# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1787 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1788 --- ## [\_id range query \[v6.1.x\]](https://discuss.elastic.co/t/id-range-query-v6-1-x/118046)
**Author:** [@andfk](https://discuss.elastic.co/u/andfk)\ **Replies:** 3\ **Last updated:** [February 15, 2018, 3:09pm UTC](https://discuss.elastic.co/t/id-range-query-v6-1-x/118046 "2018-02-15T15:09:24Z")
Hi, I would like to query by range for the "\_id" property. I tried adding the "\_id" on index time but as for v6.1.x is already added is not needed. I tried to query using a range but an exception is thrown with reason: … --- ## [Write and flush on the network layer failed](https://discuss.elastic.co/t/write-and-flush-on-the-network-layer-failed/119897)
**Author:** [@bladerunner512](https://discuss.elastic.co/u/bladerunner512)\ **Replies:** 2\ **Last updated:** [February 15, 2018, 3:05pm UTC](https://discuss.elastic.co/t/write-and-flush-on-the-network-layer-failed/119897 "2018-02-15T15:05:02Z")
Unable to get Docker ELK cluster working with 2 hosts. Both hosts have same response: user01@dcw0970:~/docker-elk-master$ docker logs dockerelkmaster\_elasticsearch\_1 \[2018-02-15T01:33:13,054\]\[INFO \]\[o.e.n.Node … --- ## [Shared field for all the documents](https://discuss.elastic.co/t/shared-field-for-all-the-documents/120010)
**Author:** [@Hrachya\_Yeghishyan](https://discuss.elastic.co/u/Hrachya_Yeghishyan)\ **Replies:** 0\ **Last updated:** [February 15, 2018, 2:40pm UTC](https://discuss.elastic.co/t/shared-field-for-all-the-documents/120010 "2018-02-15T14:40:57Z")
Hi all, I'd like to know if it is possible to have a field, which would be available for all the documents inside one index and having the same type? I understand that there could be an obvious method (though utterly un… --- ## [Data Transfer MySQL](https://discuss.elastic.co/t/data-transfer-mysql/119909)
**Author:** [@josempolm](https://discuss.elastic.co/u/josempolm)\ **Replies:** 8\ **Last updated:** [February 15, 2018, 2:33pm UTC](https://discuss.elastic.co/t/data-transfer-mysql/119909 "2018-02-15T14:33:29Z")
Hello there, How can I transfer data from Elasticsearch to MySQL? Best regards. --- ## [I am getting "json\_parse\_exception"](https://discuss.elastic.co/t/i-am-getting-json-parse-exception/119991)
**Author:** [@Anilg](https://discuss.elastic.co/u/Anilg)\ **Replies:** 4\ **Last updated:** [February 15, 2018, 2:17pm UTC](https://discuss.elastic.co/t/i-am-getting-json-parse-exception/119991 "2018-02-15T14:17:20Z")
$ curl -H 'Content-Type: application/x-ndjson' -XPOST 'localhost:9200/\_bulk?pretty' --data-binary @satendra.log { "error" : { "root\_cause" : \[ { "type" : "json\_parse\_exception", "reason" : "Illegal character ((CTRL… --- ## [Unable to Setup Watcher in 6.2.1](https://discuss.elastic.co/t/unable-to-setup-watcher-in-6-2-1/119879)
**Author:** [@dkris1](https://discuss.elastic.co/u/dkris1)\ **Replies:** 7\ **Last updated:** [February 15, 2018, 1:49pm UTC](https://discuss.elastic.co/t/unable-to-setup-watcher-in-6-2-1/119879 "2018-02-15T13:49:34Z")
Hi all, I have upgraded ELK from 6.0 to 6.2.1 and im trying to setup my first watcher. How ever it fails. following is the error. "{ "error": { "root\_cause": \[ { "type": "illegal\_argument\_exception", "reason": "Re… --- ## [Efficient date difference at document upsert](https://discuss.elastic.co/t/efficient-date-difference-at-document-upsert/119823)
**Author:** [@DidierB](https://discuss.elastic.co/u/DidierB)\ **Replies:** 1\ **Last updated:** [February 15, 2018, 1:47pm UTC](https://discuss.elastic.co/t/efficient-date-difference-at-document-upsert/119823 "2018-02-15T13:47:22Z")
Hello, I would like to make thousands of upsert and computing a time difference between the document already indexed (not with a time-based key but with an id key) and an already stored date, so I can tell what was the … --- ## [Is it possible to sort by values of different children?](https://discuss.elastic.co/t/is-it-possible-to-sort-by-values-of-different-children/119989)
**Author:** [@mpritsch](https://discuss.elastic.co/u/mpritsch)\ **Replies:** 0\ **Last updated:** [February 15, 2018, 1:14pm UTC](https://discuss.elastic.co/t/is-it-possible-to-sort-by-values-of-different-children/119989 "2018-02-15T13:14:12Z")
We already managed to sort the parent by values of a single child using this workaround (https://www.elastic.co/guide/en/elasticsearch/reference/6.2/query-dsl-has-child-query.html#\_sorting). Now we want to sort the pare… --- ## [Issue adding master only node -- path.repo not set?](https://discuss.elastic.co/t/issue-adding-master-only-node-path-repo-not-set/119716)
**Author:** [@corona](https://discuss.elastic.co/u/corona)\ **Replies:** 5\ **Last updated:** [February 15, 2018, 1:29pm UTC](https://discuss.elastic.co/t/issue-adding-master-only-node-path-repo-not-set/119716 "2018-02-15T13:29:18Z")
Hi, I would like to add 3 dedicated master only nodes to my cluster. I'd like to transition my existing master/data nodes to be data node only. However, the first step I took was to try adding a master only node to my … --- ## [Get specific flieds](https://discuss.elastic.co/t/get-specific-flieds/119984)
**Author:** [@devil\_srj7](https://discuss.elastic.co/u/devil_srj7)\ **Replies:** 1\ **Last updated:** [February 15, 2018, 12:54pm UTC](https://discuss.elastic.co/t/get-specific-flieds/119984 "2018-02-15T12:54:25Z")
I need to get specific fields rather than getting all the values in hits. --- ## [Failed to connect to master node](https://discuss.elastic.co/t/failed-to-connect-to-master-node/119754)
**Author:** [@sbu](https://discuss.elastic.co/u/sbu)\ **Replies:** 2\ **Last updated:** [February 15, 2018, 11:58am UTC](https://discuss.elastic.co/t/failed-to-connect-to-master-node/119754 "2018-02-15T11:58:06Z")
Hi, We are having problems setting up a cluster on Azure using docker. We are using three docker run commands to start each of the nodes, along the lines of :- sudo docker run --net=bridge -d -e "node.master=true" -e "… --- ## [Elasticdump write 0 for sent 100 into elasticsearch](https://discuss.elastic.co/t/elasticdump-write-0-for-sent-100-into-elasticsearch/119964)
**Author:** [@Tushar\_Sharma1](https://discuss.elastic.co/u/Tushar_Sharma1)\ **Replies:** 0\ **Last updated:** [February 15, 2018, 11:14am UTC](https://discuss.elastic.co/t/elasticdump-write-0-for-sent-100-into-elasticsearch/119964 "2018-02-15T11:14:23Z")
Continuing the discussion from Elasticdump fails to write back into elasticsearch: Sol:Upgrade elasticdump using command given as:- npm install elasticdump -g --- ## [How to install marvel in elastic (6.1.2) version](https://discuss.elastic.co/t/how-to-install-marvel-in-elastic-6-1-2-version/119896)
**Author:** [@venkat545](https://discuss.elastic.co/u/venkat545)\ **Replies:** 5\ **Last updated:** [February 15, 2018, 10:19am UTC](https://discuss.elastic.co/t/how-to-install-marvel-in-elastic-6-1-2-version/119896 "2018-02-15T10:19:12Z")
Unable to install marvel i am following this link https://www.elastic.co/guide/en/marvel/current/installing-marvel.html... i am facing issue at while installing 'marvel agent' can anyone suggest me how to solve this … --- ## [Unable to connect to AWS hosted elasticsearch from spark hadoop with 403 forbidden error](https://discuss.elastic.co/t/unable-to-connect-to-aws-hosted-elasticsearch-from-spark-hadoop-with-403-forbidden-error/119946)
**Author:** [@Sathish4k](https://discuss.elastic.co/u/Sathish4k)\ **Replies:** 0\ **Last updated:** [February 15, 2018, 9:11am UTC](https://discuss.elastic.co/t/unable-to-connect-to-aws-hosted-elasticsearch-from-spark-hadoop-with-403-forbidden-error/119946 "2018-02-15T09:11:33Z")
Im trying to connect to a AWS hosted elastic search and I am able to connect to the ES host, but getting a 403 forbidden error. This is how I connect to ES from spark shell val conf = new SparkConf() conf.set("spark.… --- ## [Is it good to clone & abstract a document to a new index for 1 search api?](https://discuss.elastic.co/t/is-it-good-to-clone-abstract-a-document-to-a-new-index-for-1-search-api/119942)
**Author:** [@michaelcheung](https://discuss.elastic.co/u/michaelcheung)\ **Replies:** 0\ **Last updated:** [February 15, 2018, 8:36am UTC](https://discuss.elastic.co/t/is-it-good-to-clone-abstract-a-document-to-a-new-index-for-1-search-api/119942 "2018-02-15T08:36:56Z")
Hi, I have an index keeps on indexing docs which are my server logs (e.g. user activities, transaction activities, system jobs, etc). And my server needs to later query back ES by doc\_id to get a transaction's info. Sh… --- ## [Sorting by \_meta fields](https://discuss.elastic.co/t/sorting-by-meta-fields/119938)
**Author:** [@vsevolodk](https://discuss.elastic.co/u/vsevolodk)\ **Replies:** 0\ **Last updated:** [February 15, 2018, 8:28am UTC](https://discuss.elastic.co/t/sorting-by-meta-fields/119938 "2018-02-15T08:28:13Z")
Hello, please help. I have three indices A, B, C and I need multiple search with sorting by index order B, A, C. So lexicographical sorting result is not suitable and I want create \_meta field for order B - 1 A - 2 … --- ## [EC2 discovery not working with Elasticsearch v6](https://discuss.elastic.co/t/ec2-discovery-not-working-with-elasticsearch-v6/119930)
**Author:** [@vikaslalwani](https://discuss.elastic.co/u/vikaslalwani)\ **Replies:** 2\ **Last updated:** [February 15, 2018, 8:07am UTC](https://discuss.elastic.co/t/ec2-discovery-not-working-with-elasticsearch-v6/119930 "2018-02-15T08:07:27Z")
This is my ES config for discovery. Not sure what I am doing wrong here. Tried uncommenting the aws region but that did not work as well. Any help would be appreciated. Thanks discovery.zen.hosts\_provider: ec2 discovery… --- ## [Filter ids across multiple indexes](https://discuss.elastic.co/t/filter-ids-across-multiple-indexes/119768)
**Author:** [@NomNomCameron](https://discuss.elastic.co/u/NomNomCameron)\ **Replies:** 7\ **Last updated:** [February 15, 2018, 7:46am UTC](https://discuss.elastic.co/t/filter-ids-across-multiple-indexes/119768 "2018-02-15T07:46:08Z")
I'm querying all searchable fields across all indexes and need to filter certain ids of documents returned from different indexes, how would I be able to filter/query for these kinds of results? --- ## [Help writing Watcher](https://discuss.elastic.co/t/help-writing-watcher/119803)
**Author:** [@Adren](https://discuss.elastic.co/u/Adren)\ **Replies:** 11\ **Last updated:** [February 15, 2018, 7:36am UTC](https://discuss.elastic.co/t/help-writing-watcher/119803 "2018-02-15T07:36:08Z")
Hello, I have troubles writing a watcher which will watch (obviously) a field in my logs. I have a field called "sev" who has a number for each log, and I want to monitore it. For Example if I have sev = 1. It'll send m… --- ## [.kibana is missing in docker elasticsearch](https://discuss.elastic.co/t/kibana-is-missing-in-docker-elasticsearch/119912)
**Author:** [@RamyaGowda](https://discuss.elastic.co/u/RamyaGowda)\ **Replies:** 4\ **Last updated:** [February 15, 2018, 7:27am UTC](https://discuss.elastic.co/t/kibana-is-missing-in-docker-elasticsearch/119912 "2018-02-15T07:27:14Z")
Hi, I Configured Elasticsearch(6.1.3) and kibana(6.1.3) in docker, both are running in separate containers , now the issue is i couldn't find .kiaban index in elasticsearch. what mistake i have done? curl -XGET http:… --- ## [How to test log rolling and deletion in elasticsearch with log4j2.properties?](https://discuss.elastic.co/t/how-to-test-log-rolling-and-deletion-in-elasticsearch-with-log4j2-properties/115117)
**Author:** [@sonfrau](https://discuss.elastic.co/u/sonfrau)\ **Replies:** 6\ **Last updated:** [February 15, 2018, 7:25am UTC](https://discuss.elastic.co/t/how-to-test-log-rolling-and-deletion-in-elasticsearch-with-log4j2-properties/115117 "2018-02-15T07:25:51Z")
Hello, We're using ES 6.1.1. We want to delete logs which matching whatever of these two conditions: size and age. For that, we have changed log4j2.properties file such as: appender.rolling.strategy.type = DefaultRo… --- ## [Recommended configuration for elasticstack](https://discuss.elastic.co/t/recommended-configuration-for-elasticstack/119921)
**Author:** [@SRIpandu1729](https://discuss.elastic.co/u/SRIpandu1729)\ **Replies:** 0\ **Last updated:** [February 15, 2018, 6:49am UTC](https://discuss.elastic.co/t/recommended-configuration-for-elasticstack/119921 "2018-02-15T06:49:18Z")
Hello, I am using Elasticstack to visualise my log data. My log data is iis server log data and after each day a dump for that day is collected from the server at the end of the day and using Logstash the data is indexe… --- ## [Disable score for multiple matched ngrams](https://discuss.elastic.co/t/disable-score-for-multiple-matched-ngrams/114220)
**Author:** [@mstkk](https://discuss.elastic.co/u/mstkk)\ **Replies:** 7\ **Last updated:** [February 15, 2018, 6:30am UTC](https://discuss.elastic.co/t/disable-score-for-multiple-matched-ngrams/114220 "2018-02-15T06:30:05Z")
"\_source": { "suggestion\_id": "35\_8\_14", "suggestion\_headerText": "İzmir kiralık Konut", "suggestion\_hierarchy": "İzmir \> kiralık \> Konut", "suggestion\_detailUrl": "?city=35&catego… --- ## [How can I easily convert logstash filters with grok to ingest pipelines?](https://discuss.elastic.co/t/how-can-i-easily-convert-logstash-filters-with-grok-to-ingest-pipelines/119704)
**Author:** [@ujjain](https://discuss.elastic.co/u/ujjain)\ **Replies:** 2\ **Last updated:** [February 15, 2018, 6:17am UTC](https://discuss.elastic.co/t/how-can-i-easily-convert-logstash-filters-with-grok-to-ingest-pipelines/119704 "2018-02-15T06:17:49Z")
Logstash has ingest-convert.sh to convert ingest pipelines to Logstash, but I'd like to convert the other way around. I have the 23-Tomcat-filters and grok\_patterns file. Is there any smart way that would save me time … --- ## [Delete documents](https://discuss.elastic.co/t/delete-documents/119745)
**Author:** [@Pororo](https://discuss.elastic.co/u/Pororo)\ **Replies:** 3\ **Last updated:** [February 15, 2018, 4:47am UTC](https://discuss.elastic.co/t/delete-documents/119745 "2018-02-15T04:47:30Z")
Hi, I am kinda confused about the operation of deleting in ES. If I import a json file which contains several items to ES thru logstash, also specify the index as "sampledata". Later on, I wanted to delete what I import… --- ## [Search query performance](https://discuss.elastic.co/t/search-query-performance/119753)
**Author:** [@FedorZaytsev](https://discuss.elastic.co/u/FedorZaytsev)\ **Replies:** 3\ **Last updated:** [February 15, 2018, 3:55am UTC](https://discuss.elastic.co/t/search-query-performance/119753 "2018-02-15T03:55:43Z")
Hi. I have an index of ~10 million users messages. I need to count all unread messages for one particular user (so I need to count all documents where userId = "SOMEID" and is\_read = false). Right now I am using SearchQu… --- ## [Active Directory Realm Authentication Issue](https://discuss.elastic.co/t/active-directory-realm-authentication-issue/119856)
**Author:** [@navnith](https://discuss.elastic.co/u/navnith)\ **Replies:** 1\ **Last updated:** [February 15, 2018, 2:39am UTC](https://discuss.elastic.co/t/active-directory-realm-authentication-issue/119856 "2018-02-15T02:39:36Z")
Environment: ELK Version: 6.1.3 Setup : Docker containers created with official images from elastic Hi All, I am trying to configure active directory realm to work with Global catalog of our companies Active directo… --- ## [Is it mandatory to install X-Pack on logstash in order to output to X-Pack'd Elasticsearch?](https://discuss.elastic.co/t/is-it-mandatory-to-install-x-pack-on-logstash-in-order-to-output-to-x-packd-elasticsearch/119875)
**Author:** [@Rodolfo\_Albuquerque](https://discuss.elastic.co/u/Rodolfo_Albuquerque)\ **Replies:** 1\ **Last updated:** [February 15, 2018, 2:23am UTC](https://discuss.elastic.co/t/is-it-mandatory-to-install-x-pack-on-logstash-in-order-to-output-to-x-packd-elasticsearch/119875 "2018-02-15T02:23:44Z")
Hey Guys, So recently I installed X-Pack on Elasticsearch and Kibana and I'm now getting an error when trying to output to Elasticsearch from Logstash. I was wondering if X-Pack has anything to do with it, and if it do… --- ## [Index stops accepting writes after applying filebeat index template](https://discuss.elastic.co/t/index-stops-accepting-writes-after-applying-filebeat-index-template/119853)
**Author:** [@dis\_manoli](https://discuss.elastic.co/u/dis_manoli)\ **Replies:** 6\ **Last updated:** [February 14, 2018, 9:58pm UTC](https://discuss.elastic.co/t/index-stops-accepting-writes-after-applying-filebeat-index-template/119853 "2018-02-14T21:58:36Z")
So I'm using AWS Elasticsearch (which is currently at version 6.0.1). I use filebeat (6.1.0) to send logs to logstash (6.2.0), which uses the https://github.com/awslabs/logstash-output-amazon\_es output plugin to write t… --- ## [How to run cross cluster search across local and remote indices](https://discuss.elastic.co/t/how-to-run-cross-cluster-search-across-local-and-remote-indices/117997)
**Author:** [@bbailey](https://discuss.elastic.co/u/bbailey)\ **Replies:** 3\ **Last updated:** [February 14, 2018, 10:30pm UTC](https://discuss.elastic.co/t/how-to-run-cross-cluster-search-across-local-and-remote-indices/117997 "2018-02-14T22:30:02Z")
I am trying to setup my environment so that I can switch from using tribe nodes to use cross cluster search and running in to a few problems After some useful feedback in this forum I have configured my system with kiba… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1786) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1788)