# Elasticsearch

**URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1654

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 1655

---

## [How to do a suggest query in Low Level Client?](https://discuss.elastic.co/t/how-to-do-a-suggest-query-in-low-level-client/135617)

<div class="topic-metadata">

**Author:** [@kartheek91](https://discuss.elastic.co/u/kartheek91)\
**Replies:** 1\
**Last updated:** [June 14, 2018, 12:20am UTC](https://discuss.elastic.co/t/how-to-do-a-suggest-query-in-low-level-client/135617 "2018-06-14T00:20:52Z")

</div>

I have a suggest query I need to implement in c# Nest low level client.Can anyone help?

---

## [Want System memory usage to be come in Percentile form](https://discuss.elastic.co/t/want-system-memory-usage-to-be-come-in-percentile-form/133914)

<div class="topic-metadata">

**Author:** [@Pushpak\_Bhawsar](https://discuss.elastic.co/u/Pushpak_Bhawsar)\
**Replies:** 3\
**Last updated:** [June 4, 2018, 7:41pm UTC](https://discuss.elastic.co/t/want-system-memory-usage-to-be-come-in-percentile-form/133914 "2018-06-04T19:41:40Z")

</div>

Hello, I have set an advance watcher to get System memory usage of an Instance via mail, but I am getting the response as Watch \[{0={value=0.7806375838926162, key=wp-bookopidia-prod-vm}}\] has exceeded the threshold via …

---

## [How to create a dynamic template for parent-child relationship in Elasticsearch 6.x version](https://discuss.elastic.co/t/how-to-create-a-dynamic-template-for-parent-child-relationship-in-elasticsearch-6-x-version/135274)

<div class="topic-metadata">

**Author:** [@sudeepkumarnair](https://discuss.elastic.co/u/sudeepkumarnair)\
**Replies:** 2\
**Last updated:** [June 13, 2018, 11:09pm UTC](https://discuss.elastic.co/t/how-to-create-a-dynamic-template-for-parent-child-relationship-in-elasticsearch-6-x-version/135274 "2018-06-13T23:09:37Z")

</div>

I am having a hard time in figuring the dynamic template which can define the parent-child relationship for ES 6.x . Any examples are welcome ... Basically, I have a root and child documents (parent-child). Currently, …

---

## [Questions on XPACK Subscriptions](https://discuss.elastic.co/t/questions-on-xpack-subscriptions/135774)

<div class="topic-metadata">

**Author:** [@titan1978](https://discuss.elastic.co/u/titan1978)\
**Replies:** 1\
**Last updated:** [June 13, 2018, 10:20pm UTC](https://discuss.elastic.co/t/questions-on-xpack-subscriptions/135774 "2018-06-13T22:20:30Z")

</div>

Considering purchasing of the Platinum license for XPACK - had a some questions on the actuals: How long do purchases of licenses last? Ie are they unlimited in terms of usage across time periods? Are Upgrades included…

---

## [Rolling upgrade alternative?](https://discuss.elastic.co/t/rolling-upgrade-alternative/135798)

<div class="topic-metadata">

**Author:** [@taganaka](https://discuss.elastic.co/u/taganaka)\
**Replies:** 1\
**Last updated:** [June 13, 2018, 9:59pm UTC](https://discuss.elastic.co/t/rolling-upgrade-alternative/135798 "2018-06-13T21:59:24Z")

</div>

Upgrading one node at a time, as suggested by the documentation, might not be feasible when ES deployment is part of an immutable infrastructure. This is my approach when upgrading from minor versions. It is a sort of b…

---

## [Set field type](https://discuss.elastic.co/t/set-field-type/135792)

<div class="topic-metadata">

**Author:** [@mc1392](https://discuss.elastic.co/u/mc1392)\
**Replies:** 0\
**Last updated:** [June 13, 2018, 8:50pm UTC](https://discuss.elastic.co/t/set-field-type/135792 "2018-06-13T20:50:25Z")

</div>

How do I set a field type without using mappings? I'm using logstash and would like to set the config there if possible? Or, do I set the field types during index creation in Kibana? very confused here.

---

## [Fielddata cache issue](https://discuss.elastic.co/t/fielddata-cache-issue/135770)

<div class="topic-metadata">

**Author:** [@oo7\_manju](https://discuss.elastic.co/u/oo7_manju)\
**Replies:** 2\
**Last updated:** [June 13, 2018, 8:06pm UTC](https://discuss.elastic.co/t/fielddata-cache-issue/135770 "2018-06-13T20:06:21Z")

</div>

Hi, We are upgrading Elasticsearch 1.7 to 5.3, observing a weird behaviour with fielddata cache. In one of our index there are keyword datatypes with mapping similar as below "shelf.raw":{ "doc\_values":true, "type":"k…

---

## [Elasticsearch for Apache Hadoop 6.3.0 released](https://discuss.elastic.co/t/elasticsearch-for-apache-hadoop-6-3-0-released/135785)

<div class="topic-metadata">

**Author:** [@james.baiera](https://discuss.elastic.co/u/james.baiera)\
**Replies:** 0\
**Last updated:** [June 13, 2018, 7:37pm UTC](https://discuss.elastic.co/t/elasticsearch-for-apache-hadoop-6-3-0-released/135785 "2018-06-13T19:37:48Z")

</div>

I am proud to announce that ES-Hadoop 6.3.0 has been released! ES-Hadoop 6.3.0 adds support for Spark 2.3, contains a large number of bug fixes, and is tested specifically against the latest Elasticsearch 6.3.0. You ca…

---

## [How to return multiple fields in a max aggregation](https://discuss.elastic.co/t/how-to-return-multiple-fields-in-a-max-aggregation/135780)

<div class="topic-metadata">

**Author:** [@Motez\_Musa](https://discuss.elastic.co/u/Motez_Musa)\
**Replies:** 0\
**Last updated:** [June 13, 2018, 6:46pm UTC](https://discuss.elastic.co/t/how-to-return-multiple-fields-in-a-max-aggregation/135780 "2018-06-13T18:46:09Z")

</div>

I have this aggregation: { "query": { "range": { "time\_stamp": { "lt": "now", "gte": "now-1d" } } }, "size": 0, "aggs": { "events\_by\_host": { "terms": { "fi…

---

## [Move snapshot files from file system to S3 and make increment snapshots work](https://discuss.elastic.co/t/move-snapshot-files-from-file-system-to-s3-and-make-increment-snapshots-work/135775)

<div class="topic-metadata">

**Author:** [@vineeth\_mohan\_2](https://discuss.elastic.co/u/vineeth_mohan_2)\
**Replies:** 0\
**Last updated:** [June 13, 2018, 6:01pm UTC](https://discuss.elastic.co/t/move-snapshot-files-from-file-system-to-s3-and-make-increment-snapshots-work/135775 "2018-06-13T18:01:23Z")

</div>

I have a huge snapshot taken on file system and we have plans to move to S3. We are seeing if there is any other option other than doing ES snapshot directly to S3. We have all the files in file system , just uploading…

---

## [A few questions optimizing our Elastic Stack](https://discuss.elastic.co/t/a-few-questions-optimizing-our-elastic-stack/135625)

<div class="topic-metadata">

**Author:** [@titan1978](https://discuss.elastic.co/u/titan1978)\
**Replies:** 5\
**Last updated:** [June 13, 2018, 5:36pm UTC](https://discuss.elastic.co/t/a-few-questions-optimizing-our-elastic-stack/135625 "2018-06-13T17:36:13Z")

</div>

We have a large number of shards spread across around 80 daily indexes and growing (5 primary 1 Replica). So far we're clocking around 400 shards. Clients do tend to query data in the older indexes. We have 5 master d…

---

## [Getting 404 Not Found error while sending data to Elasticsearch via port 80](https://discuss.elastic.co/t/getting-404-not-found-error-while-sending-data-to-elasticsearch-via-port-80/135752)

<div class="topic-metadata">

**Author:** [@Rahulkumar](https://discuss.elastic.co/u/Rahulkumar)\
**Replies:** 8\
**Last updated:** [June 13, 2018, 5:27pm UTC](https://discuss.elastic.co/t/getting-404-not-found-error-while-sending-data-to-elasticsearch-via-port-80/135752 "2018-06-13T17:27:36Z")

</div>

Hi, I have installed elasticsearch and Kibana in my local (centOS) system. I am using default port for elasticsearch(9200) and kibana(5601) . My requirement is to send data from another server to my local server using…

---

## [Stem override question](https://discuss.elastic.co/t/stem-override-question/135769)

<div class="topic-metadata">

**Author:** [@Joe\_Monastiero](https://discuss.elastic.co/u/Joe_Monastiero)\
**Replies:** 1\
**Last updated:** [June 13, 2018, 5:00pm UTC](https://discuss.elastic.co/t/stem-override-question/135769 "2018-06-13T17:00:58Z")

</div>

We have a fashion index. We do not want the word "shorts" to be stemmed to "short" in a search for shorts. "short" delivers "short dresses", "short sleeve shirts", etc. Can someone help provide and example of the rule(s)…

---

## [Range filter not working for “gt” operator but working for “lt”](https://discuss.elastic.co/t/range-filter-not-working-for-gt-operator-but-working-for-lt/135603)

<div class="topic-metadata">

**Author:** [@ankurlathwal](https://discuss.elastic.co/u/ankurlathwal)\
**Replies:** 7\
**Last updated:** [June 13, 2018, 4:03pm UTC](https://discuss.elastic.co/t/range-filter-not-working-for-gt-operator-but-working-for-lt/135603 "2018-06-13T16:03:07Z")

</div>

I am using Elasticsearch to index my documents and wanted to filter documents based on a specific property. Here is my code: filter.push({ range: {"audience.ethnicity.asian" : { gt: 50 } } }) It doesn't work with g…

---

## [Search scroll returning no hits (possible bug in 6.2?)](https://discuss.elastic.co/t/search-scroll-returning-no-hits-possible-bug-in-6-2/135578)

<div class="topic-metadata">

**Author:** [@Gemma\_Cabero](https://discuss.elastic.co/u/Gemma_Cabero)\
**Replies:** 3\
**Last updated:** [June 13, 2018, 3:31pm UTC](https://discuss.elastic.co/t/search-scroll-returning-no-hits-possible-bug-in-6-2/135578 "2018-06-13T15:31:26Z")

</div>

After an upgrade made to 6.2 our scrolling does no longer work. We are currently using a java client for it that follows the docs for first and subsequent requests (https://www.elastic.co/guide/en/elasticsearch/reference…

---

## [How to compare two aggregations buckets in watcher](https://discuss.elastic.co/t/how-to-compare-two-aggregations-buckets-in-watcher/135640)

<div class="topic-metadata">

**Author:** [@addanuj](https://discuss.elastic.co/u/addanuj)\
**Replies:** 2\
**Last updated:** [June 13, 2018, 3:08pm UTC](https://discuss.elastic.co/t/how-to-compare-two-aggregations-buckets-in-watcher/135640 "2018-06-13T15:08:58Z")

</div>

Hi Please let me know how i can compare two different aggregations buckets, i am only able to compare one bucket with one static value but i need to compare all values of two different aggregations buckets. which shoul…

---

## [Delete a field matching a regex](https://discuss.elastic.co/t/delete-a-field-matching-a-regex/135541)

<div class="topic-metadata">

**Author:** [@GregoryB-T](https://discuss.elastic.co/u/GregoryB-T)\
**Replies:** 4\
**Last updated:** [June 13, 2018, 3:01pm UTC](https://discuss.elastic.co/t/delete-a-field-matching-a-regex/135541 "2018-06-13T15:01:50Z")

</div>

Hi is it possible to delete a field in all the document of an index if he match to a regex ? Thanks and Regards

---

## [Index Templates file is not being applied. ES \[5.4.6\]](https://discuss.elastic.co/t/index-templates-file-is-not-being-applied-es-5-4-6/135747)

<div class="topic-metadata">

**Author:** [@Zamir\_Arif](https://discuss.elastic.co/u/Zamir_Arif)\
**Replies:** 0\
**Last updated:** [June 13, 2018, 2:23pm UTC](https://discuss.elastic.co/t/index-templates-file-is-not-being-applied-es-5-4-6/135747 "2018-06-13T14:23:52Z")

</div>

I have created a template as shown below. GET /\_template/ { "deal-expense-template": { "order": 0, "template": "\[deal\*\]", "settings": { "index": { "number\_of\_shards": "5" } }, "…

---

## [Node responding slowly to master, management threads spiked](https://discuss.elastic.co/t/node-responding-slowly-to-master-management-threads-spiked/135751)

<div class="topic-metadata">

**Author:** [@retzkek](https://discuss.elastic.co/u/retzkek)\
**Replies:** 0\
**Last updated:** [June 13, 2018, 2:37pm UTC](https://discuss.elastic.co/t/node-responding-slowly-to-master-management-threads-spiked/135751 "2018-06-13T14:37:49Z")

</div>

We're in the process of expanding our cluster (running 5.6.3), including upgrading and adding new dedicated masters (5.6.9), but we've had to suspend that after adding the masters (possibly unrelated, since the active ma…

---

## [Any way to make Java Client latency aware](https://discuss.elastic.co/t/any-way-to-make-java-client-latency-aware/135744)

<div class="topic-metadata">

**Author:** [@Dominik\_Stadler](https://discuss.elastic.co/u/Dominik_Stadler)\
**Replies:** 0\
**Last updated:** [June 13, 2018, 2:15pm UTC](https://discuss.elastic.co/t/any-way-to-make-java-client-latency-aware/135744 "2018-06-13T14:15:56Z")

</div>

Hi, we have machines/network where some network connections might have slightly higher latency due to the required setup of the hardware. The Client applications are spread out across the network and connect to one of t…

---

## [ES version : 5.1.2 - Retained heap is keep on increasing - causing more GCs after some time - increasing CPU spike](https://discuss.elastic.co/t/es-version-5-1-2-retained-heap-is-keep-on-increasing-causing-more-gcs-after-some-time-increasing-cpu-spike/135686)

<div class="topic-metadata">

**Author:** [@srikhark](https://discuss.elastic.co/u/srikhark)\
**Replies:** 7\
**Last updated:** [June 13, 2018, 2:27pm UTC](https://discuss.elastic.co/t/es-version-5-1-2-retained-heap-is-keep-on-increasing-causing-more-gcs-after-some-time-increasing-cpu-spike/135686 "2018-06-13T14:27:35Z")

</div>

Can you go through this and give any updates for this?

---

## [\`cluster.routing.allocation.enable: none\` set by ES?](https://discuss.elastic.co/t/cluster-routing-allocation-enable-none-set-by-es/135740)

<div class="topic-metadata">

**Author:** [@mthssdrbrg](https://discuss.elastic.co/u/mthssdrbrg)\
**Replies:** 0\
**Last updated:** [June 13, 2018, 1:48pm UTC](https://discuss.elastic.co/t/cluster-routing-allocation-enable-none-set-by-es/135740 "2018-06-13T13:48:15Z")

</div>

Hi, We had four (4) out of nine (9) nodes run into OOM issues the other day and the processes subsequently got killed. They were later started automatically (as we have a curator systemd unit with Requires=elasticsearch…

---

## [Elastic Search : Data Migration for Dates](https://discuss.elastic.co/t/elastic-search-data-migration-for-dates/133965)

<div class="topic-metadata">

**Author:** [@Nakshathri](https://discuss.elastic.co/u/Nakshathri)\
**Replies:** 8\
**Last updated:** [June 13, 2018, 1:43pm UTC](https://discuss.elastic.co/t/elastic-search-data-migration-for-dates/133965 "2018-06-13T13:43:02Z")

</div>

Hello All, We have our documents indexed in Elastic search. Each of these documents has date field captured without the timezone (By default, we are capturing the date in IST timezone, without the timezone). For obvious…

---

## [Combine wildcard and exact match](https://discuss.elastic.co/t/combine-wildcard-and-exact-match/135678)

<div class="topic-metadata">

**Author:** [@Anand\_V](https://discuss.elastic.co/u/Anand_V)\
**Replies:** 5\
**Last updated:** [June 13, 2018, 12:49pm UTC](https://discuss.elastic.co/t/combine-wildcard-and-exact-match/135678 "2018-06-13T12:49:37Z")

</div>

I am new to querying in elasticsearch. I am trying to match a field with wildcard and a few more fields with exact match. I am not able to form a proper query. Can someone help me?

---

## [Shards allocation unbalanced on nodes](https://discuss.elastic.co/t/shards-allocation-unbalanced-on-nodes/135713)

<div class="topic-metadata">

**Author:** [@Fei\_Yao](https://discuss.elastic.co/u/Fei_Yao)\
**Replies:** 1\
**Last updated:** [June 13, 2018, 12:20pm UTC](https://discuss.elastic.co/t/shards-allocation-unbalanced-on-nodes/135713 "2018-06-13T12:20:31Z")

</div>

I'm using ES v5.6.3, with 3 data nodes. All indices have default 5:1 (primary:replica) setting. After it runs for awhile (from logstash to ES) I noticed one data node has 50% disk.used\_percent where all other 2 nodes hav…

---

## [Filtering the bool query results by the score or getting results only from one query](https://discuss.elastic.co/t/filtering-the-bool-query-results-by-the-score-or-getting-results-only-from-one-query/135491)

<div class="topic-metadata">

**Author:** [@intern](https://discuss.elastic.co/u/intern)\
**Replies:** 4\
**Last updated:** [June 13, 2018, 11:55am UTC](https://discuss.elastic.co/t/filtering-the-bool-query-results-by-the-score-or-getting-results-only-from-one-query/135491 "2018-06-13T11:55:16Z")

</div>

Let's say I got the below query, two match queries inside a should clause of a bool query. I want to be able to conditionally select which queries inside my bool query are executed, I mean for example if the match query…

---

## [createdAt timestamp alternatives](https://discuss.elastic.co/t/createdat-timestamp-alternatives/135698)

<div class="topic-metadata">

**Author:** [@SebScoFr](https://discuss.elastic.co/u/SebScoFr)\
**Replies:** 0\
**Last updated:** [June 13, 2018, 11:17am UTC](https://discuss.elastic.co/t/createdat-timestamp-alternatives/135698 "2018-06-13T11:17:30Z")

</div>

I know this has been discussed already on previous threads, though our use-case might be a bit specific. We have a product import process that runs on a daily basis and saves a bunch of products into an ES index (~5M it…

---

## [How do I deal with this particular jar hell issue?](https://discuss.elastic.co/t/how-do-i-deal-with-this-particular-jar-hell-issue/135662)

<div class="topic-metadata">

**Author:** [@ndtreviv](https://discuss.elastic.co/u/ndtreviv)\
**Replies:** 3\
**Last updated:** [June 13, 2018, 10:54am UTC](https://discuss.elastic.co/t/how-do-i-deal-with-this-particular-jar-hell-issue/135662 "2018-06-13T10:54:18Z")

</div>

We're upgrading to 6.2 from 2.3.4 (ikr?! big deal) I'm battling jar hell. Previously I'd just overidden the JarHell class and snubbed all the errors. We never had any problems. Maven is pretty good at excluding duplicat…

---

## [Reindex - different doc count in the new index](https://discuss.elastic.co/t/reindex-different-doc-count-in-the-new-index/135685)

<div class="topic-metadata">

**Author:** [@kjetilhp](https://discuss.elastic.co/u/kjetilhp)\
**Replies:** 0\
**Last updated:** [June 13, 2018, 10:33am UTC](https://discuss.elastic.co/t/reindex-different-doc-count-in-the-new-index/135685 "2018-06-13T10:33:53Z")

</div>

I'm trying to reindex a timebased index to apply a new template but after reindexing the doc count of the new indexes are much less than original, I'm using the task api so I might miss some errors, not sure, can't find …

---

## [Is deleting the whole ELK stack and reinstalling on a same device a good practice?](https://discuss.elastic.co/t/is-deleting-the-whole-elk-stack-and-reinstalling-on-a-same-device-a-good-practice/135201)

<div class="topic-metadata">

**Author:** [@swathi](https://discuss.elastic.co/u/swathi)\
**Replies:** 5\
**Last updated:** [June 13, 2018, 10:31am UTC](https://discuss.elastic.co/t/is-deleting-the-whole-elk-stack-and-reinstalling-on-a-same-device-a-good-practice/135201 "2018-06-13T10:31:17Z")

</div>

Hi, I am new to ELK stack and I have recently installed it on my MAC to test out its features and learn it. I was able to successfully transfer logs through Filebeat and direct them to logstash, then logstash could push…

[Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1653)

[Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1655)
