# Elasticsearch

**URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1764

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 1765

---

## [Create Elasticsearch Cluster (newbie)](https://discuss.elastic.co/t/create-elasticsearch-cluster-newbie/122530)

<div class="topic-metadata">

**Author:** [@TheAnonymousModeIT](https://discuss.elastic.co/u/TheAnonymousModeIT)\
**Replies:** 11\
**Last updated:** [March 6, 2018, 2:53pm UTC](https://discuss.elastic.co/t/create-elasticsearch-cluster-newbie/122530 "2018-03-06T14:53:06Z")

</div>

Hi guys, I downloaded the ElasticSearch zip for Windows, I extrated it and made three copies of the folder. Then I configured in every folder the elasticsearch.yml. cluster.name: elasticsearch-dev node.name: masterNod…

---

## [About auto create index](https://discuss.elastic.co/t/about-auto-create-index/122675)

<div class="topic-metadata">

**Author:** [@Champion\_Xie](https://discuss.elastic.co/u/Champion_Xie)\
**Replies:** 1\
**Last updated:** [March 6, 2018, 2:05pm UTC](https://discuss.elastic.co/t/about-auto-create-index/122675 "2018-03-06T14:05:36Z")

</div>

what should I do? elasticsearch.yml add content :slight\_smile: action.auto.create.index: .security,.watcher, .watcher-histroy\* ,why kibana display below info Oh no! It looks like your Elasticsearch cluster's action.…

---

## [How can backup all Logs of elk server](https://discuss.elastic.co/t/how-can-backup-all-logs-of-elk-server/122688)

<div class="topic-metadata">

**Author:** [@abu.sayeed](https://discuss.elastic.co/u/abu.sayeed)\
**Replies:** 1\
**Last updated:** [March 6, 2018, 2:03pm UTC](https://discuss.elastic.co/t/how-can-backup-all-logs-of-elk-server/122688 "2018-03-06T14:03:17Z")

</div>

I install elk server on a new pc. all configuration are same. How can I back up 6 months logs of elk-server to transfer new elk-server. Thanks

---

## [\[SOLVED\] Painless, shards and multi-threading](https://discuss.elastic.co/t/solved-painless-shards-and-multi-threading/122371)

<div class="topic-metadata">

**Author:** [@cbismuth](https://discuss.elastic.co/u/cbismuth)\
**Replies:** 6\
**Last updated:** [March 6, 2018, 1:52pm UTC](https://discuss.elastic.co/t/solved-painless-shards-and-multi-threading/122371 "2018-03-06T13:52:05Z")

</div>

Hi, Let's say we have: 5 nodes 10 shards per index (with 1 replica) 10 vCPU per node (and 16 Go RAM with 8 Go heap) Will shard-scoped Painless script executions be multi-threaded on each node? E.g. will node 1 multi…

---

## [Rejecting mapping update ... as the final mapping would have more than 1 type](https://discuss.elastic.co/t/rejecting-mapping-update-as-the-final-mapping-would-have-more-than-1-type/122593)

<div class="topic-metadata">

**Author:** [@davehatma](https://discuss.elastic.co/u/davehatma)\
**Replies:** 2\
**Last updated:** [March 6, 2018, 1:51pm UTC](https://discuss.elastic.co/t/rejecting-mapping-update-as-the-final-mapping-would-have-more-than-1-type/122593 "2018-03-06T13:51:26Z")

</div>

I have a brand new ES Docker container running with no indexes or index templates. I PUT a new mapping template for some metrics indexes I want to load and get a 200OK. However, when I try to update ES from LogStash, I…

---

## [Geeting "Status : RED " error](https://discuss.elastic.co/t/geeting-status-red-error/121799)

<div class="topic-metadata">

**Author:** [@madurad](https://discuss.elastic.co/u/madurad)\
**Replies:** 5\
**Last updated:** [March 6, 2018, 1:45pm UTC](https://discuss.elastic.co/t/geeting-status-red-error/121799 "2018-03-06T13:45:58Z")

</div>

My Elastic search server contains 88GB of indices in lib file, and my server runs out of memory. Any possibility to delete some older files here? \[kibana-error\] Any help ?

---

## [Why index no automatic create](https://discuss.elastic.co/t/why-index-no-automatic-create/122628)

<div class="topic-metadata">

**Author:** [@Champion\_Xie](https://discuss.elastic.co/u/Champion_Xie)\
**Replies:** 3\
**Last updated:** [March 6, 2018, 1:27pm UTC](https://discuss.elastic.co/t/why-index-no-automatic-create/122628 "2018-03-06T13:27:31Z")

</div>

all software version is 6.2.0 the index logtash-webnginx-2018.03.05 create success ,but today index not automatic create ,this is why?

---

## [Move existing indexes from specific nodes](https://discuss.elastic.co/t/move-existing-indexes-from-specific-nodes/122496)

<div class="topic-metadata">

**Author:** [@vakarami](https://discuss.elastic.co/u/vakarami)\
**Replies:** 1\
**Last updated:** [March 6, 2018, 12:43pm UTC](https://discuss.elastic.co/t/move-existing-indexes-from-specific-nodes/122496 "2018-03-06T12:43:24Z")

</div>

Hi. I know that with below config we can exclude some nodes from cluster, And elastic itself relocate existing indexes on those nodes. PUT /\_cluster/settings { "transient" : { "cluster.routing.allocation.exclude.\_ip"…

---

## [Are aggregation results accurate except cardinality?](https://discuss.elastic.co/t/are-aggregation-results-accurate-except-cardinality/122573)

<div class="topic-metadata">

**Author:** [@cemremengu](https://discuss.elastic.co/u/cemremengu)\
**Replies:** 0\
**Last updated:** [March 5, 2018, 6:34pm UTC](https://discuss.elastic.co/t/are-aggregation-results-accurate-except-cardinality/122573 "2018-03-05T18:34:29Z")

</div>

Hello, According to here cardinality and percentiles are approximate aggregations. I just want to make sure; is this also true for other types of aggregations as well such as sum or average or maybe aggregations done w…

---

## [PDF- ingest attachement plugin](https://discuss.elastic.co/t/pdf-ingest-attachement-plugin/122693)

<div class="topic-metadata">

**Author:** [@akml\_kk](https://discuss.elastic.co/u/akml_kk)\
**Replies:** 1\
**Last updated:** [March 6, 2018, 10:51am UTC](https://discuss.elastic.co/t/pdf-ingest-attachement-plugin/122693 "2018-03-06T10:51:27Z")

</div>

HELLO, I found that i need to use " ingest attachement plugin" to load a pdf to elasticsearch. i found in documentation these code : PUT \_ingest/pipeline/attachment { "description" : "Extract attachment information"…

---

## [C# code for Conditional sorting](https://discuss.elastic.co/t/c-code-for-conditional-sorting/122700)

<div class="topic-metadata">

**Author:** [@AshwiniS](https://discuss.elastic.co/u/AshwiniS)\
**Replies:** 0\
**Last updated:** [March 6, 2018, 10:44am UTC](https://discuss.elastic.co/t/c-code-for-conditional-sorting/122700 "2018-03-06T10:44:00Z")

</div>

c# code for elastic search conditional sort Like items having value "featured" as top and sort those items desc order using featured-date and sort remaining items with normal date

---

## [Tophits - java vs CURL](https://discuss.elastic.co/t/tophits-java-vs-curl/122587)

<div class="topic-metadata">

**Author:** [@fgbogdan](https://discuss.elastic.co/u/fgbogdan)\
**Replies:** 1\
**Last updated:** [March 6, 2018, 10:34am UTC](https://discuss.elastic.co/t/tophits-java-vs-curl/122587 "2018-03-06T10:34:06Z")

</div>

I have the next curl json and I want to do the same thing in Java - but the result is not the same. The scope is to retrieve not only the last values but also some other fields, and these fields are missing from java re…

---

## [How to loop over aggregated search?](https://discuss.elastic.co/t/how-to-loop-over-aggregated-search/122692)

<div class="topic-metadata">

**Author:** [@Jan\_Pisl](https://discuss.elastic.co/u/Jan_Pisl)\
**Replies:** 0\
**Last updated:** [March 6, 2018, 10:16am UTC](https://discuss.elastic.co/t/how-to-loop-over-aggregated-search/122692 "2018-03-06T10:16:03Z")

</div>

I have the following query: query = { "aggs" : { "by\_minute" : { "date\_histogram" : { "field" : "@timestamp", "interval" : "minute" …

---

## [Reindex GC overhead](https://discuss.elastic.co/t/reindex-gc-overhead/122676)

<div class="topic-metadata">

**Author:** [@timprosteps](https://discuss.elastic.co/u/timprosteps)\
**Replies:** 0\
**Last updated:** [March 6, 2018, 8:59am UTC](https://discuss.elastic.co/t/reindex-gc-overhead/122676 "2018-03-06T08:59:11Z")

</div>

Hi, We are trying to do a reindex of one of our live indexes which contains 9.6 million docs and is 48 gig in size. Elasticsearch is running on 1 machine with 36 CPU cores and 60gig ram. I gave Elasticsearch 30gig as h…

---

## [Problem with elasticsearch on production](https://discuss.elastic.co/t/problem-with-elasticsearch-on-production/122673)

<div class="topic-metadata">

**Author:** [@Aparna\_Vodapalli](https://discuss.elastic.co/u/Aparna_Vodapalli)\
**Replies:** 0\
**Last updated:** [March 6, 2018, 8:49am UTC](https://discuss.elastic.co/t/problem-with-elasticsearch-on-production/122673 "2018-03-06T08:49:20Z")

</div>

We have test and production setup for ELK . Test setup is working fine, but on production I am getting org.elasticsearch.cluster.metadata.ProcessClusterEventTimeoutException: failed to process cluster event (put-mapping…

---

## [Machine Learning: Could not create job](https://discuss.elastic.co/t/machine-learning-could-not-create-job/122037)

<div class="topic-metadata">

**Author:** [@NOUR](https://discuss.elastic.co/u/NOUR)\
**Replies:** 4\
**Last updated:** [March 6, 2018, 8:37am UTC](https://discuss.elastic.co/t/machine-learning-could-not-create-job/122037 "2018-03-06T08:37:01Z")

</div>

hello every one, In fact i use the X pack 6.2.2 and i can't create any type of job(simple,adv,multi...) Can someone help me? Thanks, \[1\] \[2\] NOUR

---

## [Set up custom mapping](https://discuss.elastic.co/t/set-up-custom-mapping/122227)

<div class="topic-metadata">

**Author:** [@Win](https://discuss.elastic.co/u/Win)\
**Replies:** 4\
**Last updated:** [March 6, 2018, 7:35am UTC](https://discuss.elastic.co/t/set-up-custom-mapping/122227 "2018-03-06T07:35:07Z")

</div>

Hi there. I did not find an existing topic about this, so... The log to be analyzed looks like this: 2012-01-01|SEVERE|System error|NullPointerException|user1 2012-01-01|INFO||Logged In|user2 2012-01-01|SEVERE|Syste…

---

## [Pre boost while indexing](https://discuss.elastic.co/t/pre-boost-while-indexing/122660)

<div class="topic-metadata">

**Author:** [@Kurzer\_Patrick](https://discuss.elastic.co/u/Kurzer_Patrick)\
**Replies:** 0\
**Last updated:** [March 6, 2018, 7:33am UTC](https://discuss.elastic.co/t/pre-boost-while-indexing/122660 "2018-03-06T07:33:41Z")

</div>

I would like to know if there is a way to give some weights on documents like I can do for the complete suggestions. Lets say I index two documents: Gerogia Germany I will use the edge\_ngram tokenizer to search in aut…

---

## [Watcher Help](https://discuss.elastic.co/t/watcher-help/122426)

<div class="topic-metadata">

**Author:** [@EricWS](https://discuss.elastic.co/u/EricWS)\
**Replies:** 5\
**Last updated:** [March 6, 2018, 7:28am UTC](https://discuss.elastic.co/t/watcher-help/122426 "2018-03-06T07:28:41Z")

</div>

Hi all, I have been going in circles for hours trying to get a watcher working. I am trying to pick up a payload and send it via webhook to a remote server. The code below gives be an error on the very last curly brace…

---

## [About Summation](https://discuss.elastic.co/t/about-summation/122658)

<div class="topic-metadata">

**Author:** [@chenzilong444](https://discuss.elastic.co/u/chenzilong444)\
**Replies:** 0\
**Last updated:** [March 6, 2018, 7:16am UTC](https://discuss.elastic.co/t/about-summation/122658 "2018-03-06T07:16:10Z")

</div>

so i have two fields which types is number i want to Summons them and put It in a new field so can i do it on kibana or elasticsearch but i cant do it on logstash because i don't know theirs name before i see it on ki…

---

## [Filter is not working with multi \_match](https://discuss.elastic.co/t/filter-is-not-working-with-multi-match/122505)

<div class="topic-metadata">

**Author:** [@Rajamanickam](https://discuss.elastic.co/u/Rajamanickam)\
**Replies:** 2\
**Last updated:** [March 6, 2018, 6:38am UTC](https://discuss.elastic.co/t/filter-is-not-working-with-multi-match/122505 "2018-03-06T06:38:11Z")

</div>

Filter is not working for me :frowning: even though i'm having matching record with this search term, The search result shows empty hit. Can anyone please help me out. \`GET my\_index/my\_type2/\_search { "query": { …

---

## [Print Standard Streams with Gradle](https://discuss.elastic.co/t/print-standard-streams-with-gradle/122116)

<div class="topic-metadata">

**Author:** [@danlevy](https://discuss.elastic.co/u/danlevy)\
**Replies:** 1\
**Last updated:** [March 6, 2018, 5:38am UTC](https://discuss.elastic.co/t/print-standard-streams-with-gradle/122116 "2018-03-06T05:38:03Z")

</div>

Elasticsearch version: 6.2.1 Plugins installed: None JVM version: 1.8.0 OS version: MacOS 10.13 I am trying to print standard streams System.out.print() when testing a bug fix. I found here that I can just add the fo…

---

## [ES upgraded to 6.2 but didn't reindex indices first](https://discuss.elastic.co/t/es-upgraded-to-6-2-but-didnt-reindex-indices-first/122633)

<div class="topic-metadata">

**Author:** [@jamesl](https://discuss.elastic.co/u/jamesl)\
**Replies:** 0\
**Last updated:** [March 6, 2018, 4:09am UTC](https://discuss.elastic.co/t/es-upgraded-to-6-2-but-didnt-reindex-indices-first/122633 "2018-03-06T04:09:20Z")

</div>

Hi. I just upgraded my ES from 5.6.3 --\> 6.2. I missed the step to reindex all my indices first (they were done when the cluster was 2.3.x) Is there anyway I can reindex them now without having to roll back some of my ma…

---

## [Update Document Questions](https://discuss.elastic.co/t/update-document-questions/122609)

<div class="topic-metadata">

**Author:** [@Jonb32](https://discuss.elastic.co/u/Jonb32)\
**Replies:** 2\
**Last updated:** [March 6, 2018, 2:07am UTC](https://discuss.elastic.co/t/update-document-questions/122609 "2018-03-06T02:07:57Z")

</div>

Hello, Regarding updating documents via Elasticsearch's bulk API, how are documents compared? As far as I know, for the "Create" action type the index will fail if index and type exists, and for the "Index" action type …

---

## [Find a string and replace with another in all the documents](https://discuss.elastic.co/t/find-a-string-and-replace-with-another-in-all-the-documents/122624)

<div class="topic-metadata">

**Author:** [@udit.agg89](https://discuss.elastic.co/u/udit.agg89)\
**Replies:** 0\
**Last updated:** [March 6, 2018, 2:07am UTC](https://discuss.elastic.co/t/find-a-string-and-replace-with-another-in-all-the-documents/122624 "2018-03-06T02:07:13Z")

</div>

Hi, The problem I am trying to solve is to update a field with a string with another string in all the documents wherever you find it. So lets consider this: I have 5 documents. Two of the documents have string "text…

---

## [Elastic Search Lucene version Issue](https://discuss.elastic.co/t/elastic-search-lucene-version-issue/121999)

<div class="topic-metadata">

**Author:** [@raj.shah1593](https://discuss.elastic.co/u/raj.shah1593)\
**Replies:** 6\
**Last updated:** [March 6, 2018, 1:58am UTC](https://discuss.elastic.co/t/elastic-search-lucene-version-issue/121999 "2018-03-06T01:58:10Z")

</div>

Hi All, I have recently upgraded my Elastic Search cluster from v5.2.2 to v6.1.2. I did it using cluster restart process as specified in the Elastic Search guide. I fired the \_cat/segments command and noticed that the…

---

## [Can't create index patterns after x-pack licence expiration](https://discuss.elastic.co/t/cant-create-index-patterns-after-x-pack-licence-expiration/122535)

<div class="topic-metadata">

**Author:** [@matiasf](https://discuss.elastic.co/u/matiasf)\
**Replies:** 6\
**Last updated:** [March 6, 2018, 1:45am UTC](https://discuss.elastic.co/t/cant-create-index-patterns-after-x-pack-licence-expiration/122535 "2018-03-06T01:45:06Z")

</div>

Hi, We have been trying x-pack and the license have expired yesterday. Now can't create index-patterns and said the index y read only (I can delete by curl against elastic). I try uninstalling the X-pack but the proble…

---

## [Not able to configure elastic search on centos](https://discuss.elastic.co/t/not-able-to-configure-elastic-search-on-centos/119493)

<div class="topic-metadata">

**Author:** [@maheshatlas77](https://discuss.elastic.co/u/maheshatlas77)\
**Replies:** 3\
**Last updated:** [March 5, 2018, 10:57pm UTC](https://discuss.elastic.co/t/not-able-to-configure-elastic-search-on-centos/119493 "2018-03-05T22:57:49Z")

</div>

I have installed ES on centos when i start service it shows below error. \[2018-02-12T14:43:00,386\]\[WARN \]\[o.e.b.Natives \] unable to load JNA native support library, native methods will be disabled. java.lang…

---

## [Curator 5.4.1 Reuse list of indexes returned by the set of filters](https://discuss.elastic.co/t/curator-5-4-1-reuse-list-of-indexes-returned-by-the-set-of-filters/122548)

<div class="topic-metadata">

**Author:** [@ld\_pvl](https://discuss.elastic.co/u/ld_pvl)\
**Replies:** 2\
**Last updated:** [March 5, 2018, 10:34pm UTC](https://discuss.elastic.co/t/curator-5-4-1-reuse-list-of-indexes-returned-by-the-set-of-filters/122548 "2018-03-05T22:34:01Z")

</div>

Hi Team, I am trying to use curator to do some housekeeping and trying to select only the indexes that have not been housekept before. On a high level, I am doing this: close some old indexes =\> set index setting index…

---

## [Store users' search queries within index and search against those queries](https://discuss.elastic.co/t/store-users-search-queries-within-index-and-search-against-those-queries/122486)

<div class="topic-metadata">

**Author:** [@GrigoryPtashko](https://discuss.elastic.co/u/GrigoryPtashko)\
**Replies:** 0\
**Last updated:** [March 5, 2018, 11:04am UTC](https://discuss.elastic.co/t/store-users-search-queries-within-index-and-search-against-those-queries/122486 "2018-03-05T11:04:31Z")

</div>

I have an index containing the type with blog posts. I want to have another type within this index with two fields: user id and the user's search query After every blog posts type insert I want to execute a search th…

[Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1763)

[Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1765)
