# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1724 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1725 --- ## [Elasticsearch container doesn't start after ingest-geo-ip](https://discuss.elastic.co/t/elasticsearch-container-doesnt-start-after-ingest-geo-ip/127321)
**Author:** [@AJ\_NOURI](https://discuss.elastic.co/u/AJ_NOURI)\ **Replies:** 2\ **Last updated:** [April 10, 2018, 8:16am UTC](https://discuss.elastic.co/t/elasticsearch-container-doesnt-start-after-ingest-geo-ip/127321 "2018-04-10T08:16:28Z")
I am starting with ELK and following the official doc on how to use filebeat with modules: https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-modules-quickstart.html I am using separate containers for Elas… --- ## [Snapshot & Minio](https://discuss.elastic.co/t/snapshot-minio/125075)
**Author:** [@bitva77](https://discuss.elastic.co/u/bitva77)\ **Replies:** 3\ **Last updated:** [April 10, 2018, 8:03am UTC](https://discuss.elastic.co/t/snapshot-minio/125075 "2018-04-10T08:03:49Z")
Hi! Is it possible to change the S3 URL to be something custom? Like a Minio server, for example. I tried setting s3.client.default.endpoint to our internal Minio server yet ES is still trying to hit AWS. I'm POST'i… --- ## [Unable to create visualization using curl command in elaticearch](https://discuss.elastic.co/t/unable-to-create-visualization-using-curl-command-in-elaticearch/127436)
**Author:** [@Piyushpky](https://discuss.elastic.co/u/Piyushpky)\ **Replies:** 1\ **Last updated:** [April 10, 2018, 7:54am UTC](https://discuss.elastic.co/t/unable-to-create-visualization-using-curl-command-in-elaticearch/127436 "2018-04-10T07:54:48Z")
I am trying to create visualization using curl command. I am using elasticsearch 6.2.3. I am able to create the same in elasticsearch 5.6.8. I am using this command curl -XPUT http://localhost:9200/.kibana/visualization… --- ## [How to reduce indices space?](https://discuss.elastic.co/t/how-to-reduce-indices-space/126198)
**Author:** [@trelo](https://discuss.elastic.co/u/trelo)\ **Replies:** 1\ **Last updated:** [April 9, 2018, 7:47am UTC](https://discuss.elastic.co/t/how-to-reduce-indices-space/126198 "2018-04-09T07:47:18Z")
Hello, recently I've upgraded my ELK from 5.6 to 6.2(and logstash's mapping templates too). And now I've noticed that new indices almost twice bigger than old indices with same amount of documents inside. Here's l… --- ## [Delete by query is not deleting all the docs and still index doc count shows same](https://discuss.elastic.co/t/delete-by-query-is-not-deleting-all-the-docs-and-still-index-doc-count-shows-same/127277)
**Author:** [@kish](https://discuss.elastic.co/u/kish)\ **Replies:** 13\ **Last updated:** [April 10, 2018, 7:27am UTC](https://discuss.elastic.co/t/delete-by-query-is-not-deleting-all-the-docs-and-still-index-doc-count-shows-same/127277 "2018-04-10T07:27:46Z")
I tried to delete the 2000 docs of particular index. It got deleted but when i try to list then i am able to see the docs count unchanged.. root@kishan\> curl -XPOST 'localhost:9200/cscfcounter/cscfcounter/\_delete\_by\_que… --- ## [Elasticsearch must\_not bool query is not working](https://discuss.elastic.co/t/elasticsearch-must-not-bool-query-is-not-working/127397)
**Author:** [@adf4st](https://discuss.elastic.co/u/adf4st)\ **Replies:** 1\ **Last updated:** [April 10, 2018, 7:27am UTC](https://discuss.elastic.co/t/elasticsearch-must-not-bool-query-is-not-working/127397 "2018-04-10T07:27:18Z")
I have a bool query with a filter and a must\_not clause. But when I execute the query I get results that contain the values specified in the must\_not clause. Any idea what I'm doing wrong? Query POST /test/\_search { … --- ## [Elasticsearch custom date field issue](https://discuss.elastic.co/t/elasticsearch-custom-date-field-issue/127318)
**Author:** [@zxq209](https://discuss.elastic.co/u/zxq209)\ **Replies:** 3\ **Last updated:** [April 10, 2018, 7:24am UTC](https://discuss.elastic.co/t/elasticsearch-custom-date-field-issue/127318 "2018-04-10T07:24:06Z")
elasticsearch 6.2 logstash 6.2 filebeat 6.2 logstash conf if \[type\] == "s-response"{ elasticsearch { hosts =\> \["192.168.4.56:9200","192.168.15.145:9200","192.168.15.41:9200"\] index =\> "s-response-%{+Y… --- ## [Cost of Licence for X-Pack](https://discuss.elastic.co/t/cost-of-licence-for-x-pack/127426)
**Author:** [@amitmjadav](https://discuss.elastic.co/u/amitmjadav)\ **Replies:** 1\ **Last updated:** [April 10, 2018, 7:13am UTC](https://discuss.elastic.co/t/cost-of-licence-for-x-pack/127426 "2018-04-10T07:13:25Z")
Hi .. I want the licence of X-Pack plugin ..... I am running 2 cluster in my production environment. One of having 5 node and another having 3 node. So can any one suggest me the procedure and approximate cost of x-p… --- ## [Elasticsearch Search return blank results](https://discuss.elastic.co/t/elasticsearch-search-return-blank-results/127311)
**Author:** [@bruce88](https://discuss.elastic.co/u/bruce88)\ **Replies:** 2\ **Last updated:** [April 10, 2018, 6:57am UTC](https://discuss.elastic.co/t/elasticsearch-search-return-blank-results/127311 "2018-04-10T06:57:27Z")
I have an index with 1.9 billion data. When I try to do a search, it always return a blank result which is "". But the HTTP status code is 200. Then I just don't know what happens. Did anyone ever have this problem? Or … --- ## [Spark Connector performance issue \[thread contd\]](https://discuss.elastic.co/t/spark-connector-performance-issue-thread-contd/124725)
**Author:** [@waleed\_ali](https://discuss.elastic.co/u/waleed_ali)\ **Replies:** 2\ **Last updated:** [April 10, 2018, 6:50am UTC](https://discuss.elastic.co/t/spark-connector-performance-issue-thread-contd/124725 "2018-04-10T06:50:41Z")
Hello. I seem to have hit a problem in which Spark writing to Elasticsearch is very slow and it takes quite a lot of time (around 15 mins) in making the initial connection, during which both Spark and Elasticsearch rema… --- ## [List all matching shingles](https://discuss.elastic.co/t/list-all-matching-shingles/127421)
**Author:** [@nicolagambini](https://discuss.elastic.co/u/nicolagambini)\ **Replies:** 0\ **Last updated:** [April 10, 2018, 6:35am UTC](https://discuss.elastic.co/t/list-all-matching-shingles/127421 "2018-04-10T06:35:13Z")
Hello everybody, I have an index whose settings look something like this "settings" : { "index" : { ... "analysis" : { "filter" : { "suggestion\_shingle" : { "max\_shingle\_size" : "5", "min\_shingle\_… --- ## [How to aggregate similar type of data in same bucket?](https://discuss.elastic.co/t/how-to-aggregate-similar-type-of-data-in-same-bucket/127417)
**Author:** [@iamrajatroy](https://discuss.elastic.co/u/iamrajatroy)\ **Replies:** 0\ **Last updated:** [April 10, 2018, 5:38am UTC](https://discuss.elastic.co/t/how-to-aggregate-similar-type-of-data-in-same-bucket/127417 "2018-04-10T05:38:46Z")
i have some data in a field for ex - 1- xyz is not searchable 2- unable to search xyz 3- xyz not searchable currently all go in 3 different bucket. but i want it to put it on same bucket due to max occurence of the w… --- ## [Potential Feature Loss: 2.X to 5.X: Percolate does not create copy\_to fields?](https://discuss.elastic.co/t/potential-feature-loss-2-x-to-5-x-percolate-does-not-create-copy-to-fields/126611)
**Author:** [@Jon-DeWitt](https://discuss.elastic.co/u/Jon-DeWitt)\ **Replies:** 1\ **Last updated:** [April 10, 2018, 4:23am UTC](https://discuss.elastic.co/t/potential-feature-loss-2-x-to-5-x-percolate-does-not-create-copy-to-fields/126611 "2018-04-10T04:23:18Z")
We use percolate heavily in our current ES 2.3.3 cluster, trying to configure an identical setup with 5.6.7 currently has us a little confused. We previously have some registered percolate queries that make use of \_all,… --- ## [Node thread pool \[search.queue\] height](https://discuss.elastic.co/t/node-thread-pool-search-queue-height/127406)
**Author:** [@laotoumo](https://discuss.elastic.co/u/laotoumo)\ **Replies:** 0\ **Last updated:** [April 10, 2018, 2:17am UTC](https://discuss.elastic.co/t/node-thread-pool-search-queue-height/127406 "2018-04-10T02:17:50Z")
i have 4 nodes, the server configuration is the same, the node data is the same, there is always 1 node thread pool search.queue height. I hope to get your help，thank you！ 4 nodes config master:true data:true "search… --- ## [CORS and other settings with AWS ES](https://discuss.elastic.co/t/cors-and-other-settings-with-aws-es/127145)
**Author:** [@Jackson\_Pollock](https://discuss.elastic.co/u/Jackson_Pollock)\ **Replies:** 3\ **Last updated:** [April 10, 2018, 12:41am UTC](https://discuss.elastic.co/t/cors-and-other-settings-with-aws-es/127145 "2018-04-10T00:41:12Z")
In my local elasticsearch.yml I am able to set: http.cors.enabled : true http.cors.allow-origin : "\*" http.cors.allow-methods : OPTIONS, HEAD, GET, POST, PUT, DELETE http.cors.allow-headers : X-Requested-With,X-Auth-… --- ## [SAML Authentication in Elastic Stack with ADFS](https://discuss.elastic.co/t/saml-authentication-in-elastic-stack-with-adfs/121766)
**Author:** [@tatdat](https://discuss.elastic.co/u/tatdat)\ **Replies:** 3\ **Last updated:** [April 9, 2018, 9:51pm UTC](https://discuss.elastic.co/t/saml-authentication-in-elastic-stack-with-adfs/121766 "2018-04-09T21:51:45Z")
I saw this blog. They said about saml authentication in Elastick stack https://www.elastic.co/blog/how-to-enable-saml-authentication-in-kibana-and-elasticsearch Im testing on it. Can we use ADFS with Elastic Stack? T… --- ## [What is the maximum value allowed for an NGram max\_gram size?](https://discuss.elastic.co/t/what-is-the-maximum-value-allowed-for-an-ngram-max-gram-size/127378)
**Author:** [@totessusan](https://discuss.elastic.co/u/totessusan)\ **Replies:** 0\ **Last updated:** [April 9, 2018, 7:52pm UTC](https://discuss.elastic.co/t/what-is-the-maximum-value-allowed-for-an-ngram-max-gram-size/127378 "2018-04-09T19:52:43Z")
I know it wouldn't be all that useful, I'd still like to know for reference what the maximum value is allowed for an NGram max\_gram size. Is there a cap? Thanks! --- ## [Delete by Query - Is there a way to get the ids of the deleted documents?](https://discuss.elastic.co/t/delete-by-query-is-there-a-way-to-get-the-ids-of-the-deleted-documents/127385)
**Author:** [@hk4](https://discuss.elastic.co/u/hk4)\ **Replies:** 1\ **Last updated:** [April 9, 2018, 9:02pm UTC](https://discuss.elastic.co/t/delete-by-query-is-there-a-way-to-get-the-ids-of-the-deleted-documents/127385 "2018-04-09T21:02:00Z")
I am using the Delete by Query API to delete documents from an index. In the response, I can only see the number of documents that have been deleted. How can I get the ids of the documents that were deleted? Using Elast… --- ## [Visualizing Cassandra data using Kibana](https://discuss.elastic.co/t/visualizing-cassandra-data-using-kibana/127243)
**Author:** [@Soheil\_Pourbafrani](https://discuss.elastic.co/u/Soheil_Pourbafrani)\ **Replies:** 1\ **Last updated:** [April 9, 2018, 7:53pm UTC](https://discuss.elastic.co/t/visualizing-cassandra-data-using-kibana/127243 "2018-04-09T19:53:02Z")
I have a multinode apache Cassandra, full of data and I want to visualize the data using Kibana. What is the best way for such situation? I've read about Elassandra, but I couldn't understand Elassandra is a plugin that … --- ## [Aggregation: find time-window with the maximum documents](https://discuss.elastic.co/t/aggregation-find-time-window-with-the-maximum-documents/126742)
**Author:** [@ebuildy](https://discuss.elastic.co/u/ebuildy)\ **Replies:** 6\ **Last updated:** [April 9, 2018, 6:07pm UTC](https://discuss.elastic.co/t/aggregation-find-time-window-with-the-maximum-documents/126742 "2018-04-09T18:07:38Z")
Given a time-serie of events, by day, I want to know the "hour:minute" which has the maximum of documents. Ex. document: { "date" : "...", "event" : "search" } I have tried to follow https://www.elastic.co/blog/impleme… --- ## [Wait\_for\_active\_shards parameter](https://discuss.elastic.co/t/wait-for-active-shards-parameter/127281)
**Author:** [@Roman\_GR](https://discuss.elastic.co/u/Roman_GR)\ **Replies:** 2\ **Last updated:** [April 9, 2018, 6:36pm UTC](https://discuss.elastic.co/t/wait-for-active-shards-parameter/127281 "2018-04-09T18:36:43Z")
Documentation says this param should have only positive integer values, but request doesn't fail when I send 0 as a value. Does it mean that it will not wait even for primary shard or the param will be ignored? --- ## [Why multi-index queries are so slow? And how to troubleshoot?](https://discuss.elastic.co/t/why-multi-index-queries-are-so-slow-and-how-to-troubleshoot/125282)
**Author:** [@alexu](https://discuss.elastic.co/u/alexu)\ **Replies:** 9\ **Last updated:** [April 9, 2018, 6:35pm UTC](https://discuss.elastic.co/t/why-multi-index-queries-are-so-slow-and-how-to-troubleshoot/125282 "2018-04-09T18:35:45Z")
Elasticsearch 5.6.4 on centos We recently noticed that multi-index queries against our production Logshash database became very slow (5-10+ seconds). After some investigation the problem looks pretty weird OBSERVATIONS… --- ## ['took' field on the ES response](https://discuss.elastic.co/t/took-field-on-the-es-response/127147)
**Author:** [@yiliang](https://discuss.elastic.co/u/yiliang)\ **Replies:** 2\ **Last updated:** [April 9, 2018, 6:31pm UTC](https://discuss.elastic.co/t/took-field-on-the-es-response/127147 "2018-04-09T18:31:12Z")
Hi, I have a question on the 'took' filed from ES response. I run a profile request to one specific index And get following response(partial). { "took": 944, "timed\_out": false, "\_shards": { "total": 5, "successfu… --- ## [Investigating query slowness](https://discuss.elastic.co/t/investigating-query-slowness/127366)
**Author:** [@dimalini](https://discuss.elastic.co/u/dimalini)\ **Replies:** 0\ **Last updated:** [April 9, 2018, 6:25pm UTC](https://discuss.elastic.co/t/investigating-query-slowness/127366 "2018-04-09T18:25:19Z")
We have 2 main fields\[F1, F2\] in our mapping, which holds the same tokens. For instance - F1- Every token in F1 holds some payload information in addition to the terms and its offsets. F2 - This has mostly the same t… --- ## [Connect Hive to Elasticsearch 6.2.3](https://discuss.elastic.co/t/connect-hive-to-elasticsearch-6-2-3/126982)
**Author:** [@MARRAKCHI\_Tarik](https://discuss.elastic.co/u/MARRAKCHI_Tarik)\ **Replies:** 2\ **Last updated:** [April 9, 2018, 6:20pm UTC](https://discuss.elastic.co/t/connect-hive-to-elasticsearch-6-2-3/126982 "2018-04-09T18:20:08Z")
HI, I use Hortonworks and I created a single-node cluster, I installed elasticsearch and kibana (6.2.3). I downloaded the jar file elasticsearch-hadoop-6.2.3.jar and added it in hive-site.xml file with the property nam… --- ## [Empty Slices with Scan/Scroll](https://discuss.elastic.co/t/empty-slices-with-scan-scroll/127255)
**Author:** [@bevans88](https://discuss.elastic.co/u/bevans88)\ **Replies:** 1\ **Last updated:** [April 9, 2018, 6:15pm UTC](https://discuss.elastic.co/t/empty-slices-with-scan-scroll/127255 "2018-04-09T18:15:35Z")
Hi, We're currently using Spark with es-hadoop to read 1 million documents from an Elasticsearch index. The sliced scan scroll that it is using internally is not evenly distributing the results across the slices; in fac… --- ## [Hardware for ELK](https://discuss.elastic.co/t/hardware-for-elk/126277)
**Author:** [@Mahroon](https://discuss.elastic.co/u/Mahroon)\ **Replies:** 7\ **Last updated:** [April 9, 2018, 6:05pm UTC](https://discuss.elastic.co/t/hardware-for-elk/126277 "2018-04-09T18:05:10Z")
Hi ES Experts, I am new to Elasticsearch and have following use case to please suggest me to the right direction. Daily Data volume :- 400+ TB Daily. How many node, cluster, index, shards and replicas do I need. Addit… --- ## [Get delta on thread\_pool completed](https://discuss.elastic.co/t/get-delta-on-thread-pool-completed/127361)
**Author:** [@rmsys](https://discuss.elastic.co/u/rmsys)\ **Replies:** 0\ **Last updated:** [April 9, 2018, 5:10pm UTC](https://discuss.elastic.co/t/get-delta-on-thread-pool-completed/127361 "2018-04-09T17:10:18Z")
Hi! In ELS I get the values from thread using: /\_cat/thread\_pool/generic?v&h=id,name,active,rejected,completed,queue But the values from "completed" are acumulatives (from started the node). There are any way to get … --- ## [Total Limits of Users and Roles while using X-Pack Plugin?](https://discuss.elastic.co/t/total-limits-of-users-and-roles-while-using-x-pack-plugin/127066)
**Author:** [@amitmjadav](https://discuss.elastic.co/u/amitmjadav)\ **Replies:** 2\ **Last updated:** [April 9, 2018, 5:11pm UTC](https://discuss.elastic.co/t/total-limits-of-users-and-roles-while-using-x-pack-plugin/127066 "2018-04-09T17:11:34Z")
Hi, Can any one let me know Wile using X-pack plugin with elasticsearch 1:How many roles can be created.Is there any limit to create roles? 2:Can a user have multiple roles? 3:How many users can be created.IS there a… --- ## [CircuitBreakingException causes nodes to leave the cluster](https://discuss.elastic.co/t/circuitbreakingexception-causes-nodes-to-leave-the-cluster/127357)
**Author:** [@IngaFeick](https://discuss.elastic.co/u/IngaFeick)\ **Replies:** 0\ **Last updated:** [April 9, 2018, 4:50pm UTC](https://discuss.elastic.co/t/circuitbreakingexception-causes-nodes-to-leave-the-cluster/127357 "2018-04-09T16:50:25Z")
Hi there! We recently upgraded our elasticsearch to 6.2.3 and have since occasionally run into a circuit breaker, which seems to take some or all data nodes out of our cluster. Error message: org.elasticsearch.transpor… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1723) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1725)