# Elasticsearch

**URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1746

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 1747

---

## [Restore elastic search from backup](https://discuss.elastic.co/t/restore-elastic-search-from-backup/124885)

<div class="topic-metadata">

**Author:** [@ak\_bharath](https://discuss.elastic.co/u/ak_bharath)\
**Replies:** 0\
**Last updated:** [March 21, 2018, 1:28am UTC](https://discuss.elastic.co/t/restore-elastic-search-from-backup/124885 "2018-03-21T01:28:17Z")

</div>

Hi There, I want to restore indexes from elasticsearch backup on a windows machine. copied the zip file(es\_20170911) to a folder es\_backup and extracted it so the path is c:\\backup\\es\_backup\\es\_20170911 Step I had do…

---

## [Approx top count in ElasticSearch](https://discuss.elastic.co/t/approx-top-count-in-elasticsearch/124879)

<div class="topic-metadata">

**Author:** [@premieredigital](https://discuss.elastic.co/u/premieredigital)\
**Replies:** 0\
**Last updated:** [March 21, 2018, 12:06am UTC](https://discuss.elastic.co/t/approx-top-count-in-elasticsearch/124879 "2018-03-21T00:06:45Z")

</div>

I am using BigQuery to get the top ten values for a query with this syntax: SELECT APPROX\_TOP\_COUNT(first\_name, 10), APPROX\_TOP\_COUNT(last\_name, 10) FROM \<my query\> The result allows me to make something li…

---

## [Elasticsearch still writing to same index even After index rollover](https://discuss.elastic.co/t/elasticsearch-still-writing-to-same-index-even-after-index-rollover/124844)

<div class="topic-metadata">

**Author:** [@chandukreddi](https://discuss.elastic.co/u/chandukreddi)\
**Replies:** 6\
**Last updated:** [March 20, 2018, 9:36pm UTC](https://discuss.elastic.co/t/elasticsearch-still-writing-to-same-index-even-after-index-rollover/124844 "2018-03-20T21:36:32Z")

</div>

Hello Experts, I am writing data into elastic search using logstash(see below) and using index template to enable some settings and aliases. Logstash output: output { elasticsearch { hosts =\> "10.1.27.6:9200" index…

---

## [How to sort on '\_explanation' from query search](https://discuss.elastic.co/t/how-to-sort-on-explanation-from-query-search/124350)

<div class="topic-metadata">

**Author:** [@JustinChavez](https://discuss.elastic.co/u/JustinChavez)\
**Replies:** 0\
**Last updated:** [March 16, 2018, 6:20pm UTC](https://discuss.elastic.co/t/how-to-sort-on-explanation-from-query-search/124350 "2018-03-16T18:20:33Z")

</div>

I am trying to sort on the '\_explanation' field returned from my search query. Elasticsearch is not finding the field and is sorting on infinity instead. I was wondering if there is a solution for this? results = es.sea…

---

## [Elastic Search 6 returns duplicates](https://discuss.elastic.co/t/elastic-search-6-returns-duplicates/124864)

<div class="topic-metadata">

**Author:** [@popina](https://discuss.elastic.co/u/popina)\
**Replies:** 1\
**Last updated:** [March 20, 2018, 8:50pm UTC](https://discuss.elastic.co/t/elastic-search-6-returns-duplicates/124864 "2018-03-20T20:50:22Z")

</div>

No matter what I set for scroll\_from I always get duplicated values. page = es.search(index = index, scroll = scroll\_exp, sort = "doc", from = scroll\_from, body = body) Any ideas why is this happening? And why doesn'…

---

## [How to use S3 Plugin with a Keystore](https://discuss.elastic.co/t/how-to-use-s3-plugin-with-a-keystore/122613)

<div class="topic-metadata">

**Author:** [@rhugga](https://discuss.elastic.co/u/rhugga)\
**Replies:** 3\
**Last updated:** [March 20, 2018, 8:22pm UTC](https://discuss.elastic.co/t/how-to-use-s3-plugin-with-a-keystore/122613 "2018-03-20T20:22:56Z")

</div>

I'm trying to configure the S3 plugin to use a non-AWS S3 storage platform with access credentials stored in a keystore. I can't seem to find where or how you reference the keystore and key names. Thx

---

## [Elasticsearch for Apache Hadoop 6.2.3 and 6.1.4 released](https://discuss.elastic.co/t/elasticsearch-for-apache-hadoop-6-2-3-and-6-1-4-released/124858)

<div class="topic-metadata">

**Author:** [@james.baiera](https://discuss.elastic.co/u/james.baiera)\
**Replies:** 0\
**Last updated:** [March 20, 2018, 8:18pm UTC](https://discuss.elastic.co/t/elasticsearch-for-apache-hadoop-6-2-3-and-6-1-4-released/124858 "2018-03-20T20:18:26Z")

</div>

I am proud to announce that ES-Hadoop 6.2.0 and 6.1.4 have been released! ES-Hadoop 6.2.3 is a compatibility release tested specifically against the latest Elasticsearch 6.2.3. You can read more about these releases he…

---

## [Using Painless in the filter potion of my search (limiting results by a recurring field in the document being greater then an average)](https://discuss.elastic.co/t/using-painless-in-the-filter-potion-of-my-search-limiting-results-by-a-recurring-field-in-the-document-being-greater-then-an-average/124302)

<div class="topic-metadata">

**Author:** [@MPurcell](https://discuss.elastic.co/u/MPurcell)\
**Replies:** 3\
**Last updated:** [March 20, 2018, 7:28pm UTC](https://discuss.elastic.co/t/using-painless-in-the-filter-potion-of-my-search-limiting-results-by-a-recurring-field-in-the-document-being-greater-then-an-average/124302 "2018-03-20T19:28:56Z")

</div>

Hello, I have an interesting search problem, and my hope is that maybe someone here has encountered something similar. First a bit of background: I'm currently writing query DSL to search old phone books that are loaded …

---

## [Is there a way for multiple clusters to share the same index?](https://discuss.elastic.co/t/is-there-a-way-for-multiple-clusters-to-share-the-same-index/124841)

<div class="topic-metadata">

**Author:** [@vicodark](https://discuss.elastic.co/u/vicodark)\
**Replies:** 5\
**Last updated:** [March 20, 2018, 7:06pm UTC](https://discuss.elastic.co/t/is-there-a-way-for-multiple-clusters-to-share-the-same-index/124841 "2018-03-20T19:06:38Z")

</div>

I have a rather large index that I would not like to duplicate that I need to be able to search from 2 different clusters. Does Elastic support this in any way?

---

## [Setting up cluster with client, master & data node](https://discuss.elastic.co/t/setting-up-cluster-with-client-master-data-node/124723)

<div class="topic-metadata">

**Author:** [@subhraakanil](https://discuss.elastic.co/u/subhraakanil)\
**Replies:** 5\
**Last updated:** [March 20, 2018, 7:00pm UTC](https://discuss.elastic.co/t/setting-up-cluster-with-client-master-data-node/124723 "2018-03-20T19:00:28Z")

</div>

Hi Team, We are making POC on elasticsearch so that we can use it in future.Though, I am newbie in elasticsearch. We have three CentOs boxes and our requirement is to set up a cluster containing client, master & data n…

---

## [How do I use a Condition to Match Against a Value in a Loop from ctx.payload](https://discuss.elastic.co/t/how-do-i-use-a-condition-to-match-against-a-value-in-a-loop-from-ctx-payload/122910)

<div class="topic-metadata">

**Author:** [@dmdm](https://discuss.elastic.co/u/dmdm)\
**Replies:** 3\
**Last updated:** [March 20, 2018, 6:39pm UTC](https://discuss.elastic.co/t/how-do-i-use-a-condition-to-match-against-a-value-in-a-loop-from-ctx-payload/122910 "2018-03-20T18:39:57Z")

</div>

On the bottom of this example, in the actions section, I sort through all the snapshots in an S3 bucket, end goal is to send an alert to victorops if I have a failed snapshot. I finally figured out how to write out ever…

---

## [Any open source tools to index and search Windows File Server by using ElasticSearch](https://discuss.elastic.co/t/any-open-source-tools-to-index-and-search-windows-file-server-by-using-elasticsearch/124615)

<div class="topic-metadata">

**Author:** [@fengfly](https://discuss.elastic.co/u/fengfly)\
**Replies:** 4\
**Last updated:** [March 20, 2018, 6:30pm UTC](https://discuss.elastic.co/t/any-open-source-tools-to-index-and-search-windows-file-server-by-using-elasticsearch/124615 "2018-03-20T18:30:23Z")

</div>

Hello Expert, after some internet search, the best I found it this link: https://github.com/dadoonet/fscrawler. However from its own description, it is only for local file systems on Windows, It would be really appreci…

---

## [Error while using Java High Level Rest Client](https://discuss.elastic.co/t/error-while-using-java-high-level-rest-client/124436)

<div class="topic-metadata">

**Author:** [@navneet35](https://discuss.elastic.co/u/navneet35)\
**Replies:** 7\
**Last updated:** [March 20, 2018, 6:15pm UTC](https://discuss.elastic.co/t/error-while-using-java-high-level-rest-client/124436 "2018-03-20T18:15:16Z")

</div>

Hi, I am trying to develop a spring boot based elasticsearch project and I am trying to use Java High Level Rest Client in the same. I am initializing the client like this: RestHighLevelClient client = new RestHighLe…

---

## [DeleteIndexRequest in 6.0.1 version](https://discuss.elastic.co/t/deleteindexrequest-in-6-0-1-version/124829)

<div class="topic-metadata">

**Author:** [@Pushpak\_Chavan](https://discuss.elastic.co/u/Pushpak_Chavan)\
**Replies:** 1\
**Last updated:** [March 20, 2018, 6:05pm UTC](https://discuss.elastic.co/t/deleteindexrequest-in-6-0-1-version/124829 "2018-03-20T18:05:00Z")

</div>

Hi I am using 6.0.1 version of elastic search. Can someone help me for deleting index using java api. 6.0.1 version doesn't have below line of code DeleteIndexResponse deleteIndexResponse = client.indices().delete(dele…

---

## [Upgrade Assistant Reindex Helper leaves old indices undeleted, can I test if operation is complete?](https://discuss.elastic.co/t/upgrade-assistant-reindex-helper-leaves-old-indices-undeleted-can-i-test-if-operation-is-complete/122561)

<div class="topic-metadata">

**Author:** [@daved](https://discuss.elastic.co/u/daved)\
**Replies:** 5\
**Last updated:** [March 20, 2018, 6:01pm UTC](https://discuss.elastic.co/t/upgrade-assistant-reindex-helper-leaves-old-indices-undeleted-can-i-test-if-operation-is-complete/122561 "2018-03-20T18:01:17Z")

</div>

Hi, I've been using the Upgrade Assistant in 5.x to reindex indices from 2.x. I'm noticing that some of them didn't complete the process and when I click on the reindex button I get the following message: Index foo-re…

---

## [ML Datafeed lookback retrieved no data](https://discuss.elastic.co/t/ml-datafeed-lookback-retrieved-no-data/124318)

<div class="topic-metadata">

**Author:** [@t.d.garland100](https://discuss.elastic.co/u/t.d.garland100)\
**Replies:** 9\
**Last updated:** [March 20, 2018, 5:34pm UTC](https://discuss.elastic.co/t/ml-datafeed-lookback-retrieved-no-data/124318 "2018-03-20T17:34:24Z")

</div>

I am following the use case for Machine Learning for Elastic Stack found at the link below: Suspicious Login Activity My setup: Ubuntu 16.04, Elastic Stack 5.6.8 (Elasticsearch, Logstash, Kibana, Filebeats X-Pack) I …

---

## [Loading documents in index with mappings defined](https://discuss.elastic.co/t/loading-documents-in-index-with-mappings-defined/124826)

<div class="topic-metadata">

**Author:** [@Manjit](https://discuss.elastic.co/u/Manjit)\
**Replies:** 1\
**Last updated:** [March 20, 2018, 5:27pm UTC](https://discuss.elastic.co/t/loading-documents-in-index-with-mappings-defined/124826 "2018-03-20T17:27:25Z")

</div>

I have about 500K documents, few hundred per day. I am using C# to read these from sql server and generate json for all records for given day and POST to \_bulk endpoint. If I do not define index and just start inserting…

---

## [Elasticsearch Over Heap Any times](https://discuss.elastic.co/t/elasticsearch-over-heap-any-times/124812)

<div class="topic-metadata">

**Author:** [@Ben96](https://discuss.elastic.co/u/Ben96)\
**Replies:** 2\
**Last updated:** [March 20, 2018, 4:25pm UTC](https://discuss.elastic.co/t/elasticsearch-over-heap-any-times/124812 "2018-03-20T16:25:16Z")

</div>

Hi guys, Here we are for a new topic again :stuck\_out\_tongue: I'm in trouble with mu Elastic Cluster : Got on 2 nodes in particular, heap usage in red at all times. (Around 19.7 min & 19.8 Max) We jus lost one node f…

---

## [Basic indexing/search strategy : Nested/Parent-Child/Other](https://discuss.elastic.co/t/basic-indexing-search-strategy-nested-parent-child-other/124816)

<div class="topic-metadata">

**Author:** [@jgonin](https://discuss.elastic.co/u/jgonin)\
**Replies:** 0\
**Last updated:** [March 20, 2018, 4:03pm UTC](https://discuss.elastic.co/t/basic-indexing-search-strategy-nested-parent-child-other/124816 "2018-03-20T16:03:47Z")

</div>

Hi, first of all, thanks you for this great tool you are building. I am a beginner with some basis. I have been searching for an answer before posting but sadly I didn’t find anything really matching what I needed.. It …

---

## [Score interval](https://discuss.elastic.co/t/score-interval/124794)

<div class="topic-metadata">

**Author:** [@mvienne](https://discuss.elastic.co/u/mvienne)\
**Replies:** 2\
**Last updated:** [March 20, 2018, 3:58pm UTC](https://discuss.elastic.co/t/score-interval/124794 "2018-03-20T15:58:36Z")

</div>

Is there a limit to the value of \_score without the use of boost in a search query ? I need to return the score of each search results in a \[0, 1\] interval, and I'm wondering if I can just divide the score returned by E…

---

## [Curator while deleting the old snapshots, times out in middle of operation](https://discuss.elastic.co/t/curator-while-deleting-the-old-snapshots-times-out-in-middle-of-operation/124285)

<div class="topic-metadata">

**Author:** [@sujithkumarb](https://discuss.elastic.co/u/sujithkumarb)\
**Replies:** 3\
**Last updated:** [March 20, 2018, 3:44pm UTC](https://discuss.elastic.co/t/curator-while-deleting-the-old-snapshots-times-out-in-middle-of-operation/124285 "2018-03-20T15:44:14Z")

</div>

Hi, We are storing snapshots in a NETAPP S3 bucket and while deleting the old snapshots using curator, it is required to at least 10 min to delete a single snapshot on the NETAPP S3 bucket. We have a lot of older snapsh…

---

## [Elasticsearch Index size 2.2X times bigger than my log file](https://discuss.elastic.co/t/elasticsearch-index-size-2-2x-times-bigger-than-my-log-file/124659)

<div class="topic-metadata">

**Author:** [@chandukreddi](https://discuss.elastic.co/u/chandukreddi)\
**Replies:** 2\
**Last updated:** [March 20, 2018, 3:23pm UTC](https://discuss.elastic.co/t/elasticsearch-index-size-2-2x-times-bigger-than-my-log-file/124659 "2018-03-20T15:23:19Z")

</div>

Hello Experts, Elasticsearch index size 2x times bigger than my log file after compression. \[root@localhost ~\]# curl XGET 'localhost:9200/\_cat/indices/swift-proxy-log-2018.03.19-000001' curl: (6) Could not resolve hos…

---

## [Working elasticsearch 5 query don't work in 6.2 (reason : all shards failed)](https://discuss.elastic.co/t/working-elasticsearch-5-query-dont-work-in-6-2-reason-all-shards-failed/124799)

<div class="topic-metadata">

**Author:** [@Webmaster\_Cerf](https://discuss.elastic.co/u/Webmaster_Cerf)\
**Replies:** 0\
**Last updated:** [March 20, 2018, 2:51pm UTC](https://discuss.elastic.co/t/working-elasticsearch-5-query-dont-work-in-6-2-reason-all-shards-failed/124799 "2018-03-20T14:51:32Z")

</div>

Hello after an upgrade to 6.2 my ajax requests to elasticsearch fails with this message : An uncaught Exception was encountered Type: Elastica\\Exception\\ResponseException "bool" : { "must" : \[ { "query\_strin…

---

## [Logging Action to Custom File](https://discuss.elastic.co/t/logging-action-to-custom-file/35998)

<div class="topic-metadata">

**Author:** [@mvenkat\_in](https://discuss.elastic.co/u/mvenkat_in)\
**Replies:** 3\
**Last updated:** [March 20, 2018, 1:55pm UTC](https://discuss.elastic.co/t/logging-action-to-custom-file/35998 "2018-03-20T13:55:42Z")

</div>

Hi Is there any way to configure the Watcher to write the alerts to a custom file instead of elasticsearch log file. Thanks

---

## [ElasticSearch 2.4 - Cluster and inline scripts](https://discuss.elastic.co/t/elasticsearch-2-4-cluster-and-inline-scripts/124629)

<div class="topic-metadata">

**Author:** [@sean.boyer](https://discuss.elastic.co/u/sean.boyer)\
**Replies:** 1\
**Last updated:** [March 20, 2018, 1:46pm UTC](https://discuss.elastic.co/t/elasticsearch-2-4-cluster-and-inline-scripts/124629 "2018-03-20T13:46:47Z")

</div>

Hi, I am using the configuration "using script.engine.groovy.inline.search: on" in my non-clustered 2.4 servers and as soon as I added it to our 2.4 clustered server, the elastic service will not start. In the error log…

---

## [Average per day of week aggregation](https://discuss.elastic.co/t/average-per-day-of-week-aggregation/124132)

<div class="topic-metadata">

**Author:** [@atopalov](https://discuss.elastic.co/u/atopalov)\
**Replies:** 2\
**Last updated:** [March 20, 2018, 1:21pm UTC](https://discuss.elastic.co/t/average-per-day-of-week-aggregation/124132 "2018-03-20T13:21:12Z")

</div>

Hello, I have a message index with a 'date' and 'channelId' fields: POST message/\_doc { "channelId": "channel\_twitter", "date": "2018-03-08T14:01:23.385Z" } I need to create an aggregation that calculates the avera…

---

## [Elastic search is not starting](https://discuss.elastic.co/t/elastic-search-is-not-starting/124520)

<div class="topic-metadata">

**Author:** [@prahlad574](https://discuss.elastic.co/u/prahlad574)\
**Replies:** 24\
**Last updated:** [March 20, 2018, 12:15pm UTC](https://discuss.elastic.co/t/elastic-search-is-not-starting/124520 "2018-03-20T12:15:49Z")

</div>

root@:/# service elasticsearch start Starting Elasticsearch Server \[ OK \] root@:/# service elasticsearch status elasticsearch is not running this is the issue i am facing. earlier port 9200 is to be in close wait sta…

---

## [Remove elements/objects From Array in ElasticSearch Followed by Matching Query](https://discuss.elastic.co/t/remove-elements-objects-from-array-in-elasticsearch-followed-by-matching-query/124747)

<div class="topic-metadata">

**Author:** [@sandip179](https://discuss.elastic.co/u/sandip179)\
**Replies:** 0\
**Last updated:** [March 20, 2018, 11:38am UTC](https://discuss.elastic.co/t/remove-elements-objects-from-array-in-elasticsearch-followed-by-matching-query/124747 "2018-03-20T11:38:42Z")

</div>

I have below types documents. { "\_index": "example1", "\_type": "doc", "\_id": "8036", "\_score": 1, "\_source": { "user": "kimchy8036", "postDate": "2009-11-15T13:12:00", "location…

---

## [Cluster\_health status is red](https://discuss.elastic.co/t/cluster-health-status-is-red/124741)

<div class="topic-metadata">

**Author:** [@jagan](https://discuss.elastic.co/u/jagan)\
**Replies:** 0\
**Last updated:** [March 20, 2018, 11:22am UTC](https://discuss.elastic.co/t/cluster-health-status-is-red/124741 "2018-03-20T11:22:28Z")

</div>

Hi All, My issue is 'Cluster status is red' when checked the 'cluster health' API.When i check the indices with unassigned (....../\_cat/indices | grep Unassigned).IT shows .kibana both p,r shards are unassigned. I did …

---

## [How many updates is too many updates, or should I bulk?](https://discuss.elastic.co/t/how-many-updates-is-too-many-updates-or-should-i-bulk/124580)

<div class="topic-metadata">

**Author:** [@peterbe](https://discuss.elastic.co/u/peterbe)\
**Replies:** 2\
**Last updated:** [March 20, 2018, 11:00am UTC](https://discuss.elastic.co/t/how-many-updates-is-too-many-updates-or-should-i-bulk/124580 "2018-03-20T11:00:45Z")

</div>

I have a single node running a Digital Ocean VM. The server's got 8GB and according to top the CPU is about 50% used up by that java process. My app writes often. Mostly inserts and updates. I have a piece of synchronou…

[Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1745)

[Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1747)
