# Elasticsearch

**URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1673

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 1674

---

## [Discovery-ec2 does not attempt to connect to nodes \[RESOLVED\]](https://discuss.elastic.co/t/discovery-ec2-does-not-attempt-to-connect-to-nodes-resolved/133680)

<div class="topic-metadata">

**Author:** [@vincentv](https://discuss.elastic.co/u/vincentv)\
**Replies:** 2\
**Last updated:** [May 29, 2018, 2:25pm UTC](https://discuss.elastic.co/t/discovery-ec2-does-not-attempt-to-connect-to-nodes-resolved/133680 "2018-05-29T14:25:19Z")

</div>

Hi all, I've been fighting with this issue for quite some time, hopefully someone here can shed some light on it. I have a 2 node test cluster of ES 6. { "name" : "ip-172-18-5-140", "cluster\_name" : "elasticstack"…

---

## [X-pack/ldaps error: RFC822Name may not be null or empty](https://discuss.elastic.co/t/x-pack-ldaps-error-rfc822name-may-not-be-null-or-empty/133341)

<div class="topic-metadata">

**Author:** [@jmtrc](https://discuss.elastic.co/u/jmtrc)\
**Replies:** 2\
**Last updated:** [May 29, 2018, 2:03pm UTC](https://discuss.elastic.co/t/x-pack-ldaps-error-rfc822name-may-not-be-null-or-empty/133341 "2018-05-29T14:03:04Z")

</div>

It looks like to me that x-pack deployed by ECE 1.1.3 requires X509 Subject Alternative Name presented in LDAPS server certificate. Otherwise, x-pack generates a Java exception "RFC822Name may not be null or empty". Java…

---

## [If Field Mapping Exists](https://discuss.elastic.co/t/if-field-mapping-exists/132386)

<div class="topic-metadata">

**Author:** [@Jeff\_Bursik](https://discuss.elastic.co/u/Jeff_Bursik)\
**Replies:** 3\
**Last updated:** [May 29, 2018, 1:39pm UTC](https://discuss.elastic.co/t/if-field-mapping-exists/132386 "2018-05-29T13:39:59Z")

</div>

I'm in the middle of updating some mappings to an existing index and curious if there is a way to search to see if a specific field mapping exists? For example, I update the mapping with the query below but now want to …

---

## [Curator: Snapshotting Yesterday's Index](https://discuss.elastic.co/t/curator-snapshotting-yesterdays-index/132994)

<div class="topic-metadata">

**Author:** [@dawiro](https://discuss.elastic.co/u/dawiro)\
**Replies:** 9\
**Last updated:** [May 29, 2018, 1:20pm UTC](https://discuss.elastic.co/t/curator-snapshotting-yesterdays-index/132994 "2018-05-29T13:20:31Z")

</div>

Hi, I'm using curator 5.5.1 and specifying tasks in yaml formatted config files. Would appreciate it if someone could explain to me how i can snapshot an index that has rolled over? Regards, D

---

## [X-PACK Installation issues](https://discuss.elastic.co/t/x-pack-installation-issues/133639)

<div class="topic-metadata">

**Author:** [@abhat](https://discuss.elastic.co/u/abhat)\
**Replies:** 4\
**Last updated:** [May 29, 2018, 12:58pm UTC](https://discuss.elastic.co/t/x-pack-installation-issues/133639 "2018-05-29T12:58:24Z")

</div>

Hi Team, I am able to install X-PACK on ElasticSearch and Kibana. However I am getting below error while installing x-pack on Logstash. Validating x-pack x-pack is not a Logstash plugin ERROR: Installation aborted, …

---

## [How to change the mapping type while reindexing](https://discuss.elastic.co/t/how-to-change-the-mapping-type-while-reindexing/133683)

<div class="topic-metadata">

**Author:** [@sureshsubramaniyan](https://discuss.elastic.co/u/sureshsubramaniyan)\
**Replies:** 0\
**Last updated:** [May 29, 2018, 12:39pm UTC](https://discuss.elastic.co/t/how-to-change-the-mapping-type-while-reindexing/133683 "2018-05-29T12:39:46Z")

</div>

How to change the dynamic mapping type from logs to docs while reindexing "index\_name1\_template": { "order": 0, "index\_patterns": \[ "index\_name1\_v1\_\*" \], "settings": { …

---

## [Cluster Health is Yellow](https://discuss.elastic.co/t/cluster-health-is-yellow/133455)

<div class="topic-metadata">

**Author:** [@keeshqs](https://discuss.elastic.co/u/keeshqs)\
**Replies:** 3\
**Last updated:** [May 29, 2018, 12:36pm UTC](https://discuss.elastic.co/t/cluster-health-is-yellow/133455 "2018-05-29T12:36:13Z")

</div>

Hi Experts, We have implemented a standalone ELK stack (A cluster with one node) for Production. I understand that you assign 2 or more replicas in multiple nodes, which in our case is not applicable. When we go to th…

---

## [Settings from elasticsearch-keystore not loaded](https://discuss.elastic.co/t/settings-from-elasticsearch-keystore-not-loaded/133067)

<div class="topic-metadata">

**Author:** [@sureshsubramaniyan](https://discuss.elastic.co/u/sureshsubramaniyan)\
**Replies:** 2\
**Last updated:** [May 29, 2018, 12:34pm UTC](https://discuss.elastic.co/t/settings-from-elasticsearch-keystore-not-loaded/133067 "2018-05-29T12:34:29Z")

</div>

I have stored the active directory bind user password in elasticsearch keystore . but password not getting read from the keystore . elasticsearch.yml settings: xpack: security: authc: realms: native…

---

## [Unable to generate CSV](https://discuss.elastic.co/t/unable-to-generate-csv/132183)

<div class="topic-metadata">

**Author:** [@Diego\_Auza](https://discuss.elastic.co/u/Diego_Auza)\
**Replies:** 4\
**Last updated:** [May 29, 2018, 12:06pm UTC](https://discuss.elastic.co/t/unable-to-generate-csv/132183 "2018-05-29T12:06:54Z")

</div>

Hi, I seem to be having an issue while generating reports for large amounts of data for export on CSV. I wanted to confirm if I'm hitting some kind of max size or if this is some kind of configuration issue. Currently, …

---

## [X-Pack monitoring using up a lot of CPU](https://discuss.elastic.co/t/x-pack-monitoring-using-up-a-lot-of-cpu/133074)

<div class="topic-metadata">

**Author:** [@JensVanDeynse](https://discuss.elastic.co/u/JensVanDeynse)\
**Replies:** 6\
**Last updated:** [May 29, 2018, 12:03pm UTC](https://discuss.elastic.co/t/x-pack-monitoring-using-up-a-lot-of-cpu/133074 "2018-05-29T12:03:39Z")

</div>

Hello there In our company we've set up an elasticstack which has to handle about 130GB of logs (in indices) per day coming from 14 hosts (for now). Yesterday I install x-pack monitoring on the filebeats but then I not…

---

## [Range with text](https://discuss.elastic.co/t/range-with-text/133665)

<div class="topic-metadata">

**Author:** [@Michael\_Oullion](https://discuss.elastic.co/u/Michael_Oullion)\
**Replies:** 2\
**Last updated:** [May 29, 2018, 11:43am UTC](https://discuss.elastic.co/t/range-with-text/133665 "2018-05-29T11:43:45Z")

</div>

Hello, I try to do a search with a range on text term. We have "box" that contain documents from "A0001" to "F235" and from "F236" to "P159",... for example and I need to find with box contained Bryan's Documents. I f…

---

## [Connect ES and KB](https://discuss.elastic.co/t/connect-es-and-kb/133624)

<div class="topic-metadata">

**Author:** [@Meghna\_Mane](https://discuss.elastic.co/u/Meghna_Mane)\
**Replies:** 6\
**Last updated:** [May 29, 2018, 11:35am UTC](https://discuss.elastic.co/t/connect-es-and-kb/133624 "2018-05-29T11:35:33Z")

</div>

I have setup elasticsearch on one separate server and Logstatsh & Kibana (Both) on one server. 1st server- ES 2nd server- Logstatsh and kibana I have added Elasticsearch.yml network.host: 0.0.0.0 and kibana.yml se…

---

## [Data is getting duplicating when doing bulk insert](https://discuss.elastic.co/t/data-is-getting-duplicating-when-doing-bulk-insert/133663)

<div class="topic-metadata">

**Author:** [@VictorPalson](https://discuss.elastic.co/u/VictorPalson)\
**Replies:** 0\
**Last updated:** [May 29, 2018, 10:50am UTC](https://discuss.elastic.co/t/data-is-getting-duplicating-when-doing-bulk-insert/133663 "2018-05-29T10:50:14Z")

</div>

Hi Everyone, We are trying to add the object in Bulk descriptor, when the descriptor count reaches 500 we are pushing the data to ES. But the data is getting collapsed. Eg. 1st document data is pushing properly, instead…

---

## [Search with fields wildcard not working](https://discuss.elastic.co/t/search-with-fields-wildcard-not-working/133240)

<div class="topic-metadata">

**Author:** [@yuhao\_zhang](https://discuss.elastic.co/u/yuhao_zhang)\
**Replies:** 3\
**Last updated:** [May 29, 2018, 10:45am UTC](https://discuss.elastic.co/t/search-with-fields-wildcard-not-working/133240 "2018-05-29T10:45:34Z")

</div>

Hi Currently I am working on elasticsearch 6.2.4 I am not able to perform the wildcard search within specific inner elements of the document like this (https://www.elastic.co/guide/en/elasticsearch/reference/current/que…

---

## [ES with WORM stroage](https://discuss.elastic.co/t/es-with-worm-stroage/133597)

<div class="topic-metadata">

**Author:** [@wans](https://discuss.elastic.co/u/wans)\
**Replies:** 2\
**Last updated:** [May 29, 2018, 10:45am UTC](https://discuss.elastic.co/t/es-with-worm-stroage/133597 "2018-05-29T10:45:28Z")

</div>

Hello? I'm using ES 6.1 and my client want to store old data into WORM (Write Once Read Many) storage. So I'll move old index to WORM storage mounted node. I'm worrying about whether ES will work or not on WORM storag…

---

## [How to use Java API to build a nested query with filter query combination in 5.6.x?](https://discuss.elastic.co/t/how-to-use-java-api-to-build-a-nested-query-with-filter-query-combination-in-5-6-x/133071)

<div class="topic-metadata">

**Author:** [@kguru08](https://discuss.elastic.co/u/kguru08)\
**Replies:** 1\
**Last updated:** [May 29, 2018, 10:41am UTC](https://discuss.elastic.co/t/how-to-use-java-api-to-build-a-nested-query-with-filter-query-combination-in-5-6-x/133071 "2018-05-29T10:41:09Z")

</div>

Currently we are migrating from 1.7 to 5.6 version in our project. 1.7 java FilterBuilder fb = FilterBuilders.boolFilter() .must(FilterBuilders.termFilter("isVersion", 0)) .mustNot(FilterBuilders.termFilter("currentL…

---

## [Latency Spike now and then even though the query is simple](https://discuss.elastic.co/t/latency-spike-now-and-then-even-though-the-query-is-simple/133262)

<div class="topic-metadata">

**Author:** [@owenericsson](https://discuss.elastic.co/u/owenericsson)\
**Replies:** 1\
**Last updated:** [May 29, 2018, 10:36am UTC](https://discuss.elastic.co/t/latency-spike-now-and-then-even-though-the-query-is-simple/133262 "2018-05-29T10:36:10Z")

</div>

hi recently i am suffered with this problem while i am using an index and here is a summary of this index ES: 5.5.2 docs: ~1 billion shards: 3 indexing rate: \< 100 TPS structure: simp…

---

## [Aggregating the specific nested documents only](https://discuss.elastic.co/t/aggregating-the-specific-nested-documents-only/133387)

<div class="topic-metadata">

**Author:** [@rakeshallampati](https://discuss.elastic.co/u/rakeshallampati)\
**Replies:** 1\
**Last updated:** [May 29, 2018, 10:06am UTC](https://discuss.elastic.co/t/aggregating-the-specific-nested-documents-only/133387 "2018-05-29T10:06:00Z")

</div>

Hi, I just want to aggregate the specific nested documents which satisfies the given query. Let me explain it through an example, i have two records in my index first one , { "project": \[ { "subject": "mat…

---

## [Permission denied Can't run elasticsearch](https://discuss.elastic.co/t/permission-denied-cant-run-elasticsearch/132352)

<div class="topic-metadata">

**Author:** [@applicate](https://discuss.elastic.co/u/applicate)\
**Replies:** 7\
**Last updated:** [May 29, 2018, 10:00am UTC](https://discuss.elastic.co/t/permission-denied-cant-run-elasticsearch/132352 "2018-05-29T10:00:54Z")

</div>

Lenovo-G50-80:/usr/share/elasticsearch$ bin/elasticsearch bin/elasticsearch-env: line 70: /etc/default/elasticsearch: Permission denied

---

## [How can I ingest PDF and words files and extract keywords of these documents?](https://discuss.elastic.co/t/how-can-i-ingest-pdf-and-words-files-and-extract-keywords-of-these-documents/133194)

<div class="topic-metadata">

**Author:** [@Akimbo](https://discuss.elastic.co/u/Akimbo)\
**Replies:** 7\
**Last updated:** [May 29, 2018, 9:59am UTC](https://discuss.elastic.co/t/how-can-i-ingest-pdf-and-words-files-and-extract-keywords-of-these-documents/133194 "2018-05-29T09:59:58Z")

</div>

Hi all, Currently, I use FSCrawler to ingest files (PDF, words). All files are indexed in ES. Now, I want to do a search engine which uses Elasticsearch and looks like Google search engine. The first step of the search …

---

## [Index Size Query](https://discuss.elastic.co/t/index-size-query/133098)

<div class="topic-metadata">

**Author:** [@Jasonespo](https://discuss.elastic.co/u/Jasonespo)\
**Replies:** 2\
**Last updated:** [May 29, 2018, 9:02am UTC](https://discuss.elastic.co/t/index-size-query/133098 "2018-05-29T09:02:29Z")

</div>

When I run: GET \_cat/indices/tid\* OUTPUT: green open tid.67a cvQK61shSBCJd8DzFSlOwA 5 1 235899 0 560.7mb 281.2mb I have two values for size. My simple question is, is this size value in bits or bytes? Usually the lo…

---

## [Plugin \[analysis-phonetic\] and \[analysis-icu\] is incompatible with ElasticSearch version \[5.6.9\]](https://discuss.elastic.co/t/plugin-analysis-phonetic-and-analysis-icu-is-incompatible-with-elasticsearch-version-5-6-9/133635)

<div class="topic-metadata">

**Author:** [@pankajpragma](https://discuss.elastic.co/u/pankajpragma)\
**Replies:** 2\
**Last updated:** [May 29, 2018, 8:37am UTC](https://discuss.elastic.co/t/plugin-analysis-phonetic-and-analysis-icu-is-incompatible-with-elasticsearch-version-5-6-9/133635 "2018-05-29T08:37:07Z")

</div>

Recently updated the Ubuntu 16.04 and it does update the ElasticSearch from 5.6.8 to 5.6.9. But it has stopped working ElasticSearch as analysis-phonetic and analysis-icu is incompatible with ElasticSearch 5.6.9 java.l…

---

## [ElasticSearch - 6.1 - Windows - Not starting](https://discuss.elastic.co/t/elasticsearch-6-1-windows-not-starting/133546)

<div class="topic-metadata">

**Author:** [@Fhocs](https://discuss.elastic.co/u/Fhocs)\
**Replies:** 5\
**Last updated:** [May 29, 2018, 8:09am UTC](https://discuss.elastic.co/t/elasticsearch-6-1-windows-not-starting/133546 "2018-05-29T08:09:03Z")

</div>

Hello, I'm using Elastic 6.1.1 on windows , I installed it via the msi setup, the cluster was running fine, we got a unexpected restart of the cluster and now all node display this. Here the exception log : Elastic.Pr…

---

## [Find index exists in elasticsearch 5.6](https://discuss.elastic.co/t/find-index-exists-in-elasticsearch-5-6/133420)

<div class="topic-metadata">

**Author:** [@aymenkn](https://discuss.elastic.co/u/aymenkn)\
**Replies:** 1\
**Last updated:** [May 29, 2018, 7:04am UTC](https://discuss.elastic.co/t/find-index-exists-in-elasticsearch-5-6/133420 "2018-05-29T07:04:44Z")

</div>

i tried to check if an index exists or note before i do a search, i found a solution by performing requests, but it's not working, it results on a NullPointerException @Autowired private RestHighLevelClient restHighL…

---

## [Elastic search doubt](https://discuss.elastic.co/t/elastic-search-doubt/133466)

<div class="topic-metadata">

**Author:** [@hitman](https://discuss.elastic.co/u/hitman)\
**Replies:** 2\
**Last updated:** [May 29, 2018, 7:03am UTC](https://discuss.elastic.co/t/elastic-search-doubt/133466 "2018-05-29T07:03:03Z")

</div>

elastic search is not working on my machine.I use windows.when i open the windows batch file of elastic search it is just opening and closing immediately.any solution?

---

## [Why Completion Suggester with Edge Ngram analyzer takes 15 to 17 times more index size as compared to default](https://discuss.elastic.co/t/why-completion-suggester-with-edge-ngram-analyzer-takes-15-to-17-times-more-index-size-as-compared-to-default/133467)

<div class="topic-metadata">

**Author:** [@sharma.puneet3](https://discuss.elastic.co/u/sharma.puneet3)\
**Replies:** 1\
**Last updated:** [May 29, 2018, 7:02am UTC](https://discuss.elastic.co/t/why-completion-suggester-with-edge-ngram-analyzer-takes-15-to-17-times-more-index-size-as-compared-to-default/133467 "2018-05-29T07:02:00Z")

</div>

I am implementing completion suggester on multiple field having alphanumeric and colon(AA:890090:xyz:9090). When I use default analyzer for completion suggester(simple analyzer), I am not able to get suggestions(AA:890)…

---

## [Notify Logstash when new data is entered in mysql databse without using parameter schedule](https://discuss.elastic.co/t/notify-logstash-when-new-data-is-entered-in-mysql-databse-without-using-parameter-schedule/133621)

<div class="topic-metadata">

**Author:** [@iwayankit](https://discuss.elastic.co/u/iwayankit)\
**Replies:** 5\
**Last updated:** [May 29, 2018, 6:55am UTC](https://discuss.elastic.co/t/notify-logstash-when-new-data-is-entered-in-mysql-databse-without-using-parameter-schedule/133621 "2018-05-29T06:55:46Z")

</div>

I am working on Elastic Stack with Mysql. everything is working fine like logstash taking data from mysql database and sending it to elasticsearch and when new entries entered in mysql data then to update elasticsearch a…

---

## [How to use ngram tokenizer for words that output from synonym filter?](https://discuss.elastic.co/t/how-to-use-ngram-tokenizer-for-words-that-output-from-synonym-filter/133617)

<div class="topic-metadata">

**Author:** [@zhishan\_zhao](https://discuss.elastic.co/u/zhishan_zhao)\
**Replies:** 1\
**Last updated:** [May 29, 2018, 6:43am UTC](https://discuss.elastic.co/t/how-to-use-ngram-tokenizer-for-words-that-output-from-synonym-filter/133617 "2018-05-29T06:43:37Z")

</div>

hi, I want use standard tokenizer to split sentence into words first, then use synonym filter to normalize synonyms, and finally use ngram tokenizer to break the words that output from synonym filter into characters。In s…

---

## [Complex function score](https://discuss.elastic.co/t/complex-function-score/133625)

<div class="topic-metadata">

**Author:** [@aclowkey](https://discuss.elastic.co/u/aclowkey)\
**Replies:** 0\
**Last updated:** [May 29, 2018, 6:41am UTC](https://discuss.elastic.co/t/complex-function-score/133625 "2018-05-29T06:41:52Z")

</div>

Can I have score functions such as, multiply some functions, and add the other? For example, I want to boost on the filter score, and add the field\_value\_score. Is this possible?

---

## [Is it possible to get the bucket interval of a histogram for bucket\_script?](https://discuss.elastic.co/t/is-it-possible-to-get-the-bucket-interval-of-a-histogram-for-bucket-script/133613)

<div class="topic-metadata">

**Author:** [@prismatic](https://discuss.elastic.co/u/prismatic)\
**Replies:** 0\
**Last updated:** [May 29, 2018, 5:38am UTC](https://discuss.elastic.co/t/is-it-possible-to-get-the-bucket-interval-of-a-histogram-for-bucket-script/133613 "2018-05-29T05:38:41Z")

</div>

I want to calculate (sum(my\_document\_field)/bucket\_interval) for all buckets in a date\_histogram. Its straightforward to calculate the sum with a sum\_bucket aggregation, however I'm having trouble figuring out how to get…

[Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1672)

[Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1674)
