# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1717 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1718 --- ## [Curator Older Than configuration does not work](https://discuss.elastic.co/t/curator-older-than-configuration-does-not-work/128190)
**Author:** [@tchoum](https://discuss.elastic.co/u/tchoum)\ **Replies:** 6\ **Last updated:** [April 17, 2018, 11:55am UTC](https://discuss.elastic.co/t/curator-older-than-configuration-does-not-work/128190 "2018-04-17T11:55:56Z")
Hello, I' m trying to delete logs older than 10 days within an indice, based on the timestamp of my logs indice, but it does not seem to work as curator seems to delete logs older than 5 days instead, The name of my in… --- ## [ES 5.6.4: offheap memory keeps growing](https://discuss.elastic.co/t/es-5-6-4-offheap-memory-keeps-growing/126760)
**Author:** [@hokiegeek2](https://discuss.elastic.co/u/hokiegeek2)\ **Replies:** 1\ **Last updated:** [April 17, 2018, 10:46am UTC](https://discuss.elastic.co/t/es-5-6-4-offheap-memory-keeps-growing/126760 "2018-04-17T10:46:50Z")
Hi Everyone, Has anyone else encountered the issue of off-heap memory growing unbounded? I am running ES in Dockers on Marathon/Mesos and the off-heap memory keeps growing until Mesos kills the Docker. Any thoughts/adv… --- ## [Search data last occurrence](https://discuss.elastic.co/t/search-data-last-occurrence/128128)
**Author:** [@niraj\_pandey](https://discuss.elastic.co/u/niraj_pandey)\ **Replies:** 3\ **Last updated:** [April 17, 2018, 10:12am UTC](https://discuss.elastic.co/t/search-data-last-occurrence/128128 "2018-04-17T10:12:34Z")
Hi, I have a data on multiple indexes and want to search it's last occurrence. Could you please help me on this. Here is the scenario: I have following indexes: acct-2018-03-01 , acct-2018-03-02 , acct-2018-03-03 ...… --- ## [Discovery.zen.ping.unicast.hosts question](https://discuss.elastic.co/t/discovery-zen-ping-unicast-hosts-question/128324)
**Author:** [@dao](https://discuss.elastic.co/u/dao)\ **Replies:** 1\ **Last updated:** [April 17, 2018, 10:06am UTC](https://discuss.elastic.co/t/discovery-zen-ping-unicast-hosts-question/128324 "2018-04-17T10:06:58Z")
Hello, I am ready to add some nodes to my 1 node cluster. But to do so, I have to add the list of hosts to my discovery.zen.ping.unicast.hosts array. It is in the configuration file, that means I have to restart my node… --- ## [Bulk Rejection in Elasticsearch](https://discuss.elastic.co/t/bulk-rejection-in-elasticsearch/128319)
**Author:** [@rahulnama](https://discuss.elastic.co/u/rahulnama)\ **Replies:** 1\ **Last updated:** [April 17, 2018, 9:23am UTC](https://discuss.elastic.co/t/bulk-rejection-in-elasticsearch/128319 "2018-04-17T09:23:18Z")
Hello Team, I'm trying to index a 12mb log file which has 50,000 logs. After Indexign around 30,000 logs I'm getting the following error \[2018-04-17T05:52:48,254\]\[INFO \]\[logstash.outputs.elasticsearch\] retrying failed … --- ## [matchedQueries ordering in SearchHit](https://discuss.elastic.co/t/matchedqueries-ordering-in-searchhit/128315)
**Author:** [@NewHere](https://discuss.elastic.co/u/NewHere)\ **Replies:** 0\ **Last updated:** [April 17, 2018, 8:36am UTC](https://discuss.elastic.co/t/matchedqueries-ordering-in-searchhit/128315 "2018-04-17T08:36:36Z")
Hi I want to get the items in matchedQueries of SearchHit ordered by the boost score in each ConstantScoreQuery (which are the sub-queries of a DisMaxQuery), but it seems there is simply no ordering in it? What good ways… --- ## [Issue while Integrating elasticsearch with servicenow using plugin "Elasticsearch - Incident Enrichment Configuration"](https://discuss.elastic.co/t/issue-while-integrating-elasticsearch-with-servicenow-using-plugin-elasticsearch-incident-enrichment-configuration/128304)
**Author:** [@sarang](https://discuss.elastic.co/u/sarang)\ **Replies:** 2\ **Last updated:** [April 17, 2018, 7:56am UTC](https://discuss.elastic.co/t/issue-while-integrating-elasticsearch-with-servicenow-using-plugin-elasticsearch-incident-enrichment-configuration/128304 "2018-04-17T07:56:09Z")
I want to integrate Elasticsearch with Servicenow .I found a plugin called "Elasticsearch - Incident Enrichment" in servicenow Integration configuration. but while configuring the plugin ,it showing error that configu… --- ## [Max Bucket across multiple days](https://discuss.elastic.co/t/max-bucket-across-multiple-days/128300)
**Author:** [@ysl](https://discuss.elastic.co/u/ysl)\ **Replies:** 0\ **Last updated:** [April 17, 2018, 7:13am UTC](https://discuss.elastic.co/t/max-bucket-across-multiple-days/128300 "2018-04-17T07:13:14Z")
How to get the hour with the highest value for each day instead of highest value across multiple day? In the below script the returned result is the max bucket of 1 hour interval across days. I would like to have each s… --- ## [Case Insensitive Search/Sort by Keyword field](https://discuss.elastic.co/t/case-insensitive-search-sort-by-keyword-field/128260)
**Author:** [@Xiaoping](https://discuss.elastic.co/u/Xiaoping)\ **Replies:** 2\ **Last updated:** [April 17, 2018, 6:42am UTC](https://discuss.elastic.co/t/case-insensitive-search-sort-by-keyword-field/128260 "2018-04-17T06:42:44Z")
We have a use case to support case insensitive sort on certain fields of keyword type. It seems the general practice is to use normalizer on keyword fields. However, a coworker is concerned that, per ElasticSearch online… --- ## [Hdfs repository illegal argument exception](https://discuss.elastic.co/t/hdfs-repository-illegal-argument-exception/126380)
**Author:** [@7518f42b92157eda0e44](https://discuss.elastic.co/u/7518f42b92157eda0e44)\ **Replies:** 2\ **Last updated:** [April 4, 2018, 2:09am UTC](https://discuss.elastic.co/t/hdfs-repository-illegal-argument-exception/126380 "2018-04-04T02:09:31Z")
Good morning. I want to use hdfs-repository. But it does not work well. My define the configuration "PUT \_snapshot/my\_hdfs\_repository { "type": "hdfs", "settings": { "uri": "hdfs://namenode:8020/", "path": "elast… --- ## [Elasticsearch data node sizing on Azure infrastructure](https://discuss.elastic.co/t/elasticsearch-data-node-sizing-on-azure-infrastructure/128288)
**Author:** [@Ali\_Nazemian](https://discuss.elastic.co/u/Ali_Nazemian)\ **Replies:** 0\ **Last updated:** [April 17, 2018, 5:54am UTC](https://discuss.elastic.co/t/elasticsearch-data-node-sizing-on-azure-infrastructure/128288 "2018-04-17T05:54:46Z")
Hi, To host Elasticsearch data nodes we have come with the following sizing for the start and we will be adding more data nodes based on the actual required capacity. Master nodes: 3xD12v2 (4vCores, 28 RAM) Coordinat… --- ## [Small values getting rounded to zero on scripted field](https://discuss.elastic.co/t/small-values-getting-rounded-to-zero-on-scripted-field/128287)
**Author:** [@DermotM](https://discuss.elastic.co/u/DermotM)\ **Replies:** 0\ **Last updated:** [April 17, 2018, 5:48am UTC](https://discuss.elastic.co/t/small-values-getting-rounded-to-zero-on-scripted-field/128287 "2018-04-17T05:48:05Z")
Hi folks, This one's got me stumped... I'm taking a really small value, and creating a scripted field to scale it, so that kibana can chart it nicely for me. But I'm losing precion somewhere and ending up with '0' instea… --- ## [How to mitigate "\[routing\] is missing for join field \[join\_field\]](https://discuss.elastic.co/t/how-to-mitigate-routing-is-missing-for-join-field-join-field/128145)
**Author:** [@modalikasi](https://discuss.elastic.co/u/modalikasi)\ **Replies:** 1\ **Last updated:** [April 17, 2018, 4:55am UTC](https://discuss.elastic.co/t/how-to-mitigate-routing-is-missing-for-join-field-join-field/128145 "2018-04-17T04:55:05Z")
Getting the following exception "\[routing\] is missing for join field \[join\_field\]" while reindexing data from 1.x to 6.x and 2.4 to 6.x. How to resolve this kind of issue. Actually we have 3 document types in that one is… --- ## [Index setting for blocks.read\_only\_allow\_delete keeps changing](https://discuss.elastic.co/t/index-setting-for-blocks-read-only-allow-delete-keeps-changing/128256)
**Author:** [@daved](https://discuss.elastic.co/u/daved)\ **Replies:** 1\ **Last updated:** [April 17, 2018, 2:15am UTC](https://discuss.elastic.co/t/index-setting-for-blocks-read-only-allow-delete-keeps-changing/128256 "2018-04-17T02:15:20Z")
Hi, I'm trying to delete and re-ingest a large amount of data. I set up a script to do this and things were going fine, deleting an old daily index and re-copying data to a file input folder until everything stopped. I … --- ## [Replica shards from initializing to started](https://discuss.elastic.co/t/replica-shards-from-initializing-to-started/128257)
**Author:** [@oraclept](https://discuss.elastic.co/u/oraclept)\ **Replies:** 0\ **Last updated:** [April 16, 2018, 10:26pm UTC](https://discuss.elastic.co/t/replica-shards-from-initializing-to-started/128257 "2018-04-16T22:26:24Z")
Hi - I am creating index and doing a bulk insert with no replica shards. After bulk operations are completed. I am increasing replica shards to 2. It took almost 5 min for replica shards to catch up with primary shard to… --- ## [Match All Query](https://discuss.elastic.co/t/match-all-query/128255)
**Author:** [@mc1392](https://discuss.elastic.co/u/mc1392)\ **Replies:** 1\ **Last updated:** [April 16, 2018, 9:36pm UTC](https://discuss.elastic.co/t/match-all-query/128255 "2018-04-16T21:36:38Z")
how can I get all documents in an index using java? Do I use the Match All Query or Scroll API? If Match All, what do I do after this? : MatchAllQueryBuilder queryBuilder = QueryBuilders.matchAllQuery(); How do I spe… --- ## [Parallel document processing across nodes?](https://discuss.elastic.co/t/parallel-document-processing-across-nodes/128215)
**Author:** [@sdeck51](https://discuss.elastic.co/u/sdeck51)\ **Replies:** 1\ **Last updated:** [April 16, 2018, 8:32pm UTC](https://discuss.elastic.co/t/parallel-document-processing-across-nodes/128215 "2018-04-16T20:32:38Z")
Hi, I've been playing around with making an elastic search plugin and have added a few endpoints to do things that es doesn't currently do like text summary. I was wondering if there was an interface/design pattern for … --- ## [Bulk API insertion failed](https://discuss.elastic.co/t/bulk-api-insertion-failed/128152)
**Author:** [@gvkiran007](https://discuss.elastic.co/u/gvkiran007)\ **Replies:** 1\ **Last updated:** [April 16, 2018, 8:26pm UTC](https://discuss.elastic.co/t/bulk-api-insertion-failed/128152 "2018-04-16T20:26:35Z")
Hi Team, Using .Net I am not able to do the bulk insert (bulk API call). I am using elastic search 1.72 version. I am getting following error: The operation has timed out ( for 100 documents) From last two days, I am … --- ## [Multipolygon query](https://discuss.elastic.co/t/multipolygon-query/128131)
**Author:** [@JanSp](https://discuss.elastic.co/u/JanSp)\ **Replies:** 1\ **Last updated:** [April 16, 2018, 8:23pm UTC](https://discuss.elastic.co/t/multipolygon-query/128131 "2018-04-16T20:23:15Z")
Hey guys, i want to make a query on a multipolygon array and dont know if it is possible. i have some tables where the coordinates stored as point and want to find all these document within a polygon or a multipolygon. … --- ## [Big data: Log analysis with ELK and Spark](https://discuss.elastic.co/t/big-data-log-analysis-with-elk-and-spark/128142)
**Author:** [@Malek\_Soltani](https://discuss.elastic.co/u/Malek_Soltani)\ **Replies:** 1\ **Last updated:** [April 16, 2018, 8:13pm UTC](https://discuss.elastic.co/t/big-data-log-analysis-with-elk-and-spark/128142 "2018-04-16T20:13:31Z")
Hi, I'm new to ELK stack and Big data. Now, i'm trying to build a one node Log Analytics tool based on ELK+Kafka+Spark Machine Learning. I'm trying to implement the lambda architecture with the following layers: Batch:… --- ## [Reading from ES with hive: How can I get the \_score value?](https://discuss.elastic.co/t/reading-from-es-with-hive-how-can-i-get-the-score-value/126558)
**Author:** [@limudonline](https://discuss.elastic.co/u/limudonline)\ **Replies:** 1\ **Last updated:** [April 16, 2018, 8:11pm UTC](https://discuss.elastic.co/t/reading-from-es-with-hive-how-can-i-get-the-score-value/126558 "2018-04-16T20:11:54Z")
Hi , I'm trying to read the \_score value from elastic through Hive (I need to store it in a Hive table for farther data investigation). I tried the following but the "\_score" field returns with null instead of its righ… --- ## [Field value type saved as URL](https://discuss.elastic.co/t/field-value-type-saved-as-url/128172)
**Author:** [@sancroth](https://discuss.elastic.co/u/sancroth)\ **Replies:** 2\ **Last updated:** [April 16, 2018, 7:39pm UTC](https://discuss.elastic.co/t/field-value-type-saved-as-url/128172 "2018-04-16T19:39:48Z")
Is it possible to save a fields value as a clickable URL value? What i want to accomplish is for a certain index that holds information coming from certain sites to have a "project" field, that comes from a translate fi… --- ## [Can't get size of array/list in watcher condition](https://discuss.elastic.co/t/cant-get-size-of-array-list-in-watcher-condition/128032)
**Author:** [@iamthealex](https://discuss.elastic.co/u/iamthealex)\ **Replies:** 3\ **Last updated:** [April 16, 2018, 7:29pm UTC](https://discuss.elastic.co/t/cant-get-size-of-array-list-in-watcher-condition/128032 "2018-04-16T19:29:42Z")
here is the result: "result": { "execution\_time": "2018-04-13T23:05:32.255Z", "execution\_duration": 179, "input": { "type": "search", "status": "success", "payload": { "\_shards": { "total… --- ## [Error about too many open files when allocating shard](https://discuss.elastic.co/t/error-about-too-many-open-files-when-allocating-shard/128055)
**Author:** [@Warren\_Turner](https://discuss.elastic.co/u/Warren_Turner)\ **Replies:** 5\ **Last updated:** [April 16, 2018, 6:11pm UTC](https://discuss.elastic.co/t/error-about-too-many-open-files-when-allocating-shard/128055 "2018-04-16T18:11:14Z")
I opened a closed index with 5 shards. All of the shards allocated fine except 1. When I check the logs I see an error about too many open files. \[WARN \]\[o.e.c.a.s.ShardStateAction\] \[bos1-es2\] \[px-web-server-2018.03.0… --- ## [Elasticsearch stop suddenly](https://discuss.elastic.co/t/elasticsearch-stop-suddenly/128233)
**Author:** [@Hanen](https://discuss.elastic.co/u/Hanen)\ **Replies:** 1\ **Last updated:** [April 16, 2018, 5:46pm UTC](https://discuss.elastic.co/t/elasticsearch-stop-suddenly/128233 "2018-04-16T17:46:01Z")
Hi guys, Our cluster has 7 data nodes. Sometimes one of them was turned off (Elasticsearch service sudden stopped). how can I solve the issue.? And How can I minimize the number of shards because I noticed that the num… --- ## [Trying to load data using Rally into Elastic Search](https://discuss.elastic.co/t/trying-to-load-data-using-rally-into-elastic-search/127875)
**Author:** [@sarba](https://discuss.elastic.co/u/sarba)\ **Replies:** 6\ **Last updated:** [April 16, 2018, 5:41pm UTC](https://discuss.elastic.co/t/trying-to-load-data-using-rally-into-elastic-search/127875 "2018-04-16T17:41:32Z")
Trying to load data using rally into Elastic Search and facing this issue: root@esdb01-cqs01:~/.rally/benchmarks/tracks/default/contactdata# esrally --track=contactdata --target-hosts=esdb01-cqs01.db.us-west-1a.stg1.ebs… --- ## [Getting index status from monitoring data index .monitoring-es-\*](https://discuss.elastic.co/t/getting-index-status-from-monitoring-data-index-monitoring-es/128024)
**Author:** [@Karthik\_Ramachandran](https://discuss.elastic.co/u/Karthik_Ramachandran)\ **Replies:** 1\ **Last updated:** [April 16, 2018, 4:23pm UTC](https://discuss.elastic.co/t/getting-index-status-from-monitoring-data-index-monitoring-es/128024 "2018-04-16T16:23:39Z")
I'm trying to get an output of all the indices that are not in green state from monitoring data, but not able to using elastic queries. Tried standard filters/must and also script. Below is the observation index\_stats.s… --- ## [Error at startup:Transport SSL must be enabled for setups with production licenses. Please set \[xpack.security.transport.ssl.enabled\] to \[true\] or disable security by setting \[xpack.security.enabled\] to \[false\]](https://discuss.elastic.co/t/error-at-startup-transport-ssl-must-be-enabled-for-setups-with-production-licenses-please-set-xpack-security-transport-ssl-enabled-to-true-or-disable-security-by-setting-xpack-security-enabled-to-false/128208)
**Author:** [@Diadems](https://discuss.elastic.co/u/Diadems)\ **Replies:** 6\ **Last updated:** [April 16, 2018, 4:02pm UTC](https://discuss.elastic.co/t/error-at-startup-transport-ssl-must-be-enabled-for-setups-with-production-licenses-please-set-xpack-security-transport-ssl-enabled-to-true-or-disable-security-by-setting-xpack-security-enabled-to-false/128208 "2018-04-16T16:02:48Z")
I already checked a similar thread that was closed with the link to the configuration page for TLS. I have already checked that and modified my config several times to test which one works.. but it does not seems to. I… --- ## [Shared fs backup repository credentials](https://discuss.elastic.co/t/shared-fs-backup-repository-credentials/128031)
**Author:** [@alca](https://discuss.elastic.co/u/alca)\ **Replies:** 3\ **Last updated:** [April 16, 2018, 3:54pm UTC](https://discuss.elastic.co/t/shared-fs-backup-repository-credentials/128031 "2018-04-16T15:54:09Z")
Hi there, I have read through the documentation for snapshot and restore, but have encountered the following error when I have my path.repo pointing to "\\\\SERVER\\share" or even to a mapped drive ("U:\\backups") in my ela… --- ## [Setting up Watches](https://discuss.elastic.co/t/setting-up-watches/128218)
**Author:** [@volksman](https://discuss.elastic.co/u/volksman)\ **Replies:** 2\ **Last updated:** [April 16, 2018, 3:26pm UTC](https://discuss.elastic.co/t/setting-up-watches/128218 "2018-04-16T15:26:36Z")
Hello! I'm fairly new to the stack but I have an ELK system setup and consuming logs from a production webserver. I'd like to setup some Watches. When I go to setup a Watch it asks for a name and index, so I provide a… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1716) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1718)