# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1780 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1781 --- ## [Log management application](https://discuss.elastic.co/t/log-management-application/120634)
**Author:** [@sana](https://discuss.elastic.co/u/sana)\ **Replies:** 2\ **Last updated:** [February 21, 2018, 2:04pm UTC](https://discuss.elastic.co/t/log-management-application/120634 "2018-02-21T14:04:45Z")
i have an index of logs collected using logstash, now i want to classify the fields, for example collect all the exception in the field "exception" and store them so i can use them later in my log management java applica… --- ## [503 Service Unavailable from ES server](https://discuss.elastic.co/t/503-service-unavailable-from-es-server/120859)
**Author:** [@melvilgit](https://discuss.elastic.co/u/melvilgit)\ **Replies:** 0\ **Last updated:** [February 21, 2018, 2:04pm UTC](https://discuss.elastic.co/t/503-service-unavailable-from-es-server/120859 "2018-02-21T14:04:30Z")
Getting the Error in Es Version - 5.6.1 \[cluster:monitor/nodes/stats\[n\]\] request\_id \[10143460\] timed out after \[15000ms\] at org.elasticsearch.transport.TransportService$TimeoutHandler.run(TransportService.java:951) \[e… --- ## [Elastic Search and Infra requirement](https://discuss.elastic.co/t/elastic-search-and-infra-requirement/120854)
**Author:** [@sivap](https://discuss.elastic.co/u/sivap)\ **Replies:** 1\ **Last updated:** [February 21, 2018, 2:01pm UTC](https://discuss.elastic.co/t/elastic-search-and-infra-requirement/120854 "2018-02-21T14:01:05Z")
Hi Team, I'm very new to ELK , I want to build elk for 600 GB data per month with 3 months log retention period . Could you please suggest best infrastructure to build ELK (How much CPU and Storage ). Thanks Siva.P --- ## [Elasticsearch error curl: (7) Failed to connect to localhost port 9200: Connection refused but localhost:9200 works on browser](https://discuss.elastic.co/t/elasticsearch-error-curl-7-failed-to-connect-to-localhost-port-9200-connection-refused-but-localhost-9200-works-on-browser/120817)
**Author:** [@kabrice](https://discuss.elastic.co/u/kabrice)\ **Replies:** 8\ **Last updated:** [February 21, 2018, 2:00pm UTC](https://discuss.elastic.co/t/elasticsearch-error-curl-7-failed-to-connect-to-localhost-port-9200-connection-refused-but-localhost-9200-works-on-browser/120817 "2018-02-21T14:00:35Z")
I'm trying to connect Elasticsearch 5.5.2 to a Django 2 project: When running : curl -X GET 'http://localhost:9200' on terminal, I got this error : curl: (7) Failed to connect to localhost port 9200: Connection refused … --- ## [Set up Elasticsearch cluster 2 nodes on same machine](https://discuss.elastic.co/t/set-up-elasticsearch-cluster-2-nodes-on-same-machine/120824)
**Author:** [@Darshan\_Shah1](https://discuss.elastic.co/u/Darshan_Shah1)\ **Replies:** 5\ **Last updated:** [February 21, 2018, 1:57pm UTC](https://discuss.elastic.co/t/set-up-elasticsearch-cluster-2-nodes-on-same-machine/120824 "2018-02-21T13:57:23Z")
Hi , The requirement is need to set up two nodes of cluster on same host. if I use network.host: with same IP http.port : different port Below is my config file for node-1. In 2nd node cluster name is same,node name … --- ## [Elasticsearch declare field as null](https://discuss.elastic.co/t/elasticsearch-declare-field-as-null/120838)
**Author:** [@HilalB](https://discuss.elastic.co/u/HilalB)\ **Replies:** 1\ **Last updated:** [February 21, 2018, 1:14pm UTC](https://discuss.elastic.co/t/elasticsearch-declare-field-as-null/120838 "2018-02-21T13:14:23Z")
I would like to declare a field to null not with null\_value. Are "" and null equivalent? If I do not write anything to field, will ES set set the null automatically? Is empty string stored in doc? --- ## [How to get large strings in elasticsearch and kibana](https://discuss.elastic.co/t/how-to-get-large-strings-in-elasticsearch-and-kibana/120842)
**Author:** [@ajit](https://discuss.elastic.co/u/ajit)\ **Replies:** 1\ **Last updated:** [February 21, 2018, 1:11pm UTC](https://discuss.elastic.co/t/how-to-get-large-strings-in-elasticsearch-and-kibana/120842 "2018-02-21T13:11:29Z")
Hi, I am pushing large string values in elasticsearch. But it is not showing in kibana. I have query to update mapping. But it is showing resource\_already\_exists exception. I want to update mapping for large strings wi… --- ## [Type Mismatch between Ingest Pipeline and Kibana](https://discuss.elastic.co/t/type-mismatch-between-ingest-pipeline-and-kibana/120119)
**Author:** [@SIVA\_S2018](https://discuss.elastic.co/u/SIVA_S2018)\ **Replies:** 8\ **Last updated:** [February 21, 2018, 12:24pm UTC](https://discuss.elastic.co/t/type-mismatch-between-ingest-pipeline-and-kibana/120119 "2018-02-21T12:24:16Z")
Hello Team, We are facing an issue with Elastic Stack and Kabana type mismatch. Kabana is not picking up type as NUMBER rather shows them as string. Here is what we've tried, Initially used ingest pipeline node grok p… --- ## [Regarding Upgrade from 2.x to 5.x](https://discuss.elastic.co/t/regarding-upgrade-from-2-x-to-5-x/120411)
**Author:** [@dawiro](https://discuss.elastic.co/u/dawiro)\ **Replies:** 5\ **Last updated:** [February 21, 2018, 11:57am UTC](https://discuss.elastic.co/t/regarding-upgrade-from-2-x-to-5-x/120411 "2018-02-21T11:57:58Z")
Hi, As I understand it, snapshot repos get upgraded as part of the upgrade to 5.x. Does this mean that 2.x snapshots in that repo can be restored into the now 5.x cluster? Also, what will happen to fields with conflicti… --- ## [Getting error while installing Sense in Kabana](https://discuss.elastic.co/t/getting-error-while-installing-sense-in-kabana/120818)
**Author:** [@prateeksethvns](https://discuss.elastic.co/u/prateeksethvns)\ **Replies:** 2\ **Last updated:** [February 21, 2018, 11:47am UTC](https://discuss.elastic.co/t/getting-error-while-installing-sense-in-kabana/120818 "2018-02-21T11:47:25Z")
Getting below error while trying to install Sense in Kabana \[root@quickstart kibana-6.2.2-linux-x86\_64\]# ./bin/kibana-plugin install https://download.elastic.co/elastic/sense/sense-latest.tar.gz Attempting to transfer … --- ## [Watcher Acknowledge](https://discuss.elastic.co/t/watcher-acknowledge/120709)
**Author:** [@annk](https://discuss.elastic.co/u/annk)\ **Replies:** 2\ **Last updated:** [February 21, 2018, 11:38am UTC](https://discuss.elastic.co/t/watcher-acknowledge/120709 "2018-02-21T11:38:50Z")
Is it possible to know who acknowledged the watch when x-pack security is enabled ? Is it possible to create a new field for that ? Thanks --- ## [Facing too many file open or how to hit ES multiple times using spark](https://discuss.elastic.co/t/facing-too-many-file-open-or-how-to-hit-es-multiple-times-using-spark/120785)
**Author:** [@Gunjit\_Bansal](https://discuss.elastic.co/u/Gunjit_Bansal)\ **Replies:** 6\ **Last updated:** [February 21, 2018, 11:02am UTC](https://discuss.elastic.co/t/facing-too-many-file-open-or-how-to-hit-es-multiple-times-using-spark/120785 "2018-02-21T11:02:18Z")
Hi, My use case is to hit ES multiple times using Spark. In this, i am hitting ES 10000 times. I am getting too many files exception. But its working fine for 5K request To achieve this, I am hitting through REST API. … --- ## [Filtering results by inner hits data](https://discuss.elastic.co/t/filtering-results-by-inner-hits-data/120814)
**Author:** [@krudnicki](https://discuss.elastic.co/u/krudnicki)\ **Replies:** 0\ **Last updated:** [February 21, 2018, 10:37am UTC](https://discuss.elastic.co/t/filtering-results-by-inner-hits-data/120814 "2018-02-21T10:37:00Z")
So we have run into a problem related to a bit more complex scenario, where we have to filter search results by values from inner hits. There was a possibility to filter those results after being returned from elastic, b… --- ## [Error when combining queries using bool](https://discuss.elastic.co/t/error-when-combining-queries-using-bool/120798)
**Author:** [@tgangte](https://discuss.elastic.co/u/tgangte)\ **Replies:** 2\ **Last updated:** [February 21, 2018, 9:45am UTC](https://discuss.elastic.co/t/error-when-combining-queries-using-bool/120798 "2018-02-21T09:45:47Z")
myindex/\_search?scroll=10m { "size": 5000, "query" : "bool": { "must": \[ { "query\_string" : { "query":" name:bob " } }, { "range":{… --- ## [Best way to find the length of array in elasticsearch](https://discuss.elastic.co/t/best-way-to-find-the-length-of-array-in-elasticsearch/120645)
**Author:** [@Amit\_khanduri](https://discuss.elastic.co/u/Amit_khanduri)\ **Replies:** 7\ **Last updated:** [February 21, 2018, 9:25am UTC](https://discuss.elastic.co/t/best-way-to-find-the-length-of-array-in-elasticsearch/120645 "2018-02-21T09:25:01Z")
\> "asst\_re": \[ \> { \> "rep\_type": 345, \> "repo\_id": 7144220 \> } \> , \> { \> "rep\_type": 545, \> "repo\_id": 7084555 \> }\] I have to filter the "asst\_re" array on the basis of length of the array. What is the best and optimis… --- ## [By default purging in elasticSearch](https://discuss.elastic.co/t/by-default-purging-in-elasticsearch/120665)
**Author:** [@vids](https://discuss.elastic.co/u/vids)\ **Replies:** 3\ **Last updated:** [February 21, 2018, 9:18am UTC](https://discuss.elastic.co/t/by-default-purging-in-elasticsearch/120665 "2018-02-21T09:18:24Z")
If we have no defined any purging logic for indexes in elasticsearch then what will be default behavior to purge those index, do we have such default behavior? --- ## [Aggregation with matched nested objects](https://discuss.elastic.co/t/aggregation-with-matched-nested-objects/120791)
**Author:** [@arkkanoid](https://discuss.elastic.co/u/arkkanoid)\ **Replies:** 0\ **Last updated:** [February 21, 2018, 9:03am UTC](https://discuss.elastic.co/t/aggregation-with-matched-nested-objects/120791 "2018-02-21T09:03:16Z")
Hi, I'm implementing a terms aggregation with a field in a nested object. What I expect is that the aggregation only takes the matched nested object, but it takes the whole document. I've seen a partial solution using… --- ## [WordDelimiterTokenFilter used twice in same analyzer with different configurations causes issues](https://discuss.elastic.co/t/worddelimitertokenfilter-used-twice-in-same-analyzer-with-different-configurations-causes-issues/116259)
**Author:** [@Atul\_Bagga](https://discuss.elastic.co/u/Atul_Bagga)\ **Replies:** 6\ **Last updated:** [February 21, 2018, 8:55am UTC](https://discuss.elastic.co/t/worddelimitertokenfilter-used-twice-in-same-analyzer-with-different-configurations-causes-issues/116259 "2018-02-21T08:55:16Z")
ES 5.4.1 Config-1 GenerateWordParts = true, // \[wi-fi\] ---\> \[wi,fi\] GenerateNumberParts = true, // \[12-03\] ---\> \[12,03\] CatenateWords = false, // \[wi-fi\] -/-\> \[wifi\] CatenateNumbers = false, // \[12-03\] -… --- ## [Watcher Sending Slack dynamic Attachments](https://discuss.elastic.co/t/watcher-sending-slack-dynamic-attachments/120786)
**Author:** [@vaidabhishek](https://discuss.elastic.co/u/vaidabhishek)\ **Replies:** 1\ **Last updated:** [February 21, 2018, 8:35am UTC](https://discuss.elastic.co/t/watcher-sending-slack-dynamic-attachments/120786 "2018-02-21T08:35:13Z")
I'm setting a watcher on ELK 6.2 to send dynamic attachments. I just want to extract string in the key message of all the hits. Below is the actions defined on my watcher. It's not working. The text is coming fine in th… --- ## [LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError, :error=\>"Elasticsearch Unreachable: \[http://localhost:9200/\]](https://discuss.elastic.co/t/logstash-outputs-elasticsearch-httpclient-pool-hostunreachableerror-error-elasticsearch-unreachable-http-localhost-9200/118674)
**Author:** [@Shahnaz\_Shariff](https://discuss.elastic.co/u/Shahnaz_Shariff)\ **Replies:** 3\ **Last updated:** [February 21, 2018, 8:25am UTC](https://discuss.elastic.co/t/logstash-outputs-elasticsearch-httpclient-pool-hostunreachableerror-error-elasticsearch-unreachable-http-localhost-9200/118674 "2018-02-21T08:25:53Z")
I installed x-pack on elasticsearch, kibana, and logstash. Elasticsearch.yml bootstrap.memory\_lock: true transport.host: localhost transport.tcp.port: 9300 network.host: 0.0.0.0 http.port: 9200 xpack.ssl.keystore.path:… --- ## [Cluster become unresponsive after receiving data for sometime using EC2 Discovery](https://discuss.elastic.co/t/cluster-become-unresponsive-after-receiving-data-for-sometime-using-ec2-discovery/120770)
**Author:** [@vivek.pr.mi](https://discuss.elastic.co/u/vivek.pr.mi)\ **Replies:** 0\ **Last updated:** [February 21, 2018, 6:50am UTC](https://discuss.elastic.co/t/cluster-become-unresponsive-after-receiving-data-for-sometime-using-ec2-discovery/120770 "2018-02-21T06:50:20Z")
Hi, I am using Elasticsearch-5.0.1 with EC2 discovery. I am running a two nodes cluster both the node are perfectly joining he cluster and I am able to receive data for sometime from logstash. But after sometime cluster… --- ## [HTML eMail rendering issue](https://discuss.elastic.co/t/html-email-rendering-issue/120549)
**Author:** [@Karthik\_Ramachandran](https://discuss.elastic.co/u/Karthik_Ramachandran)\ **Replies:** 3\ **Last updated:** [February 21, 2018, 8:07am UTC](https://discuss.elastic.co/t/html-email-rendering-issue/120549 "2018-02-21T08:07:52Z")
I belive the html sanitization comes into effect, but not sure I'm using below output syntax to the eMail action {{#ishighuse}} \{{jvminuse}} {{/ishighuse}} bgcolor setting is not set and always g… --- ## [Configure authentication with active directory](https://discuss.elastic.co/t/configure-authentication-with-active-directory/120667)
**Author:** [@flochon](https://discuss.elastic.co/u/flochon)\ **Replies:** 2\ **Last updated:** [February 21, 2018, 7:52am UTC](https://discuss.elastic.co/t/configure-authentication-with-active-directory/120667 "2018-02-21T07:52:46Z")
Hello, I configured my active directory in Elasticsearch.yml like this: xpack: security: authc: realms: native: type: native order: 0 active\_directory: type: activ… --- ## [Getting Error while executing query String in Elasticsearch 6.1.1](https://discuss.elastic.co/t/getting-error-while-executing-query-string-in-elasticsearch-6-1-1/120669)
**Author:** [@rakhirajpoot18](https://discuss.elastic.co/u/rakhirajpoot18)\ **Replies:** 5\ **Last updated:** [February 21, 2018, 7:51am UTC](https://discuss.elastic.co/t/getting-error-while-executing-query-string-in-elasticsearch-6-1-1/120669 "2018-02-21T07:51:59Z")
"query": { "query\_string": { "query": "herbal hills muslihills, 60 capsules", "fields": \["br\_nm^1.0", "c\_nm^1.0", "fullName^1.0", "kp\_\*^1.0"\], "type": "best\_fields", "default\_operator": "or", "max\_determinized\_stat… --- ## [Unknown setting \[xpack.notification.email.html.sanitization.allow\] please check that any required plugins are installed, or check the breaking changes documentation for removed settings](https://discuss.elastic.co/t/unknown-setting-xpack-notification-email-html-sanitization-allow-please-check-that-any-required-plugins-are-installed-or-check-the-breaking-changes-documentation-for-removed-settings/120746)
**Author:** [@Karthik\_Ramachandran](https://discuss.elastic.co/u/Karthik_Ramachandran)\ **Replies:** 1\ **Last updated:** [February 21, 2018, 5:19am UTC](https://discuss.elastic.co/t/unknown-setting-xpack-notification-email-html-sanitization-allow-please-check-that-any-required-plugins-are-installed-or-check-the-breaking-changes-documentation-for-removed-settings/120746 "2018-02-21T05:19:38Z")
Trying to configure sanitization settings for eMail notifications but when ES is started, i'm getting error java.lang.IllegalArgumentException: unknown setting \[xpack.notification.email.html.sanitization.allow\] please c… --- ## [How does MLT with multiple like documents work?](https://discuss.elastic.co/t/how-does-mlt-with-multiple-like-documents-work/120755)
**Author:** [@Patrick\_Lam](https://discuss.elastic.co/u/Patrick_Lam)\ **Replies:** 0\ **Last updated:** [February 21, 2018, 2:53am UTC](https://discuss.elastic.co/t/how-does-mlt-with-multiple-like-documents-work/120755 "2018-02-21T02:53:56Z")
Hi, I'm wondering how an MLT query with multiple "like" free text documents works. I assumed that it would basically either concatenate all the texts together, extract the best N words, and match some percent of them to… --- ## [Optimal number of documents in an index](https://discuss.elastic.co/t/optimal-number-of-documents-in-an-index/120748)
**Author:** [@Bkt](https://discuss.elastic.co/u/Bkt)\ **Replies:** 1\ **Last updated:** [February 21, 2018, 2:29am UTC](https://discuss.elastic.co/t/optimal-number-of-documents-in-an-index/120748 "2018-02-21T02:29:49Z")
Hello, Is there some optimal number of documents to be present in an index? for example the indexes are created daily and go as foo-2018-02-20 and so on. Some of the indexes are really small (\<100 documents with average… --- ## [Make a nested field not searchable in elasticsearch 5.6](https://discuss.elastic.co/t/make-a-nested-field-not-searchable-in-elasticsearch-5-6/120741)
**Author:** [@Arjun\_subramanyam\_va](https://discuss.elastic.co/u/Arjun_subramanyam_va)\ **Replies:** 0\ **Last updated:** [February 20, 2018, 11:40pm UTC](https://discuss.elastic.co/t/make-a-nested-field-not-searchable-in-elasticsearch-5-6/120741 "2018-02-20T23:40:00Z")
I have a field which is nested inside other field, I want to make that field not searchable my mapping looks like this dataset": { "properties": { "identifier": { "type": "text" }, "title": { "type": "text", "ter… --- ## [Not able to Execute Query with Custom User](https://discuss.elastic.co/t/not-able-to-execute-query-with-custom-user/120069)
**Author:** [@eramitsinha](https://discuss.elastic.co/u/eramitsinha)\ **Replies:** 7\ **Last updated:** [February 20, 2018, 10:46pm UTC](https://discuss.elastic.co/t/not-able-to-execute-query-with-custom-user/120069 "2018-02-20T22:46:09Z")
Hi , I have ES 5.2.2 and X-Pack 5.2.2 security with Authentication mechanism: I have 6 Data Node in cluster. I have created Following Role(yy\_elastic\_search\_role) and User(yy\_transport\_client) in cluster(native rea… --- ## [Completion field storing norms, payloads, pos and freqs](https://discuss.elastic.co/t/completion-field-storing-norms-payloads-pos-and-freqs/120735)
**Author:** [@adrianocrestani](https://discuss.elastic.co/u/adrianocrestani)\ **Replies:** 0\ **Last updated:** [February 20, 2018, 10:34pm UTC](https://discuss.elastic.co/t/completion-field-storing-norms-payloads-pos-and-freqs/120735 "2018-02-20T22:34:41Z")
I have a completion field with the mapping below. When I use Luke to inspect the index, it shows that that field is storing Payloads, Norms, positions and freqs. I wonder why it needs all that data at all and how I could… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1779) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1781)