# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1779 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1780 --- ## [High Availability ES](https://discuss.elastic.co/t/high-availability-es/120793)
**Author:** [@paul1243](https://discuss.elastic.co/u/paul1243)\ **Replies:** 3\ **Last updated:** [February 22, 2018, 8:14am UTC](https://discuss.elastic.co/t/high-availability-es/120793 "2018-02-22T08:14:48Z")
Hi, Moving the Elastic Search to the Production, Would like to have the High Availability, if Master Elastic Search server stops abruptly for some reason, Secondary server should come up and make the indices available o… --- ## [Elasticsearch MultiNode Cluster Configuration](https://discuss.elastic.co/t/elasticsearch-multinode-cluster-configuration/120883)
**Author:** [@Hassan\_Shaitou](https://discuss.elastic.co/u/Hassan_Shaitou)\ **Replies:** 6\ **Last updated:** [February 22, 2018, 8:13am UTC](https://discuss.elastic.co/t/elasticsearch-multinode-cluster-configuration/120883 "2018-02-22T08:13:02Z")
I have two nodes I want one to act as a master(master node) the second to act as a slave(data node): master node configuration: cluster.name: twist node.master: true node.data: false node.name: 192.168.237.131 discover… --- ## [Repository HDFS change in security.prinicpal](https://discuss.elastic.co/t/repository-hdfs-change-in-security-prinicpal/121000)
**Author:** [@DaveyDevOps](https://discuss.elastic.co/u/DaveyDevOps)\ **Replies:** 0\ **Last updated:** [February 22, 2018, 7:40am UTC](https://discuss.elastic.co/t/repository-hdfs-change-in-security-prinicpal/121000 "2018-02-22T07:40:51Z")
Elasticsearch 5.6.6 with Repository HDFS plugin, HDFS kerberized Just wanted to share my experience. Short version: Needed to restart following a change in security.prinicpal Long version: Attempted to update the se… --- ## [Nested object in sort](https://discuss.elastic.co/t/nested-object-in-sort/121003)
**Author:** [@vicariouskp](https://discuss.elastic.co/u/vicariouskp)\ **Replies:** 0\ **Last updated:** [February 22, 2018, 7:49am UTC](https://discuss.elastic.co/t/nested-object-in-sort/121003 "2018-02-22T07:49:12Z")
Hello, I'm trying to write in c# using Nest 6.0 version code provided here: https://www.elastic.co/guide/en/elasticsearch/reference/current/search-request-sort.html POST /\_search { "query" : { "term" : { "produ… --- ## [Index rebuild taking much time](https://discuss.elastic.co/t/index-rebuild-taking-much-time/120556)
**Author:** [@sateesh](https://discuss.elastic.co/u/sateesh)\ **Replies:** 8\ **Last updated:** [February 22, 2018, 6:28am UTC](https://discuss.elastic.co/t/index-rebuild-taking-much-time/120556 "2018-02-22T06:28:06Z")
Hi, I have only 170GB of Data, each time restarting data node, for rebuilding index taking to much time active percentage increased 18 to 19 it took almost 24 hr, what could be the issue. { "cluster\_name" : "elk-stac… --- ## [Disable elastic user after some restarting application](https://discuss.elastic.co/t/disable-elastic-user-after-some-restarting-application/120832)
**Author:** [@Amir\_Salar\_Pourhasan](https://discuss.elastic.co/u/Amir_Salar_Pourhasan)\ **Replies:** 0\ **Last updated:** [February 21, 2018, 12:04pm UTC](https://discuss.elastic.co/t/disable-elastic-user-after-some-restarting-application/120832 "2018-02-21T12:04:27Z")
I have a Nodejs app using elastic search. For dev mode, I need lots of restarts my app. after some restarts, elastic shows me failed to authenticate user \[elastic\], with { header={ WWW-Authenticat at respond ... I cha… --- ## [IBM Qradar and elastic search SIEM solution](https://discuss.elastic.co/t/ibm-qradar-and-elastic-search-siem-solution/120982)
**Author:** [@Blason](https://discuss.elastic.co/u/Blason)\ **Replies:** 0\ **Last updated:** [February 22, 2018, 5:45am UTC](https://discuss.elastic.co/t/ibm-qradar-and-elastic-search-siem-solution/120982 "2018-02-22T05:45:08Z")
Hi Guys, I am evaluating elastic search as a probable SIEM solution in my internal organization and working for IBM Qradar as well. Since this a very huge/intelligent elastic community out there, what points probably I… --- ## [SSL Communication Client and Cluster Error](https://discuss.elastic.co/t/ssl-communication-client-and-cluster-error/120607)
**Author:** [@vigneshaj](https://discuss.elastic.co/u/vigneshaj)\ **Replies:** 6\ **Last updated:** [February 22, 2018, 5:09am UTC](https://discuss.elastic.co/t/ssl-communication-client-and-cluster-error/120607 "2018-02-22T05:09:36Z")
I have a cluster with 2 nodes one master and one data. Elastic with x-pack has been installed. Authentication LDAP is setup Internode communication has been encrypted, which is again successful. Successful: xpack.se… --- ## [Is the all\_fields limit include both keyword and text version of multi fields?](https://discuss.elastic.co/t/is-the-all-fields-limit-include-both-keyword-and-text-version-of-multi-fields/120973)
**Author:** [@trevan](https://discuss.elastic.co/u/trevan)\ **Replies:** 0\ **Last updated:** [February 22, 2018, 4:31am UTC](https://discuss.elastic.co/t/is-the-all-fields-limit-include-both-keyword-and-text-version-of-multi-fields/120973 "2018-02-22T04:31:38Z")
The all\_fields has a limit of 1024 fields (per https://github.com/elastic/elasticsearch/pull/26541) and I'm wondering if that limit counts the different versions of a multi field? Say I have a field that has both a text… --- ## [Can't use \_doc as type despite it being declared the preferred method](https://discuss.elastic.co/t/cant-use-doc-as-type-despite-it-being-declared-the-preferred-method/113837)
**Author:** [@percona.jayj](https://discuss.elastic.co/u/percona.jayj)\ **Replies:** 8\ **Last updated:** [February 22, 2018, 2:49am UTC](https://discuss.elastic.co/t/cant-use-doc-as-type-despite-it-being-declared-the-preferred-method/113837 "2018-02-22T02:49:40Z")
Ok, I'm at a loss. I'm starting to work with 6.0 and I read here that the preferred type name in 6.x is '\_doc'. However, when I try to PUT a new document, I get an error from the (6.0.1) server: Document mapping type… --- ## [Unable to start elasticsearch 6.2.0 in windows 10](https://discuss.elastic.co/t/unable-to-start-elasticsearch-6-2-0-in-windows-10/118851)
**Author:** [@bikkina\_mahesh](https://discuss.elastic.co/u/bikkina_mahesh)\ **Replies:** 8\ **Last updated:** [February 22, 2018, 2:42am UTC](https://discuss.elastic.co/t/unable-to-start-elasticsearch-6-2-0-in-windows-10/118851 "2018-02-22T02:42:35Z")
My java version is : java version "1.8.0\_151" Java(TM) SE Runtime Environment (build 1.8.0\_151-b12) Java HotSpot(TM) Client VM (build 25.151-b12, mixed mode) and JAVA\_HOME is set correctly and when i am running the … --- ## [Advice needed on migrating from X-pack](https://discuss.elastic.co/t/advice-needed-on-migrating-from-x-pack/120635)
**Author:** [@Kannaj](https://discuss.elastic.co/u/Kannaj)\ **Replies:** 2\ **Last updated:** [February 22, 2018, 1:11am UTC](https://discuss.elastic.co/t/advice-needed-on-migrating-from-x-pack/120635 "2018-02-22T01:11:54Z")
Hello, We've deployed an elastic cluster using the recommended template in azure (https://github.com/elastic/azure-marketplace). Once created , we have 6 nodes (3 master + 3 data nodes) in a virtual network and one VM h… --- ## [Role and Active Directory](https://discuss.elastic.co/t/role-and-active-directory/120862)
**Author:** [@flochon](https://discuss.elastic.co/u/flochon)\ **Replies:** 1\ **Last updated:** [February 21, 2018, 11:48pm UTC](https://discuss.elastic.co/t/role-and-active-directory/120862 "2018-02-21T23:48:59Z")
I make a connection to an active directory but all my users haven't access to the role "superuser" that I precise in the file role\_mapping.yml like here https://www.elastic.co/guide/en/x-pack/current/active-directory-rea… --- ## [\-E network.host doesn't work in VM](https://discuss.elastic.co/t/e-network-host-doesnt-work-in-vm/120730)
**Author:** [@melissachang](https://discuss.elastic.co/u/melissachang)\ **Replies:** 10\ **Last updated:** [February 21, 2018, 10:23pm UTC](https://discuss.elastic.co/t/e-network-host-doesnt-work-in-vm/120730 "2018-02-21T22:23:05Z")
I'm trying to run ElasticSearch and view the webpage from a different machine. On my Debian desktop, elasticsearch-5.0.1/bin/elasticsearch -E network.host=100.96.149.173 works. I can access machine\_hostname:9200. But … --- ## [How to access the fields of arrays of Object in Pianless Script](https://discuss.elastic.co/t/how-to-access-the-fields-of-arrays-of-object-in-pianless-script/120453)
**Author:** [@rakhirajpoot18](https://discuss.elastic.co/u/rakhirajpoot18)\ **Replies:** 4\ **Last updated:** [February 21, 2018, 10:00pm UTC](https://discuss.elastic.co/t/how-to-access-the-fields-of-arrays-of-object-in-pianless-script/120453 "2018-02-21T22:00:27Z")
I am using this script double new\_offer\_price = doc\['offer\_price'\].value; boolean deal\_type\_check = true; if (doc.containsKey('flash\_deal\_es')) { for (int i = 0; i \< doc\['flash\_deal\_es'\].length; i++) { if (params.pl… --- ## [Unable to delete few indicies](https://discuss.elastic.co/t/unable-to-delete-few-indicies/120934)
**Author:** [@alexus](https://discuss.elastic.co/u/alexus)\ **Replies:** 1\ **Last updated:** [February 21, 2018, 9:12pm UTC](https://discuss.elastic.co/t/unable-to-delete-few-indicies/120934 "2018-02-21T21:12:42Z")
how do I get rid of these indices? # curl --silent --request GET $ELASTICSEARCH\_URI/\_cat/indices | grep metadata green open %{\[@metadata\]\[beat\]}-2018.02.20 IVbWWsxTRiSDZCNNb8VDAw 5 1 1 … --- ## [Elastic ignoring shard settings](https://discuss.elastic.co/t/elastic-ignoring-shard-settings/120933)
**Author:** [@Callahan](https://discuss.elastic.co/u/Callahan)\ **Replies:** 0\ **Last updated:** [February 21, 2018, 8:47pm UTC](https://discuss.elastic.co/t/elastic-ignoring-shard-settings/120933 "2018-02-21T20:47:52Z")
Hi, So, because I ended up with way, way too many shards on my 3 node cluster due to not really understanding the consequences of having too many shards and therefore accepting the default of 5, I took the decision to w… --- ## [Malformed Query?](https://discuss.elastic.co/t/malformed-query/120919)
**Author:** [@liamwazherealso](https://discuss.elastic.co/u/liamwazherealso)\ **Replies:** 2\ **Last updated:** [February 21, 2018, 8:34pm UTC](https://discuss.elastic.co/t/malformed-query/120919 "2018-02-21T20:34:51Z")
Hello, I'm trying to query duplicates by comparing more than one field. I cannot use the scripting solution mentioned here. So I'm using this query. { 'aggs':{ '@timestamp':{ 'terms':{ 'fi… --- ## [Trouble posting JSON file](https://discuss.elastic.co/t/trouble-posting-json-file/120927)
**Author:** [@mcurtis778](https://discuss.elastic.co/u/mcurtis778)\ **Replies:** 0\ **Last updated:** [February 21, 2018, 8:00pm UTC](https://discuss.elastic.co/t/trouble-posting-json-file/120927 "2018-02-21T20:00:34Z")
I am new to ELK and I am trying to load the Accounts.Json file using the code in the documentation but it is not working for me. I am using Windows and the Kibana Console. I have searched and tried so many other things o… --- ## [Problems with ELK install](https://discuss.elastic.co/t/problems-with-elk-install/120723)
**Author:** [@rnvntr.h](https://discuss.elastic.co/u/rnvntr.h)\ **Replies:** 7\ **Last updated:** [February 21, 2018, 7:50pm UTC](https://discuss.elastic.co/t/problems-with-elk-install/120723 "2018-02-21T19:50:37Z")
Hello! I'm running Kibana 6.2.1 on a Centos 7 server. I'm able to receive logs from this same server but not from my other servers, can you guys tell me what i'm missing? I'm sharing my config files and logs. Thanks in a… --- ## [duplicateNames with multiple fields?](https://discuss.elastic.co/t/duplicatenames-with-multiple-fields/120209)
**Author:** [@liamwazherealso](https://discuss.elastic.co/u/liamwazherealso)\ **Replies:** 7\ **Last updated:** [February 21, 2018, 7:07pm UTC](https://discuss.elastic.co/t/duplicatenames-with-multiple-fields/120209 "2018-02-21T19:07:38Z")
Hello, I'm able to preform a query and find duplicate results with. query = { "aggs": { "duplicateNames": { "terms": { "field": comparison\_field, "size": 0, … --- ## [Correlation between different fields of different logs - Question](https://discuss.elastic.co/t/correlation-between-different-fields-of-different-logs-question/120921)
**Author:** [@NGCyber](https://discuss.elastic.co/u/NGCyber)\ **Replies:** 0\ **Last updated:** [February 21, 2018, 7:03pm UTC](https://discuss.elastic.co/t/correlation-between-different-fields-of-different-logs-question/120921 "2018-02-21T19:03:30Z")
Hi, I am trying to find a solution to this problem, and I can't seem to find the solution for quite some time. I am new to ELK, and I hoped someone can help me somehow. Let's say I have an ELK which receives logs throu… --- ## [Specify type in delete by query](https://discuss.elastic.co/t/specify-type-in-delete-by-query/120912)
**Author:** [@prasanth\_nair1](https://discuss.elastic.co/u/prasanth_nair1)\ **Replies:** 0\ **Last updated:** [February 21, 2018, 6:23pm UTC](https://discuss.elastic.co/t/specify-type-in-delete-by-query/120912 "2018-02-21T18:23:39Z")
Currently delete by query (java api) only accepts index and i couldn't find an option to provide type .Am i missing something ? i am working with version 5.4 --- ## [How to check if an index and mapping exists in elasticsearch v6.0.1](https://discuss.elastic.co/t/how-to-check-if-an-index-and-mapping-exists-in-elasticsearch-v6-0-1/120895)
**Author:** [@wandermonk](https://discuss.elastic.co/u/wandermonk)\ **Replies:** 3\ **Last updated:** [February 21, 2018, 5:35pm UTC](https://discuss.elastic.co/t/how-to-check-if-an-index-and-mapping-exists-in-elasticsearch-v6-0-1/120895 "2018-02-21T17:35:58Z")
How to check if an index already exists before creating an index in elasticsearch. I could not find any documentation on this. Please help. --- ## [@timestamp in kibana doesn't match browser time(local time)](https://discuss.elastic.co/t/timestamp-in-kibana-doesnt-match-browser-time-local-time/120819)
**Author:** [@f26227279](https://discuss.elastic.co/u/f26227279)\ **Replies:** 1\ **Last updated:** [February 21, 2018, 4:15pm UTC](https://discuss.elastic.co/t/timestamp-in-kibana-doesnt-match-browser-time-local-time/120819 "2018-02-21T16:15:16Z")
Hi everyone, I input netflow data to ES through logstash, but I found that the @timestamp doesn't match the browser time. It delay about 10 minutes. \[image\] so in kibana the graph is delay about 10 minutes. \[image\] t… --- ## [Add @timestamp using Python API](https://discuss.elastic.co/t/add-timestamp-using-python-api/120890)
**Author:** [@druzmieres](https://discuss.elastic.co/u/druzmieres)\ **Replies:** 0\ **Last updated:** [February 21, 2018, 4:10pm UTC](https://discuss.elastic.co/t/add-timestamp-using-python-api/120890 "2018-02-21T16:10:03Z")
I wrote a script that loads files to ES using the Python API (helpers.parallel\_bulk). But, when the same files are sent using Logstash, there's a field called "@timestamp". I'd like to add the same field using the API b… --- ## [Cross cluster search causing gateway nodes to reset](https://discuss.elastic.co/t/cross-cluster-search-causing-gateway-nodes-to-reset/120886)
**Author:** [@bbailey](https://discuss.elastic.co/u/bbailey)\ **Replies:** 0\ **Last updated:** [February 21, 2018, 3:58pm UTC](https://discuss.elastic.co/t/cross-cluster-search-causing-gateway-nodes-to-reset/120886 "2018-02-21T15:58:08Z")
I've moved recently to use cross cluster search to connect my Kibana to two separate clusters instead of using tribe nodes. I am finding certain cases where trying to query from indexes present in only of of the cluster… --- ## [Scroll Request with Condition](https://discuss.elastic.co/t/scroll-request-with-condition/120747)
**Author:** [@animageofmine](https://discuss.elastic.co/u/animageofmine)\ **Replies:** 2\ **Last updated:** [February 21, 2018, 3:55pm UTC](https://discuss.elastic.co/t/scroll-request-with-condition/120747 "2018-02-21T15:55:46Z")
Let's say my Scroll request contains a condition / filter that matches 100 documents. Once I start scrolling, say there was one more record added to the index that meets the condition / filter passed in the scroll reques… --- ## ["Elasticsearch is still initializing the kibana index](https://discuss.elastic.co/t/elasticsearch-is-still-initializing-the-kibana-index/120870)
**Author:** [@niheeth](https://discuss.elastic.co/u/niheeth)\ **Replies:** 0\ **Last updated:** [February 21, 2018, 3:15pm UTC](https://discuss.elastic.co/t/elasticsearch-is-still-initializing-the-kibana-index/120870 "2018-02-21T15:15:59Z")
After supply credentials in kibana dashboard getting "internal server error". seeing bellow errors in logs.how to fix this. plugin:elasticsearch","state":"red","message":"Status changed from red to red - Elasticsearch i… --- ## [Failed to load plugin class \[org.elasticsearch.xpack.core.XPackPlugin\]](https://discuss.elastic.co/t/failed-to-load-plugin-class-org-elasticsearch-xpack-core-xpackplugin/120627)
**Author:** [@sbu](https://discuss.elastic.co/u/sbu)\ **Replies:** 2\ **Last updated:** [February 21, 2018, 2:36pm UTC](https://discuss.elastic.co/t/failed-to-load-plugin-class-org-elasticsearch-xpack-core-xpackplugin/120627 "2018-02-21T14:36:15Z")
Hi, I'm getting "failed to load plugin class \[org.elasticsearch.xpack.core.XPackPlugin\]" and then right at the bottom of the exception I'm getting access denied ("java.io.FilePermission" "/certs/ca/ca.crt" "read") which… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1778) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1780)