# Elasticsearch

**URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1788

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 1789

---

## [Wildcard query on \_id failing in 6.1.2](https://discuss.elastic.co/t/wildcard-query-on-id-failing-in-6-1-2/119816)

<div class="topic-metadata">

**Author:** [@Srikanth\_Bemineni](https://discuss.elastic.co/u/Srikanth_Bemineni)\
**Replies:** 3\
**Last updated:** [February 14, 2018, 9:15pm UTC](https://discuss.elastic.co/t/wildcard-query-on-id-failing-in-6-1-2/119816 "2018-02-14T21:15:21Z")

</div>

Hi, I recently moved from elastic search 5.5 to 6.1.2. After moving to the new version, all elastic search wildcard queries on \_id is not returning any hits. This code used to work in 5.5. We verified this using my app…

---

## [Send alerts to elasticsearch index with YYYY-MM placeholder](https://discuss.elastic.co/t/send-alerts-to-elasticsearch-index-with-yyyy-mm-placeholder/119854)

<div class="topic-metadata">

**Author:** [@Matthew\_Field](https://discuss.elastic.co/u/Matthew_Field)\
**Replies:** 1\
**Last updated:** [February 14, 2018, 8:13pm UTC](https://discuss.elastic.co/t/send-alerts-to-elasticsearch-index-with-yyyy-mm-placeholder/119854 "2018-02-14T20:13:56Z")

</div>

I am trying to send x pack watcher alerts to an index using YYYY-MM-dd placeholders similar to the way I do in logstash. eg. my-index-2018-01-01 , my-index-2018-01-02 etc. as a function of todays date. Something li…

---

## [Overhead and heap issues](https://discuss.elastic.co/t/overhead-and-heap-issues/117888)

<div class="topic-metadata">

**Author:** [@Callahan](https://discuss.elastic.co/u/Callahan)\
**Replies:** 6\
**Last updated:** [February 14, 2018, 7:07pm UTC](https://discuss.elastic.co/t/overhead-and-heap-issues/117888 "2018-02-14T19:07:43Z")

</div>

Hi all, I'm having big problems with Java Heap size and my 3 Elastic nodes running out of space. I've been running with the default 1gig setup but as that started to fill, I've increased it to 4gig (half of the availab…

---

## [Wildcarded query make elasticsearch cluster unresponsive](https://discuss.elastic.co/t/wildcarded-query-make-elasticsearch-cluster-unresponsive/119729)

<div class="topic-metadata">

**Author:** [@Sriram\_P](https://discuss.elastic.co/u/Sriram_P)\
**Replies:** 5\
**Last updated:** [February 14, 2018, 7:03pm UTC](https://discuss.elastic.co/t/wildcarded-query-make-elasticsearch-cluster-unresponsive/119729 "2018-02-14T19:03:18Z")

</div>

I run the query below on a large elastic search cluster. The cluster bcomes unresponsive { "size": 10000, "query": { "bool": { "must": \[ { "regexp": { "message": { …

---

## [Uncaught TypeError: Cannot read property 'Client' of undefined](https://discuss.elastic.co/t/uncaught-typeerror-cannot-read-property-client-of-undefined/119863)

<div class="topic-metadata">

**Author:** [@rolfrennemo](https://discuss.elastic.co/u/rolfrennemo)\
**Replies:** 0\
**Last updated:** [February 14, 2018, 6:29pm UTC](https://discuss.elastic.co/t/uncaught-typeerror-cannot-read-property-client-of-undefined/119863 "2018-02-14T18:29:12Z")

</div>

I'm running version 5.6.7 and have an issue I can't solve. See enclosed screenshots. \[image\] \[image\] Apreciate if someone has a tip for me. Regards Rolf

---

## [SSL config to ignore validation](https://discuss.elastic.co/t/ssl-config-to-ignore-validation/119551)

<div class="topic-metadata">

**Author:** [@GSCully](https://discuss.elastic.co/u/GSCully)\
**Replies:** 5\
**Last updated:** [February 14, 2018, 6:18pm UTC](https://discuss.elastic.co/t/ssl-config-to-ignore-validation/119551 "2018-02-14T18:18:05Z")

</div>

I want to encrypt the data from Filebeat to Logstash using SSL but I don't want to enforce validating the certificate. Is that possible? I am trying to avoid generating/buying a ssl for each filebeat host. If I remove t…

---

## [Index/Template Question After Upgrade (Single Type)](https://discuss.elastic.co/t/index-template-question-after-upgrade-single-type/117642)

<div class="topic-metadata">

**Author:** [@Daniel\_Sanchez](https://discuss.elastic.co/u/Daniel_Sanchez)\
**Replies:** 2\
**Last updated:** [February 14, 2018, 6:02pm UTC](https://discuss.elastic.co/t/index-template-question-after-upgrade-single-type/117642 "2018-02-14T18:02:04Z")

</div>

OK, so I see that new ELK doesn't have multiple mapping types. Had tons of errors, and believed I fixed it by removing the additional types being added at my logstash level. However, although all my data appears to be …

---

## [Bug: X-Pack install via Puppet breaks ES startup after meta-plugin introduction in 6.2.0](https://discuss.elastic.co/t/bug-x-pack-install-via-puppet-breaks-es-startup-after-meta-plugin-introduction-in-6-2-0/119477)

<div class="topic-metadata">

**Author:** [@st0nez](https://discuss.elastic.co/u/st0nez)\
**Replies:** 3\
**Last updated:** [February 14, 2018, 5:48pm UTC](https://discuss.elastic.co/t/bug-x-pack-install-via-puppet-breaks-es-startup-after-meta-plugin-introduction-in-6-2-0/119477 "2018-02-14T17:48:17Z")

</div>

Tested on Ubuntu 16.04, Elasticsearch/X-pack 6.2.0 and 6.2.1, puppet module elastic-elasticsearch v6.2.0. Issue: 6.2.0 included this merge regarding meta-plugins. When installing x-pack (a meta-plugin) via puppet, a fi…

---

## [Search hits used as filter](https://discuss.elastic.co/t/search-hits-used-as-filter/119831)

<div class="topic-metadata">

**Author:** [@Hrachya\_Yeghishyan](https://discuss.elastic.co/u/Hrachya_Yeghishyan)\
**Replies:** 3\
**Last updated:** [February 14, 2018, 4:58pm UTC](https://discuss.elastic.co/t/search-hits-used-as-filter/119831 "2018-02-14T16:58:29Z")

</div>

Hi all, I wonder whether there is a feature in ES that allows to use search hits of an index as filters of a query on a completely different index. I'll try to describe what i need on an example, in order to be more cl…

---

## [Fetch @timestamp as epoch via docvalue\_field in 6.x Elasticsearch query](https://discuss.elastic.co/t/fetch-timestamp-as-epoch-via-docvalue-field-in-6-x-elasticsearch-query/119845)

<div class="topic-metadata">

**Author:** [@Chaitra\_Ranganna](https://discuss.elastic.co/u/Chaitra_Ranganna)\
**Replies:** 0\
**Last updated:** [February 14, 2018, 4:35pm UTC](https://discuss.elastic.co/t/fetch-timestamp-as-epoch-via-docvalue-field-in-6-x-elasticsearch-query/119845 "2018-02-14T16:35:45Z")

</div>

Hi, In 5.x we used to fetch @timestamp as epoch using docvalue\_field in the query. We have upgraded to 6.x from 5.x and seeing that @timestamp is in text format even though we use docvalues\_field in 6.x. Could you hel…

---

## [Logstash-Elastic problems](https://discuss.elastic.co/t/logstash-elastic-problems/119844)

<div class="topic-metadata">

**Author:** [@Ninoslav](https://discuss.elastic.co/u/Ninoslav)\
**Replies:** 0\
**Last updated:** [February 14, 2018, 4:30pm UTC](https://discuss.elastic.co/t/logstash-elastic-problems/119844 "2018-02-14T16:30:53Z")

</div>

Hi gys, I am using ELK stack 6.0, and it worked nice, till 2 day before, I have obviosuly done something rly wrong, and my logstash is not working correctly. My logstash log got flooded with logs like: \[2018-02-14T1…

---

## [ES 6.0 Is still recommendable to create indices per date](https://discuss.elastic.co/t/es-6-0-is-still-recommendable-to-create-indices-per-date/119843)

<div class="topic-metadata">

**Author:** [@elpaisa](https://discuss.elastic.co/u/elpaisa)\
**Replies:** 0\
**Last updated:** [February 14, 2018, 4:29pm UTC](https://discuss.elastic.co/t/es-6-0-is-still-recommendable-to-create-indices-per-date/119843 "2018-02-14T16:29:57Z")

</div>

Hi, back in the versions 2.x of elasticsearch i read that it was convenient creating indices per date, i think that helped our curator to delete old indices, i adopted creating indices daily, '2018.01.01' now i'm switchi…

---

## [\_search API - why doesn't it return version by default?](https://discuss.elastic.co/t/search-api-why-doesnt-it-return-version-by-default/119842)

<div class="topic-metadata">

**Author:** [@Jay\_Hilden](https://discuss.elastic.co/u/Jay_Hilden)\
**Replies:** 0\
**Last updated:** [February 14, 2018, 4:21pm UTC](https://discuss.elastic.co/t/search-api-why-doesnt-it-return-version-by-default/119842 "2018-02-14T16:21:53Z")

</div>

When using the \_search API if you want the version number of every record to be returned you need to specify that directly. source GET /\_search { "version": true, "query" : { "term" …

---

## [Reindex error: Failed to parse content to map](https://discuss.elastic.co/t/reindex-error-failed-to-parse-content-to-map/119841)

<div class="topic-metadata">

**Author:** [@narschang](https://discuss.elastic.co/u/narschang)\
**Replies:** 0\
**Last updated:** [February 14, 2018, 4:19pm UTC](https://discuss.elastic.co/t/reindex-error-failed-to-parse-content-to-map/119841 "2018-02-14T16:19:18Z")

</div>

I followed the instruction in this page to manually reindex the Kibana index to get ready to upgrade our Elasticsearch server from 5.6.7 to 6.x. The first step (Set .kibana index to read-only) went ok, but I got an erro…

---

## [Handshake failed. unexpected remote node](https://discuss.elastic.co/t/handshake-failed-unexpected-remote-node/117082)

<div class="topic-metadata">

**Author:** [@Ujaku\_San](https://discuss.elastic.co/u/Ujaku_San)\
**Replies:** 2\
**Last updated:** [February 14, 2018, 3:56pm UTC](https://discuss.elastic.co/t/handshake-failed-unexpected-remote-node/117082 "2018-02-14T15:56:47Z")

</div>

Hi, using the elasticsearch docker image docker.elastic.co/elasticsearch/elasticsearch:6.1.2 I can't connect two nodes on different digitalocean droplets. I've created both containers with: droplet1: docker run -d -p …

---

## [Setting HEAP SIZE and one node doesn't get it](https://discuss.elastic.co/t/setting-heap-size-and-one-node-doesnt-get-it/119797)

<div class="topic-metadata">

**Author:** [@Juanps2](https://discuss.elastic.co/u/Juanps2)\
**Replies:** 1\
**Last updated:** [February 14, 2018, 2:49pm UTC](https://discuss.elastic.co/t/setting-heap-size-and-one-node-doesnt-get-it/119797 "2018-02-14T14:49:14Z")

</div>

Hi, I have 4 nodes and I'm setting HEAP SIZE in jvm.options file as follow. The serves have 8GB and I want to setup with 4GB -Xms4g -Xmx4g In three of them is working right but in one node the value is not set as I w…

---

## [What can I expect after restoring a snapshot?](https://discuss.elastic.co/t/what-can-i-expect-after-restoring-a-snapshot/119666)

<div class="topic-metadata">

**Author:** [@Marco\_Costantini](https://discuss.elastic.co/u/Marco_Costantini)\
**Replies:** 5\
**Last updated:** [February 14, 2018, 1:59pm UTC](https://discuss.elastic.co/t/what-can-i-expect-after-restoring-a-snapshot/119666 "2018-02-14T13:59:53Z")

</div>

I have put in place a snapshot restoration process. It's great, but I've chosen to delete the indices first (as opposed to 'closing' them). The reason I took this approach is because it is easy to know what data will exi…

---

## [Low level REST API : bulk request and array problem](https://discuss.elastic.co/t/low-level-rest-api-bulk-request-and-array-problem/119775)

<div class="topic-metadata">

**Author:** [@yutanpo](https://discuss.elastic.co/u/yutanpo)\
**Replies:** 4\
**Last updated:** [February 14, 2018, 1:44pm UTC](https://discuss.elastic.co/t/low-level-rest-api-bulk-request-and-array-problem/119775 "2018-02-14T13:44:09Z")

</div>

Dear all, I am currently working on ES 6.0, using the low rest client to communicate with an ES 6.0. I am wondering few things, among them : is it possible, via the low rest client, to get a response like this one af…

---

## [Exception when there are duplicate words in search query](https://discuss.elastic.co/t/exception-when-there-are-duplicate-words-in-search-query/119791)

<div class="topic-metadata">

**Author:** [@Sachini\_Perera](https://discuss.elastic.co/u/Sachini_Perera)\
**Replies:** 1\
**Last updated:** [February 14, 2018, 1:12pm UTC](https://discuss.elastic.co/t/exception-when-there-are-duplicate-words-in-search-query/119791 "2018-02-14T13:12:40Z")

</div>

{"error":{"root\_cause":\[{"type":"parsing\_exception","reason":"\[terms\] query does not support \[0\] within lookup element","line":1,"col":150}\],"type":"parsing\_exception","reason":"\[terms\] query does not support \[0\] withi…

---

## [Get Index name based on Aliases](https://discuss.elastic.co/t/get-index-name-based-on-aliases/119793)

<div class="topic-metadata">

**Author:** [@Akib\_Ali](https://discuss.elastic.co/u/Akib_Ali)\
**Replies:** 4\
**Last updated:** [February 14, 2018, 1:07pm UTC](https://discuss.elastic.co/t/get-index-name-based-on-aliases/119793 "2018-02-14T13:07:07Z")

</div>

I have index which has multiple aliases names. And now i want to get all the index names which contain some given aliases names. Example: Index\_name: test Aliases name: a1,a2,a3 Index\_name: test2 Aliases name: a1,a3 …

---

## [Hard code metadata values in ldap realm configuration](https://discuss.elastic.co/t/hard-code-metadata-values-in-ldap-realm-configuration/119678)

<div class="topic-metadata">

**Author:** [@jchannon](https://discuss.elastic.co/u/jchannon)\
**Replies:** 4\
**Last updated:** [February 14, 2018, 12:31pm UTC](https://discuss.elastic.co/t/hard-code-metadata-values-in-ldap-realm-configuration/119678 "2018-02-14T12:31:05Z")

</div>

In the LDAP realm configuration you can set the metadata value to be an ldap attribute that the realm uses to populate the user's metadata property. Is there a way to hardcode a value for metadata for example if I didn'…

---

## [Unable to create index and view message sent from Spark](https://discuss.elastic.co/t/unable-to-create-index-and-view-message-sent-from-spark/119787)

<div class="topic-metadata">

**Author:** [@sauraj786](https://discuss.elastic.co/u/sauraj786)\
**Replies:** 0\
**Last updated:** [February 14, 2018, 11:54am UTC](https://discuss.elastic.co/t/unable-to-create-index-and-view-message-sent-from-spark/119787 "2018-02-14T11:54:29Z")

</div>

Hi, I am trying to get messages from kafka through spark and populate the messages in ElasticSearch. I am new in this. I want the messages of "df" command to be displayed as "filesystem" "message" . i am generating 2 di…

---

## [Filter based on String variable using Script Query](https://discuss.elastic.co/t/filter-based-on-string-variable-using-script-query/119776)

<div class="topic-metadata">

**Author:** [@volle](https://discuss.elastic.co/u/volle)\
**Replies:** 0\
**Last updated:** [February 14, 2018, 11:01am UTC](https://discuss.elastic.co/t/filter-based-on-string-variable-using-script-query/119776 "2018-02-14T11:01:17Z")

</div>

I wish to set up a filter in my dashboard using painless script. I wish to do a query for a field ,named 'message', for the text 'foo' , in turn, run a script to get text from another field called activity\_id, assign it …

---

## [Does a non indexed field ("index": "no") has doc\_values enabled by default?](https://discuss.elastic.co/t/does-a-non-indexed-field-index-no-has-doc-values-enabled-by-default/119765)

<div class="topic-metadata">

**Author:** [@Olivier-L](https://discuss.elastic.co/u/Olivier-L)\
**Replies:** 0\
**Last updated:** [February 14, 2018, 10:15am UTC](https://discuss.elastic.co/t/does-a-non-indexed-field-index-no-has-doc-values-enabled-by-default/119765 "2018-02-14T10:15:28Z")

</div>

(elasticsearch 2.4.6) Hello, From the elasticsearch documentation we can read that all fields (excepted analyzed ones) have "doc\_values" enabled by default. But what about field where "index" = "no"? Best regards, O…

---

## [Elastic node hangs or stops after few hours of load](https://discuss.elastic.co/t/elastic-node-hangs-or-stops-after-few-hours-of-load/118621)

<div class="topic-metadata">

**Author:** [@lecko](https://discuss.elastic.co/u/lecko)\
**Replies:** 9\
**Last updated:** [February 14, 2018, 9:59am UTC](https://discuss.elastic.co/t/elastic-node-hangs-or-stops-after-few-hours-of-load/118621 "2018-02-14T09:59:53Z")

</div>

Hello, After trobleshooting this problem for days, I decided to ask for help elasticsearch community. We are running 5 node elastic cluster, on Oracle linux 7.4. All machines have 64G RAM, and each one has 10 disks wit…

---

## [Can't get good results](https://discuss.elastic.co/t/cant-get-good-results/119744)

<div class="topic-metadata">

**Author:** [@Kandelakil](https://discuss.elastic.co/u/Kandelakil)\
**Replies:** 3\
**Last updated:** [February 14, 2018, 9:47am UTC](https://discuss.elastic.co/t/cant-get-good-results/119744 "2018-02-14T09:47:02Z")

</div>

Please help us to solve the following issue: The problem is..... We do not have a specific queue. Default query is \_search?q={$q} This search query is not getting the result for me. When we tried different queues, w…

---

## [Unexplained Speed Improvement in Third and Subsequent Terms Aggregations](https://discuss.elastic.co/t/unexplained-speed-improvement-in-third-and-subsequent-terms-aggregations/119713)

<div class="topic-metadata">

**Author:** [@jdgenio](https://discuss.elastic.co/u/jdgenio)\
**Replies:** 4\
**Last updated:** [February 14, 2018, 9:42am UTC](https://discuss.elastic.co/t/unexplained-speed-improvement-in-third-and-subsequent-terms-aggregations/119713 "2018-02-14T09:42:52Z")

</div>

Hi @Mark\_Harwood, I implemented @dadoonet's suggestion (eager global ordinals, thank you for this) in Slow terms aggregation speed on ~130M documents and was able to decrease the first load to ~2s from ~5s. However, usi…

---

## [Elastic Search Phonetic issue with NEST in Dotnet (C#)](https://discuss.elastic.co/t/elastic-search-phonetic-issue-with-nest-in-dotnet-c/119759)

<div class="topic-metadata">

**Author:** [@DotnetDeveloper](https://discuss.elastic.co/u/DotnetDeveloper)\
**Replies:** 0\
**Last updated:** [February 14, 2018, 9:31am UTC](https://discuss.elastic.co/t/elastic-search-phonetic-issue-with-nest-in-dotnet-c/119759 "2018-02-14T09:31:57Z")

</div>

I am new in Elastic search and i want to use it for Phonetic search so I have added plugin NEST in dotnet (C#) using nougat package and also installed phonetic analysis plugin then tried to create index with phonetic but…

---

## [Elasticdump](https://discuss.elastic.co/t/elasticdump/117607)

<div class="topic-metadata">

**Author:** [@dilipchiru](https://discuss.elastic.co/u/dilipchiru)\
**Replies:** 0\
**Last updated:** [January 30, 2018, 12:11pm UTC](https://discuss.elastic.co/t/elasticdump/117607 "2018-01-30T12:11:41Z")

</div>

Hi , how to dump all the indices from one elastic search to another elastic search . elasticdump --bulk=true --all --input=http://localhost:9200/ --type=data --output=http://localhost:9201/ I used above command where …

---

## [Solved :Java High Level RestClient 6.1.3 NoClassDefFoundError](https://discuss.elastic.co/t/solved-java-high-level-restclient-6-1-3-noclassdeffounderror/118436)

<div class="topic-metadata">

**Author:** [@Christian\_Foerster](https://discuss.elastic.co/u/Christian_Foerster)\
**Replies:** 2\
**Last updated:** [February 14, 2018, 8:17am UTC](https://discuss.elastic.co/t/solved-java-high-level-restclient-6-1-3-noclassdeffounderror/118436 "2018-02-14T08:17:12Z")

</div>

Hi, I'm trying to create a very simple Rest Client, as described in the docs. I'm using maven with this dependency: \<dependency\> \<groupId\>org.elasticsearch.client\</groupId\> \<artifactId\>elasticsearch-re…

[Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1787)

[Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1789)
