# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1785 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1786 --- ## [Sorts not working on my production env](https://discuss.elastic.co/t/sorts-not-working-on-my-production-env/119533)
**Author:** [@Miguel\_Michelsongs](https://discuss.elastic.co/u/Miguel_Michelsongs)\ **Replies:** 1\ **Last updated:** [February 16, 2018, 5:26pm UTC](https://discuss.elastic.co/t/sorts-not-working-on-my-production-env/119533 "2018-02-16T17:26:36Z")
Hi Guys, I need some help with this. I've a production app which is not sorting the records, but I've the same configuration on staging server and is working fine, also is working on my development machine. don't know wh… --- ## [Dynamic list of fields to be returned in search](https://discuss.elastic.co/t/dynamic-list-of-fields-to-be-returned-in-search/119699)
**Author:** [@hariso](https://discuss.elastic.co/u/hariso)\ **Replies:** 1\ **Last updated:** [February 16, 2018, 5:23pm UTC](https://discuss.elastic.co/t/dynamic-list-of-fields-to-be-returned-in-search/119699 "2018-02-16T17:23:48Z")
Is it possible to configure Elasticsearch so that it returns different fields for different documents, based on some criteria? For example: if a field called "foo" \>= 40, then return all fields. If not, return all field… --- ## [Correct Stack setup, especially ES](https://discuss.elastic.co/t/correct-stack-setup-especially-es/119881)
**Author:** [@af\_andi](https://discuss.elastic.co/u/af_andi)\ **Replies:** 2\ **Last updated:** [February 16, 2018, 5:20pm UTC](https://discuss.elastic.co/t/correct-stack-setup-especially-es/119881 "2018-02-16T17:20:53Z")
Hi Guys, currently we have an Elastic Stack with just one node. So Kibana, Logstash and Elasticsearch are running there. Now i want to add a further to disburden the ressources and want to have another Logstash and Elas… --- ## [Not accepting multiple messages at once](https://discuss.elastic.co/t/not-accepting-multiple-messages-at-once/119681)
**Author:** [@pingmehere](https://discuss.elastic.co/u/pingmehere)\ **Replies:** 1\ **Last updated:** [February 16, 2018, 5:20pm UTC](https://discuss.elastic.co/t/not-accepting-multiple-messages-at-once/119681 "2018-02-16T17:20:00Z")
Hi everyone, help to get it solution... I'm using MirthConnect to send the data over HTTP to Elasticsearch. I'm using different messages and filtering them into Mirthconnect and sending to ELK but it shows error while a… --- ## [Resume reindex process](https://discuss.elastic.co/t/resume-reindex-process/119563)
**Author:** [@olanamramoj2](https://discuss.elastic.co/u/olanamramoj2)\ **Replies:** 1\ **Last updated:** [February 16, 2018, 5:12pm UTC](https://discuss.elastic.co/t/resume-reindex-process/119563 "2018-02-16T17:12:50Z")
Hi, We are reindexing a 500gb data, but we dont know how to resume the reindexing once there has been an interruption, can you help us? right now, we are doing this: curl -X POST -H "Content-Type: application/json" --… --- ## [Subquery with elasticsearch](https://discuss.elastic.co/t/subquery-with-elasticsearch/119832)
**Author:** [@sabdoul](https://discuss.elastic.co/u/sabdoul)\ **Replies:** 10\ **Last updated:** [February 16, 2018, 4:57pm UTC](https://discuss.elastic.co/t/subquery-with-elasticsearch/119832 "2018-02-16T16:57:04Z")
Hello, how to simulate this subquery with elasticsearch: Select NOM from Table where NOM not in (select NOM from Table where Prenom='Paul') Thanks! --- ## [Get aggregation value and source field in one st](https://discuss.elastic.co/t/get-aggregation-value-and-source-field-in-one-st/120162)
**Author:** [@devil\_srj7](https://discuss.elastic.co/u/devil_srj7)\ **Replies:** 1\ **Last updated:** [February 16, 2018, 4:54pm UTC](https://discuss.elastic.co/t/get-aggregation-value-and-source-field-in-one-st/120162 "2018-02-16T16:54:51Z")
My Index has data as fields as dept\_id dept\_name dept\_manager year month expenditure there are multiple documents of each dept\_id making expenditure corresponding to year and month. I need to to get the total expendi… --- ## [PHP client: Check input before indexing](https://discuss.elastic.co/t/php-client-check-input-before-indexing/119511)
**Author:** [@syiannop](https://discuss.elastic.co/u/syiannop)\ **Replies:** 4\ **Last updated:** [February 16, 2018, 4:49pm UTC](https://discuss.elastic.co/t/php-client-check-input-before-indexing/119511 "2018-02-16T16:49:39Z")
I am trying to use the PHP client to check if the user's input already exists before indexing it. Here is the code I tried. My idea was: Check if the variables are set (I have four required fields: titel, thema, type… --- ## [Webservice response as chain input](https://discuss.elastic.co/t/webservice-response-as-chain-input/119837)
**Author:** [@Ayush\_Mathur](https://discuss.elastic.co/u/Ayush_Mathur)\ **Replies:** 1\ **Last updated:** [February 16, 2018, 4:48pm UTC](https://discuss.elastic.co/t/webservice-response-as-chain-input/119837 "2018-02-16T16:48:23Z")
Hi, I'm querying an external web service from which I receive a response in JSON format. I'm then trying to chain this output to another query and specifying the path of payload as "path". However, no matter if I use {… --- ## [Elasticsearch Index Template](https://discuss.elastic.co/t/elasticsearch-index-template/120218)
**Author:** [@gittinfunky](https://discuss.elastic.co/u/gittinfunky)\ **Replies:** 0\ **Last updated:** [February 16, 2018, 4:28pm UTC](https://discuss.elastic.co/t/elasticsearch-index-template/120218 "2018-02-16T16:28:38Z")
I am following this tutorial and trying to send tshark captures to ELK. https://www.elastic.co/blog/analyzing-network-packets-with-wireshark-elasticsearch-and-kibana I am required to create an elasticsearch mapping but… --- ## [Startwith query not working if string has hyphen (-)](https://discuss.elastic.co/t/startwith-query-not-working-if-string-has-hyphen/120146)
**Author:** [@nmathur](https://discuss.elastic.co/u/nmathur)\ **Replies:** 4\ **Last updated:** [February 16, 2018, 4:14pm UTC](https://discuss.elastic.co/t/startwith-query-not-working-if-string-has-hyphen/120146 "2018-02-16T16:14:34Z")
Hello All, I am writing a query to fetch items using start with query ... the query returns nothing if the input string has hyphen. Below is working: {"query":{"bool":{"must":\[{"term":{"CompanyId":2}},{"query\_string":… --- ## [Unexpected error while indexing monitoring document elasticsearch](https://discuss.elastic.co/t/unexpected-error-while-indexing-monitoring-document-elasticsearch/120216)
**Author:** [@alexus](https://discuss.elastic.co/u/alexus)\ **Replies:** 0\ **Last updated:** [February 16, 2018, 4:11pm UTC](https://discuss.elastic.co/t/unexpected-error-while-indexing-monitoring-document-elasticsearch/120216 "2018-02-16T16:11:34Z")
I open up Kibana and seeing following message: Login is currently disabled. Administrators should consult the Kibana logs for more details. in elasticsearch's log, I found following: elasticsearch | \[2018-02-16T16:0… --- ## [Time based elastic search index deletion](https://discuss.elastic.co/t/time-based-elastic-search-index-deletion/119036)
**Author:** [@Onkar\_Limburkar](https://discuss.elastic.co/u/Onkar_Limburkar)\ **Replies:** 1\ **Last updated:** [February 16, 2018, 3:59pm UTC](https://discuss.elastic.co/t/time-based-elastic-search-index-deletion/119036 "2018-02-16T15:59:47Z")
We are planning to use elastic search to use for the log data. We have 3TB data for one day. These logs are being generated in json format (they are kind of summaries). So we dont need logstash and are able to index doc… --- ## [Elasticsearch Node Cache](https://discuss.elastic.co/t/elasticsearch-node-cache/120202)
**Author:** [@varundbest](https://discuss.elastic.co/u/varundbest)\ **Replies:** 0\ **Last updated:** [February 16, 2018, 2:51pm UTC](https://discuss.elastic.co/t/elasticsearch-node-cache/120202 "2018-02-16T14:51:29Z")
So I have developed ES + Kibana plugins for Access Control,etc. We have read-only access, index, document, field level security, etc. Instead of turning off Elasticsearch Node Cache, I want to extend/wrap it via a plugi… --- ## [Mutate (like logstash conf) using Python API](https://discuss.elastic.co/t/mutate-like-logstash-conf-using-python-api/120197)
**Author:** [@druzmieres](https://discuss.elastic.co/u/druzmieres)\ **Replies:** 0\ **Last updated:** [February 16, 2018, 2:29pm UTC](https://discuss.elastic.co/t/mutate-like-logstash-conf-using-python-api/120197 "2018-02-16T14:29:30Z")
Hi, I know that using logstash conf files you can perform operations like "mutate" so you can add fields to the mapping and then you can apply transformations to these fields. Something like this: mutate { add\_fiel… --- ## [ES cluster sometimes disconnect!](https://discuss.elastic.co/t/es-cluster-sometimes-disconnect/120186)
**Author:** [@f26227279](https://discuss.elastic.co/u/f26227279)\ **Replies:** 0\ **Last updated:** [February 16, 2018, 1:49pm UTC](https://discuss.elastic.co/t/es-cluster-sometimes-disconnect/120186 "2018-02-16T13:49:34Z")
Hi everyone, my OS is centos7. I set a cluster and input data through logstash, but I found sometimes logsatsh can't connect to ES and this is the error warnning: \[2018-02-13T17:01:34,860\]\[WARN \]\[logstash.outputs.elasti… --- ## [Can't launch elasticsearch in CentOs](https://discuss.elastic.co/t/cant-launch-elasticsearch-in-centos/120170)
**Author:** [@Adren](https://discuss.elastic.co/u/Adren)\ **Replies:** 1\ **Last updated:** [February 16, 2018, 1:48pm UTC](https://discuss.elastic.co/t/cant-launch-elasticsearch-in-centos/120170 "2018-02-16T13:48:20Z")
Hello, As the tilte says I can't start elasticsearch with Centos, when I try to launch it with an user it says "Java.nio.file.AccessDeniedException: /home/project/elasticsearch/config.jvm.options" And when I try with … --- ## [Search rate in Monitoring down to 0 when switching aliases](https://discuss.elastic.co/t/search-rate-in-monitoring-down-to-0-when-switching-aliases/120174)
**Author:** [@jomarl](https://discuss.elastic.co/u/jomarl)\ **Replies:** 0\ **Last updated:** [February 16, 2018, 1:16pm UTC](https://discuss.elastic.co/t/search-rate-in-monitoring-down-to-0-when-switching-aliases/120174 "2018-02-16T13:16:09Z")
Hi, I've noticed that the search rate in Monitoring tend to drop down to 0/s just after switching an alias to point to a newly created index. Do anybody know if this is a known "bug/feature" in Monitoring or something t… --- ## [Reindex while writing to index](https://discuss.elastic.co/t/reindex-while-writing-to-index/120167)
**Author:** [@tweissin](https://discuss.elastic.co/u/tweissin)\ **Replies:** 0\ **Last updated:** [February 16, 2018, 12:35pm UTC](https://discuss.elastic.co/t/reindex-while-writing-to-index/120167 "2018-02-16T12:35:21Z")
I am trying to reindex one index to a new index, while indexing on the source index is in progress, with the intention of switching over the application to use the new index. In other words, I want the switch-over to be… --- ## [Elasticsearch startup issues while upgrade from v2.2.3 to v5.6.7](https://discuss.elastic.co/t/elasticsearch-startup-issues-while-upgrade-from-v2-2-3-to-v5-6-7/120163)
**Author:** [@bhaskar.mittal](https://discuss.elastic.co/u/bhaskar.mittal)\ **Replies:** 0\ **Last updated:** [February 16, 2018, 12:19pm UTC](https://discuss.elastic.co/t/elasticsearch-startup-issues-while-upgrade-from-v2-2-3-to-v5-6-7/120163 "2018-02-16T12:19:28Z")
Hello, We have upgraded our Elasticsearch component from v2.2.3 to v5.6.7. Post upgrade the elasticsearch process is not getting restarted. We are not getting any elasticsearcglogs and it's failing to start. We are al… --- ## [Aggregation from multiple indicates](https://discuss.elastic.co/t/aggregation-from-multiple-indicates/120150)
**Author:** [@Amir\_Salar\_Pourhasan](https://discuss.elastic.co/u/Amir_Salar_Pourhasan)\ **Replies:** 0\ **Last updated:** [February 16, 2018, 10:55am UTC](https://discuss.elastic.co/t/aggregation-from-multiple-indicates/120150 "2018-02-16T10:55:04Z")
Hi I\`m new in ES and I have an important question. I have 2 collections in MongoDB "matches" and "countries" for example: matches (collection) : { \_id : 11111, name: "team1", game: "Cup1" country\_id… --- ## [How to query for empty field or specific value](https://discuss.elastic.co/t/how-to-query-for-empty-field-or-specific-value/119623)
**Author:** [@andresilveira](https://discuss.elastic.co/u/andresilveira)\ **Replies:** 2\ **Last updated:** [February 16, 2018, 10:56am UTC](https://discuss.elastic.co/t/how-to-query-for-empty-field-or-specific-value/119623 "2018-02-16T10:56:36Z")
I'm trying to write a query to achieve the following result: field1: value1 AND field2: value2 OR "" (empty) I've tried the following but it always returns me empty results: { "\_source": \["field1", "field2"\], "q… --- ## [Remove duplicates after bulk insert exploiting ES power](https://discuss.elastic.co/t/remove-duplicates-after-bulk-insert-exploiting-es-power/120144)
**Author:** [@tab](https://discuss.elastic.co/u/tab)\ **Replies:** 0\ **Last updated:** [February 16, 2018, 10:10am UTC](https://discuss.elastic.co/t/remove-duplicates-after-bulk-insert-exploiting-es-power/120144 "2018-02-16T10:10:25Z")
Hello, I have an index of this type: { "email": email, "data": { domain: \[{ "purchase\_date": date, "amount": amount, }\] } And this is my Python method which inserts data into ES: # @insert into db def line2json… --- ## [Having 2 threshold values in the same alert (one for start firing and one for stop firing)](https://discuss.elastic.co/t/having-2-threshold-values-in-the-same-alert-one-for-start-firing-and-one-for-stop-firing/120137)
**Author:** [@romanuf](https://discuss.elastic.co/u/romanuf)\ **Replies:** 0\ **Last updated:** [February 16, 2018, 9:49am UTC](https://discuss.elastic.co/t/having-2-threshold-values-in-the-same-alert-one-for-start-firing-and-one-for-stop-firing/120137 "2018-02-16T09:49:22Z")
Hello, I want to create a CPU watcher that will start firing when the CPU is above 80% and will continue firing until the CPU will be bellow 60% for example. Can anyone help me with this please? Thanks --- ## [Query NOT in Metric](https://discuss.elastic.co/t/query-not-in-metric/120029)
**Author:** [@Thuy\_Le](https://discuss.elastic.co/u/Thuy_Le)\ **Replies:** 6\ **Last updated:** [February 16, 2018, 9:42am UTC](https://discuss.elastic.co/t/query-not-in-metric/120029 "2018-02-16T09:42:15Z")
tags.keyword!=D8 or tags.keyword NOT D8 are not work??? --- ## [Conflicts with existing mapping](https://discuss.elastic.co/t/conflicts-with-existing-mapping/119727)
**Author:** [@aneesh](https://discuss.elastic.co/u/aneesh)\ **Replies:** 23\ **Last updated:** [February 16, 2018, 9:38am UTC](https://discuss.elastic.co/t/conflicts-with-existing-mapping/119727 "2018-02-16T09:38:06Z")
Hi while doing PutMappuing i am getting following error "Mapper for \[uUserId\] conflicts with existing mapping in other types:\\n\[mapper \[uUserId\] has different \[analyzer\], mapper \[uUserId\] is used by multiple types. Set… --- ## [High-level-client never close connection](https://discuss.elastic.co/t/high-level-client-never-close-connection/119268)
**Author:** [@Derrick](https://discuss.elastic.co/u/Derrick)\ **Replies:** 1\ **Last updated:** [February 16, 2018, 9:34am UTC](https://discuss.elastic.co/t/high-level-client-never-close-connection/119268 "2018-02-16T09:34:36Z")
Hi, I have one server running and doing CRUD on ES 5.6, but there are so many connections being opened, looks like it is never released, any idea? This is the jstack log "elasticsearch\[high-level-client\]\[scheduler\]\[T#… --- ## [Missing plugin-descriptor.properties](https://discuss.elastic.co/t/missing-plugin-descriptor-properties/120122)
**Author:** [@ryext](https://discuss.elastic.co/u/ryext)\ **Replies:** 10\ **Last updated:** [February 16, 2018, 9:30am UTC](https://discuss.elastic.co/t/missing-plugin-descriptor-properties/120122 "2018-02-16T09:30:12Z")
hey, i am trying to install x-pack plugin. Here is my command: ./elasticsearch-plugin install file:///home/admin/Downloads/x-pack-6.2.1.zip Once i execute i get the following error: Exception in thread "main" java.ni… --- ## [GC overhead each day at new index creation](https://discuss.elastic.co/t/gc-overhead-each-day-at-new-index-creation/119675)
**Author:** [@jujugrrr](https://discuss.elastic.co/u/jujugrrr)\ **Replies:** 1\ **Last updated:** [February 16, 2018, 9:20am UTC](https://discuss.elastic.co/t/gc-overhead-each-day-at-new-index-creation/119675 "2018-02-16T09:20:03Z")
Hi, We use elasticsearch for logstash only. We have a cluster of 8 nodes, everyday from midnight (when logstash creates a new index, default logstash-yyyy-mm-dd pattern), the whole cluster is getting crazy and start to… --- ## [Indexing of a two documents with same ID at the same time](https://discuss.elastic.co/t/indexing-of-a-two-documents-with-same-id-at-the-same-time/119609)
**Author:** [@Mohammed\_Ferjani](https://discuss.elastic.co/u/Mohammed_Ferjani)\ **Replies:** 1\ **Last updated:** [February 16, 2018, 9:17am UTC](https://discuss.elastic.co/t/indexing-of-a-two-documents-with-same-id-at-the-same-time/119609 "2018-02-16T09:17:01Z")
Hi I'm using elastic search 5.3 and facing an issue. We are actually using the index API with optimistic concurrency control and do not see any VersionConflictEngineException in our logs. To give you more details abou… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1784) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1786)