# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1711 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1712 --- ## [1 aggregate bucket with multiple filters](https://discuss.elastic.co/t/1-aggregate-bucket-with-multiple-filters/128936)
**Author:** [@Vijay\_arora1](https://discuss.elastic.co/u/Vijay_arora1)\ **Replies:** 1\ **Last updated:** [April 23, 2018, 6:00pm UTC](https://discuss.elastic.co/t/1-aggregate-bucket-with-multiple-filters/128936 "2018-04-23T18:00:57Z")
I have a nested collection under the root documents, where I am trying to get a single aggregate value\_count based on multiple aggregate filters. For Example: I need count of address ids where city is LA or San Diego an… --- ## [How to sent Windows Event Logs to ELK?](https://discuss.elastic.co/t/how-to-sent-windows-event-logs-to-elk/129156)
**Author:** [@FIRST\_Souharit](https://discuss.elastic.co/u/FIRST_Souharit)\ **Replies:** 0\ **Last updated:** [April 23, 2018, 5:43pm UTC](https://discuss.elastic.co/t/how-to-sent-windows-event-logs-to-elk/129156 "2018-04-23T17:43:18Z")
Hello, I just started ELK and english i suck. but I have an ELK trial project to analyze Windows Event Logs. Now I have installed ELK on Ubuntu Vm. If I want to take the log file example into the logstash for analysis. … --- ## [Cakephp example](https://discuss.elastic.co/t/cakephp-example/129138)
**Author:** [@Gwen\_P](https://discuss.elastic.co/u/Gwen_P)\ **Replies:** 3\ **Last updated:** [April 23, 2018, 4:42pm UTC](https://discuss.elastic.co/t/cakephp-example/129138 "2018-04-23T16:42:04Z")
Hello everyone, I'm working on Cakephp and Elasticsearch and I'm trying to find some example of how to display index information using cakephp. I know that there is an official Cakephp plugin called Elasticsearch but t… --- ## [ES 6.2.1 Switching node attributes](https://discuss.elastic.co/t/es-6-2-1-switching-node-attributes/129146)
**Author:** [@ld\_pvl](https://discuss.elastic.co/u/ld_pvl)\ **Replies:** 0\ **Last updated:** [April 23, 2018, 4:35pm UTC](https://discuss.elastic.co/t/es-6-2-1-switching-node-attributes/129146 "2018-04-23T16:35:30Z")
Hi Team, I would like to confirm one doubt with you with regards to changing an attribute of an existing elasticsearch node. Just as an example, say I have a cluster with 3 nodes. And 2 nodes have the attribute of "hot… --- ## [Accessing single tag in watcher](https://discuss.elastic.co/t/accessing-single-tag-in-watcher/128776)
**Author:** [@pepperhat](https://discuss.elastic.co/u/pepperhat)\ **Replies:** 2\ **Last updated:** [April 23, 2018, 4:13pm UTC](https://discuss.elastic.co/t/accessing-single-tag-in-watcher/128776 "2018-04-23T16:13:09Z")
Hello All! I'm setting up a watcher that'll send an email when a query matches, and all of that is working as expected. What I'm attempting to do is access a single value from an array being returned, the first tag. Th… --- ## [Watcher - Sending x number of emails per hit](https://discuss.elastic.co/t/watcher-sending-x-number-of-emails-per-hit/128931)
**Author:** [@pstobbe\_corett](https://discuss.elastic.co/u/pstobbe_corett)\ **Replies:** 6\ **Last updated:** [April 23, 2018, 3:06pm UTC](https://discuss.elastic.co/t/watcher-sending-x-number-of-emails-per-hit/128931 "2018-04-23T15:06:30Z")
Hi, I'm trying to setup a watcher so that based on the number on hits in my query send out that number of emails. It seems to me that this can't be done by simply looping around the email action so I have an idea but n… --- ## [X-pack after install not working!](https://discuss.elastic.co/t/x-pack-after-install-not-working/129115)
**Author:** [@omid](https://discuss.elastic.co/u/omid)\ **Replies:** 5\ **Last updated:** [April 23, 2018, 2:14pm UTC](https://discuss.elastic.co/t/x-pack-after-install-not-working/129115 "2018-04-23T14:14:45Z")
install xpack and enter address kibana in browser this error msg: {"statusCode":404,"error":"Not Found","message":"\[index\_not\_found\_exception\] no such index, with { resource.type=\\"index\_expression\\" & resource.id=\\"\_… --- ## [Machine Learning in the cloud](https://discuss.elastic.co/t/machine-learning-in-the-cloud/129098)
**Author:** [@georgezoto](https://discuss.elastic.co/u/georgezoto)\ **Replies:** 3\ **Last updated:** [April 23, 2018, 1:54pm UTC](https://discuss.elastic.co/t/machine-learning-in-the-cloud/129098 "2018-04-23T13:54:48Z")
Hello machine learning team, I really like your features for on-premise ELK servers. Last thread I found was suggesting support for cloud by October 2017. Is ML for cloud now available? Any timeline suggested? I plan to… --- ## [Excessively high bulk work\_queue counts right before OOM](https://discuss.elastic.co/t/excessively-high-bulk-work-queue-counts-right-before-oom/129121)
**Author:** [@eherot](https://discuss.elastic.co/u/eherot)\ **Replies:** 0\ **Last updated:** [April 23, 2018, 1:32pm UTC](https://discuss.elastic.co/t/excessively-high-bulk-work-queue-counts-right-before-oom/129121 "2018-04-23T13:32:59Z")
So going over the Prometheus data that my ELK cluster spewed out right before all of my coordinators died by running out of heap space, I saw that the there was a huge excursion in the number of tasks in the bulk work\_qu… --- ## [AWS RDS Postgres Provided Grok expressions do not match field value](https://discuss.elastic.co/t/aws-rds-postgres-provided-grok-expressions-do-not-match-field-value/129116)
**Author:** [@toontilley](https://discuss.elastic.co/u/toontilley)\ **Replies:** 0\ **Last updated:** [April 23, 2018, 1:25pm UTC](https://discuss.elastic.co/t/aws-rds-postgres-provided-grok-expressions-do-not-match-field-value/129116 "2018-04-23T13:25:43Z")
I'm trying to setup Filebeat with the postgres module to publish logs from an AWS/RDS instance to elasticsearch. I have a python script which can download the logs and the output looks like this: 2018-04-18 08:10:50 UTC… --- ## [How to move data from ES 5.0 on one server to ES 6.1 on different server?](https://discuss.elastic.co/t/how-to-move-data-from-es-5-0-on-one-server-to-es-6-1-on-different-server/129039)
**Author:** [@Madhuri\_Gupta](https://discuss.elastic.co/u/Madhuri_Gupta)\ **Replies:** 1\ **Last updated:** [April 23, 2018, 1:31pm UTC](https://discuss.elastic.co/t/how-to-move-data-from-es-5-0-on-one-server-to-es-6-1-on-different-server/129039 "2018-04-23T13:31:16Z")
Hi , can someone please guide on moving data from Elastic search 5.0 version on one server to different server with higher elastic search version 6.1/6.2. Thanks, Madhuri --- ## [Performance tips wanted for one time logs import](https://discuss.elastic.co/t/performance-tips-wanted-for-one-time-logs-import/129118)
**Author:** [@Aditya\_Kumar](https://discuss.elastic.co/u/Aditya_Kumar)\ **Replies:** 0\ **Last updated:** [April 23, 2018, 1:30pm UTC](https://discuss.elastic.co/t/performance-tips-wanted-for-one-time-logs-import/129118 "2018-04-23T13:30:05Z")
I use an ELK stack to process sets of historical logs which I receive from customers in zipped up bundle. In total there could be 2~3 million lines of logs which I want to import quickly so I can start analysing them in… --- ## [Unable to modify values from Payload](https://discuss.elastic.co/t/unable-to-modify-values-from-payload/129047)
**Author:** [@Himanshu\_Rajput](https://discuss.elastic.co/u/Himanshu_Rajput)\ **Replies:** 1\ **Last updated:** [April 23, 2018, 1:17pm UTC](https://discuss.elastic.co/t/unable-to-modify-values-from-payload/129047 "2018-04-23T13:17:34Z")
Hi, I am trying to create this watch- { "trigger": { "schedule": { "interval": "5s" } }, "input": { "search": { "request": { "indices": \[ ".marvel-\*" \], "search\_type": "count", "body": { "query": { "fil… --- ## [Upgrade from v5.1.1 to v5.6.4 disabled role based access](https://discuss.elastic.co/t/upgrade-from-v5-1-1-to-v5-6-4-disabled-role-based-access/128386)
**Author:** [@Turbo\_Fredriksson](https://discuss.elastic.co/u/Turbo_Fredriksson)\ **Replies:** 5\ **Last updated:** [April 23, 2018, 12:50pm UTC](https://discuss.elastic.co/t/upgrade-from-v5-1-1-to-v5-6-4-disabled-role-based-access/128386 "2018-04-23T12:50:12Z")
We're testing upgrades from v5.1.1 to v5.6.4 and we had all role based access working before the upgrade, but afterwards, no authentication/authorisation succeeded. $ curl -s https://turbo:Secret@mycluster/myindex | jq … --- ## [Nest and a cluster without a master node](https://discuss.elastic.co/t/nest-and-a-cluster-without-a-master-node/128897)
**Author:** [@aslamy1](https://discuss.elastic.co/u/aslamy1)\ **Replies:** 9\ **Last updated:** [April 23, 2018, 11:18am UTC](https://discuss.elastic.co/t/nest-and-a-cluster-without-a-master-node/128897 "2018-04-23T11:18:43Z")
I have a cluster with two nodes. I use discovery.zen.minimum\_master\_nodes : 2 to avoid the splitt brain. When I stop one of this nodes. Nest stops working. {" Invalid NEST response built from a unsuccessful low level … --- ## [Evaluating your search system's performance](https://discuss.elastic.co/t/evaluating-your-search-systems-performance/17064)
**Author:** [@Andrew\_O\_Brien](https://discuss.elastic.co/u/Andrew_O_Brien)\ **Replies:** 2\ **Last updated:** [April 23, 2018, 12:05pm UTC](https://discuss.elastic.co/t/evaluating-your-search-systems-performance/17064 "2018-04-23T12:05:13Z")
What do you generally do to evaluate your search system's performance? Do you use a metrics based approach where they can compare how changes to scoring, analysis, or similarities effect hits in a quantitative way? O… --- ## [I am not getting the logs in Kibana](https://discuss.elastic.co/t/i-am-not-getting-the-logs-in-kibana/129079)
**Author:** [@siva1](https://discuss.elastic.co/u/siva1)\ **Replies:** 3\ **Last updated:** [April 23, 2018, 11:44am UTC](https://discuss.elastic.co/t/i-am-not-getting-the-logs-in-kibana/129079 "2018-04-23T11:44:36Z")
Hi..Guys.. ==\> /var/log/logstash/logstash-plain.log \<== elk\_1 | \[2018-04-23T10:04:15,350\]\[INFO \]\[logstash.modules.scaffold\] Initializing module {:module\_name=\>"fb\_apache", :directory=\>"/opt/logstash/modules/fb\_apache/… --- ## [While migrating form ES2 to ES6 index is taking more space](https://discuss.elastic.co/t/while-migrating-form-es2-to-es6-index-is-taking-more-space/128799)
**Author:** [@manish\_mitra](https://discuss.elastic.co/u/manish_mitra)\ **Replies:** 7\ **Last updated:** [April 23, 2018, 10:57am UTC](https://discuss.elastic.co/t/while-migrating-form-es2-to-es6-index-is-taking-more-space/128799 "2018-04-23T10:57:44Z")
Hi, We are upgrading Elastic stack from Elastic search 2.3.4 to elastic search 6.2. When we are migrating index from ES2 to ES6, migrated index are taking more space in ES6 , we migrated thinking that ES6 would take le… --- ## [Upgrading from 5.6.6 to 6.latest - rolling upgrade or full restart?](https://discuss.elastic.co/t/upgrading-from-5-6-6-to-6-latest-rolling-upgrade-or-full-restart/128545)
**Author:** [@Ant](https://discuss.elastic.co/u/Ant)\ **Replies:** 2\ **Last updated:** [April 23, 2018, 10:37am UTC](https://discuss.elastic.co/t/upgrading-from-5-6-6-to-6-latest-rolling-upgrade-or-full-restart/128545 "2018-04-23T10:37:12Z")
So I ran thought https://www.elastic.co/products/upgrade\_guide and it told me I need to do a full cluster restsart rather than a rolling upgrade which is also the guidance here https://www.elastic.co/guide/en/elasticsea… --- ## [Analyzer Problems](https://discuss.elastic.co/t/analyzer-problems/128721)
**Author:** [@Kratosonyy](https://discuss.elastic.co/u/Kratosonyy)\ **Replies:** 2\ **Last updated:** [April 23, 2018, 8:36am UTC](https://discuss.elastic.co/t/analyzer-problems/128721 "2018-04-23T08:36:48Z")
Hey guys, ES newbie here - I'm currently working on a data-set having the format of the following: // "desc": "The Quick and Brown Fox", // "amount": 1000 I'm passing the "desc" field through a stop analyzer and it … --- ## [NoSuchFileException: /usr/share/elasticsearch/config](https://discuss.elastic.co/t/nosuchfileexception-usr-share-elasticsearch-config/129056)
**Author:** [@souf\_el\_badraoui](https://discuss.elastic.co/u/souf_el_badraoui)\ **Replies:** 0\ **Last updated:** [April 23, 2018, 8:24am UTC](https://discuss.elastic.co/t/nosuchfileexception-usr-share-elasticsearch-config/129056 "2018-04-23T08:24:19Z")
Hello, ES 5.6.5 fails starting with systemd in Red hat and show the following error main ERROR Could not register mbeans java.security.Acces at java.security.AccessControlContext.checkPermission(AccessControlConte a… --- ## [Cumulative sum of derivatives](https://discuss.elastic.co/t/cumulative-sum-of-derivatives/128119)
**Author:** [@Narayana\_Pachava](https://discuss.elastic.co/u/Narayana_Pachava)\ **Replies:** 3\ **Last updated:** [April 23, 2018, 7:26am UTC](https://discuss.elastic.co/t/cumulative-sum-of-derivatives/128119 "2018-04-23T07:26:53Z")
cumulative sum of derivatives I am currently using elastic for storing time series of of data where I am storing the incoming packets( it is incremental counter) on a port-\>network device . I am doing aggregations to c… --- ## [When Removing default path settings elasticsearch fails starting](https://discuss.elastic.co/t/when-removing-default-path-settings-elasticsearch-fails-starting/128881)
**Author:** [@souf\_el\_badraoui](https://discuss.elastic.co/u/souf_el_badraoui)\ **Replies:** 1\ **Last updated:** [April 23, 2018, 7:06am UTC](https://discuss.elastic.co/t/when-removing-default-path-settings-elasticsearch-fails-starting/128881 "2018-04-23T07:06:48Z")
Hello, I want to upgrade my 5.6.5 ES cluster to v6.2 using the Upgrade Assistant and i get an error that states Default path settings are removed This issue must be resolved to upgrade. Read Documentation but… --- ## [Inconsistent results using Lucene Query Syntax](https://discuss.elastic.co/t/inconsistent-results-using-lucene-query-syntax/129034)
**Author:** [@SRIpandu1729](https://discuss.elastic.co/u/SRIpandu1729)\ **Replies:** 8\ **Last updated:** [April 23, 2018, 7:05am UTC](https://discuss.elastic.co/t/inconsistent-results-using-lucene-query-syntax/129034 "2018-04-23T07:05:51Z")
I am using elasticstack for log analysis. When I am querying from Kibana using the Lucene Query Syntax I am gettting some inconsistent results. The queries along with their respective number of hits are: clientIP: \[66.… --- ## [How to get elasticsearch document id against topdocs.scandocs\[i\].doc](https://discuss.elastic.co/t/how-to-get-elasticsearch-document-id-against-topdocs-scandocs-i-doc/129040)
**Author:** [@maarab](https://discuss.elastic.co/u/maarab)\ **Replies:** 0\ **Last updated:** [April 23, 2018, 6:32am UTC](https://discuss.elastic.co/t/how-to-get-elasticsearch-document-id-against-topdocs-scandocs-i-doc/129040 "2018-04-23T06:32:47Z")
In my elasticsearch plugin code I get the results in topdocs. While looping through topdocs, there is an id that is retrieved by doing topdocs.scandocs\[i\].doc. This id is not the elasticsearch document id. How can I get … --- ## [How to save ordering for recreated index in search result](https://discuss.elastic.co/t/how-to-save-ordering-for-recreated-index-in-search-result/128830)
**Author:** [@jmanj](https://discuss.elastic.co/u/jmanj)\ **Replies:** 2\ **Last updated:** [April 23, 2018, 3:30am UTC](https://discuss.elastic.co/t/how-to-save-ordering-for-recreated-index-in-search-result/128830 "2018-04-23T03:30:44Z")
Hello. We need to storage items order in resulting search response after elasticsearch index is updating. Now we do this by sorting with \_doc value, but for same field values getting different result after recreating ela… --- ## [Wrong anomaly detection with X-pack ML?](https://discuss.elastic.co/t/wrong-anomaly-detection-with-x-pack-ml/124348)
**Author:** [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Replies:** 12\ **Last updated:** [April 23, 2018, 2:39am UTC](https://discuss.elastic.co/t/wrong-anomaly-detection-with-x-pack-ml/124348 "2018-04-23T02:39:55Z")
Hello, I'm starting to make some tests with Machine Learning on my data and I'm trying to understand how it works and why it identifies an anomaly, an unexpected zero value, when the same query did not return zero. The… --- ## [Machine Learning data disapeared](https://discuss.elastic.co/t/machine-learning-data-disapeared/128011)
**Author:** [@David\_Tomasheski](https://discuss.elastic.co/u/David_Tomasheski)\ **Replies:** 4\ **Last updated:** [April 23, 2018, 2:28am UTC](https://discuss.elastic.co/t/machine-learning-data-disapeared/128011 "2018-04-23T02:28:08Z")
I have been running a Machine Learning job which I created on April 3rd. The metric has a predictable wave pattern to it. The blue model bounds were getting tighter. I checked in on April 11th and all looked good. I chec… --- ## [Cannot retrieve remote IP address](https://discuss.elastic.co/t/cannot-retrieve-remote-ip-address/128217)
**Author:** [@jordyd](https://discuss.elastic.co/u/jordyd)\ **Replies:** 3\ **Last updated:** [April 23, 2018, 1:03am UTC](https://discuss.elastic.co/t/cannot-retrieve-remote-ip-address/128217 "2018-04-23T01:03:11Z")
I created certificates using the x-pack certutil, but Logstash is giving me this error. I created a certificate with an IP address for Filebeat and Logstash because I want Filebeat to send data to Logstash which is insta… --- ## [Creating child document to store additional information](https://discuss.elastic.co/t/creating-child-document-to-store-additional-information/129025)
**Author:** [@mattkallo](https://discuss.elastic.co/u/mattkallo)\ **Replies:** 0\ **Last updated:** [April 23, 2018, 12:27am UTC](https://discuss.elastic.co/t/creating-child-document-to-store-additional-information/129025 "2018-04-23T00:27:59Z")
After we index documents into elastic search, we do some processing to enrich the document (like adding tags etc) with additional information. This is done for all documents and the search relies on this enriched data. W… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1710) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1712)