up-the-score-with-a-date-range-filter/136090)
**Author:** [@saurabhwahile](https://discuss.elastic.co/u/saurabhwahile)\ **Replies:** 1\ **Last updated:** [June 22, 2018, 5:57pm UTC](https://discuss.elastic.co/t/elasticsearch-screwing-up-the-score-with-a-date-range-filter/136090 "2018-06-22T17:57:31Z")
Hello, I have a query which is matching with any documents that satisfy the filter, but none of the objects have, a match. The scores also, are weird, with sometimes the score returned as 0. \<\> {'highlight': {'fields'… --- ## [Using "now" in bucket\_selector script](https://discuss.elastic.co/t/using-now-in-bucket-selector-script/135919)
**Author:** [@R.Rabbit](https://discuss.elastic.co/u/R.Rabbit)\ **Replies:** 1\ **Last updated:** [June 22, 2018, 5:55pm UTC](https://discuss.elastic.co/t/using-now-in-bucket-selector-script/135919 "2018-06-22T17:55:09Z")
Hey there, I want to get the entities that showed up in the last 24h and suppressing all those that had appeared earlier. The query looks like: \> { { "aggs": { "entity" : { "terms" : { … --- ## [Multiple actions in the watcher yet?](https://discuss.elastic.co/t/multiple-actions-in-the-watcher-yet/136925)
**Author:** [@vgersh99](https://discuss.elastic.co/u/vgersh99)\ **Replies:** 2\ **Last updated:** [June 22, 2018, 5:43pm UTC](https://discuss.elastic.co/t/multiple-actions-in-the-watcher-yet/136925 "2018-06-22T17:43:04Z")
I know this topic has been discussed previously ... Continuing the discussion from Loop through watcher results to create multiple actions: Wondering if there was any additional watcher functionality introduced yet. Ru… --- ## [Reading documents from MongoDB instead of a json file](https://discuss.elastic.co/t/reading-documents-from-mongodb-instead-of-a-json-file/137054)
**Author:** [@akhil-rane](https://discuss.elastic.co/u/akhil-rane)\ **Replies:** 1\ **Last updated:** [June 22, 2018, 3:42pm UTC](https://discuss.elastic.co/t/reading-documents-from-mongodb-instead-of-a-json-file/137054 "2018-06-22T15:42:53Z")
Hi All, I am working on a project where all my documents are stored in MongoDB database. Is there any option in Rally to read documents from mongo instead of a json file? Thanks in advance --- ## [Is there a way to ignore invalid invalid parameters?](https://discuss.elastic.co/t/is-there-a-way-to-ignore-invalid-invalid-parameters/137049)
**Author:** [@a344254](https://discuss.elastic.co/u/a344254)\ **Replies:** 0\ **Last updated:** [June 22, 2018, 3:12pm UTC](https://discuss.elastic.co/t/is-there-a-way-to-ignore-invalid-invalid-parameters/137049 "2018-06-22T15:12:24Z")
I'm writing an EXTJS app and having to make a JSONP call to do a search query, but it's automatically adding a "callback" parameter to the URL and I haven't found a way to eliminate it. This is causing an "illegal\_argum… --- ## [Help regarding hardware requirements](https://discuss.elastic.co/t/help-regarding-hardware-requirements/137041)
**Author:** [@nishantcoder97](https://discuss.elastic.co/u/nishantcoder97)\ **Replies:** 2\ **Last updated:** [June 22, 2018, 3:04pm UTC](https://discuss.elastic.co/t/help-regarding-hardware-requirements/137041 "2018-06-22T15:04:00Z")
I have a few queries regarding hardware requirements for elasticsearch in production. First i would like to give some information about my data :- The data will contain around 5000 to 7000 documents. Size of total d… --- ## [Elasticsearch service stops, site not available; fresh install on Ubuntu 18.04](https://discuss.elastic.co/t/elasticsearch-service-stops-site-not-available-fresh-install-on-ubuntu-18-04/136944)
**Author:** [@crichmond](https://discuss.elastic.co/u/crichmond)\ **Replies:** 9\ **Last updated:** [June 22, 2018, 3:10pm UTC](https://discuss.elastic.co/t/elasticsearch-service-stops-site-not-available-fresh-install-on-ubuntu-18-04/136944 "2018-06-22T15:10:31Z")
Hello all; New to Elasticstack, and already running into troubles :frowning: I have a fresh Ubuntu 18.04 VM just created a few days ago. Basic install, have only added SSH and Webmin functionality. Yesterday, started … --- ## [Expected behaviour of an unconditional watch](https://discuss.elastic.co/t/expected-behaviour-of-an-unconditional-watch/136055)
**Author:** [@crickes](https://discuss.elastic.co/u/crickes)\ **Replies:** 2\ **Last updated:** [June 22, 2018, 3:06pm UTC](https://discuss.elastic.co/t/expected-behaviour-of-an-unconditional-watch/136055 "2018-06-22T15:06:45Z")
Hi, Similar to the example in the docs, I have created a watch to email a status report once every 24 hours, at 8am. When the watch fires at the specified time, its stays in the 'firing' state and never returns to the '… --- ## [Corrupted elastic index](https://discuss.elastic.co/t/corrupted-elastic-index/135932)
**Author:** [@matw](https://discuss.elastic.co/u/matw)\ **Replies:** 4\ **Last updated:** [June 22, 2018, 2:53pm UTC](https://discuss.elastic.co/t/corrupted-elastic-index/135932 "2018-06-22T14:53:42Z")
my instance of elasticsearch (5.6.1) stopped indexing because of the following error \[2018-06-13T16:39:07,413\]\[ERROR\]\[o.e.i.e.InternalEngine$EngineMergeScheduler\] \[tracer-node-1\] \[tracer-default-logs-network-2018.06.13\]… --- ## [Monitoring Beats: Instance list too short](https://discuss.elastic.co/t/monitoring-beats-instance-list-too-short/136833)
**Author:** [@kaem2111](https://discuss.elastic.co/u/kaem2111)\ **Replies:** 1\ **Last updated:** [June 22, 2018, 2:48pm UTC](https://discuss.elastic.co/t/monitoring-beats-instance-list-too-short/136833 "2018-06-22T14:48:55Z")
As you see here: \[grafik\] Total beats are 64 (instead of metric 64 + file 63 + winlog 1 = 128), so only the newest half of all beats are shown in the list (see 1-20 of 64, I would expect 1-20 of 128). Moreover the lis… --- ## [Sending email while Alert](https://discuss.elastic.co/t/sending-email-while-alert/135950)
**Author:** [@elleuch](https://discuss.elastic.co/u/elleuch)\ **Replies:** 7\ **Last updated:** [June 22, 2018, 2:18pm UTC](https://discuss.elastic.co/t/sending-email-while-alert/135950 "2018-06-22T14:18:09Z")
I want to send emails with watcher menu in Kibana. I tried a configuration in elasticsarch.yml and I don't know why it never arrived to send emails. What should I write in the elasticsearch.yml? and shoud I add another t… --- ## [Watcher range query Problem](https://discuss.elastic.co/t/watcher-range-query-problem/135630)
**Author:** [@oleg.parschalk](https://discuss.elastic.co/u/oleg.parschalk)\ **Replies:** 1\ **Last updated:** [June 22, 2018, 2:13pm UTC](https://discuss.elastic.co/t/watcher-range-query-problem/135630 "2018-06-22T14:13:43Z")
Hi Guys, i have a problem with my watcher. I try to search for 500 nginx access response code error in the last 24h. But no results are found. And this is quite impossible. The Dashboard tells me i have 2000+ hits in th… --- ## [RestFilters for ES 5.x](https://discuss.elastic.co/t/restfilters-for-es-5-x/134123)
**Author:** [@Vinh\_Nguyen](https://discuss.elastic.co/u/Vinh_Nguyen)\ **Replies:** 12\ **Last updated:** [June 22, 2018, 2:11pm UTC](https://discuss.elastic.co/t/restfilters-for-es-5-x/134123 "2018-06-22T14:11:38Z")
Goal: log all REST requests made to ElasticSearch 5.6.4 cluster. \*Note: in ES 2.x, this can done via RestFilter and RestFilterChain but I am struggle to find the equivalent for ES 5.x . Implementation 1: I wrote a … --- ## [How to print more than 10 (default) output in chain query](https://discuss.elastic.co/t/how-to-print-more-than-10-default-output-in-chain-query/136338)
**Author:** [@addanuj](https://discuss.elastic.co/u/addanuj)\ **Replies:** 1\ **Last updated:** [June 22, 2018, 2:06pm UTC](https://discuss.elastic.co/t/how-to-print-more-than-10-default-output-in-chain-query/136338 "2018-06-22T14:06:32Z")
I am not able to print more than 10 (which i think is default) output using below query { "trigger": { "schedule": { "interval": "10s" } }, "input": { "chain": { … --- ## [Not able to compare two loops in a chain query](https://discuss.elastic.co/t/not-able-to-compare-two-loops-in-a-chain-query/135488)
**Author:** [@addanuj](https://discuss.elastic.co/u/addanuj)\ **Replies:** 12\ **Last updated:** [June 22, 2018, 2:04pm UTC](https://discuss.elastic.co/t/not-able-to-compare-two-loops-in-a-chain-query/135488 "2018-06-22T14:04:47Z")
Hi i am trying to achieve below I have two different index and i want to compare two fields values using loop and get result if any of the IP address value matches for example :- Index 1: threatintel fields :- 1. in… --- ## [Is it possible to use a custom suggester?](https://discuss.elastic.co/t/is-it-possible-to-use-a-custom-suggester/135925)
**Author:** [@andyhind](https://discuss.elastic.co/u/andyhind)\ **Replies:** 1\ **Last updated:** [June 22, 2018, 1:31pm UTC](https://discuss.elastic.co/t/is-it-possible-to-use-a-custom-suggester/135925 "2018-06-22T13:31:09Z")
Hi I have a custom lucene suggester; an implementation of org.apache.lucene.search.suggest.Lookup. Is it possible to wire this up in Elastic Search? In SOLR, I can create a lookup factory and add this to the configurat… --- ## [Where eleasticsearch is store the data](https://discuss.elastic.co/t/where-eleasticsearch-is-store-the-data/136975)
**Author:** [@antonopo](https://discuss.elastic.co/u/antonopo)\ **Replies:** 6\ **Last updated:** [June 22, 2018, 12:12pm UTC](https://discuss.elastic.co/t/where-eleasticsearch-is-store-the-data/136975 "2018-06-22T12:12:39Z")
Hi :slight\_smile: Where eleasticsearch is store the data?? --- ## [Warm Nodes Rebalance not occurring](https://discuss.elastic.co/t/warm-nodes-rebalance-not-occurring/136470)
**Author:** [@FatalGlitch](https://discuss.elastic.co/u/FatalGlitch)\ **Replies:** 1\ **Last updated:** [June 22, 2018, 11:05am UTC](https://discuss.elastic.co/t/warm-nodes-rebalance-not-occurring/136470 "2018-06-22T11:05:04Z")
We run a Master, Hot, Warm cluster setup, and we've noticed that when adding new warm nodes to increase overall warm storage, there's no rebalance that occurs. We have allocation enabled for all, no exclusions for alloc… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1641) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1643)