# Elasticsearch

**URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1798

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 1799

---

## [Some of built-in watches fails](https://discuss.elastic.co/t/some-of-built-in-watches-fails/117960)

<div class="topic-metadata">

**Author:** [@admlko](https://discuss.elastic.co/u/admlko)\
**Replies:** 8\
**Last updated:** [February 7, 2018, 2:08pm UTC](https://discuss.elastic.co/t/some-of-built-in-watches-fails/117960 "2018-02-07T14:08:19Z")

</div>

Hi, I have a situation where two of the built-in watches fails: Cluster status and Logstash version mismatch. Both Watcher in Kibana and Elasticsearch log file just states that it failed. I have also another issue wit…

---

## [Effect of " index.mapping.total\_fields.limit" on elasticsearch fuctions?](https://discuss.elastic.co/t/effect-of-index-mapping-total-fields-limit-on-elasticsearch-fuctions/118854)

<div class="topic-metadata">

**Author:** [@madhur\_yadav](https://discuss.elastic.co/u/madhur_yadav)\
**Replies:** 0\
**Last updated:** [February 7, 2018, 1:53pm UTC](https://discuss.elastic.co/t/effect-of-index-mapping-total-fields-limit-on-elasticsearch-fuctions/118854 "2018-02-07T13:53:17Z")

</div>

Hi there, currently I'm working on a product which uses Elasticsearch. the current index.mapping.total\_fields.limit is 1000 and due to growing fields in the indexes, I want to increase it upto 5000. My question is - W…

---

## [Find documents with multiple occurrences within a time span](https://discuss.elastic.co/t/find-documents-with-multiple-occurrences-within-a-time-span/118608)

<div class="topic-metadata">

**Author:** [@adammichalik](https://discuss.elastic.co/u/adammichalik)\
**Replies:** 2\
**Last updated:** [February 7, 2018, 1:37pm UTC](https://discuss.elastic.co/t/find-documents-with-multiple-occurrences-within-a-time-span/118608 "2018-02-07T13:37:42Z")

</div>

I have documents with a following structure: { "timestamp": "2018-01-01T12:34:56.000Z", "message": "Some message", "idNumber": 12345678 } The message field holds various messages, there are multiple messages per i…

---

## [timeSeries Aggregation](https://discuss.elastic.co/t/timeseries-aggregation/118458)

<div class="topic-metadata">

**Author:** [@Moshe\_Sharon](https://discuss.elastic.co/u/Moshe_Sharon)\
**Replies:** 2\
**Last updated:** [February 7, 2018, 1:27pm UTC](https://discuss.elastic.co/t/timeseries-aggregation/118458 "2018-02-07T13:27:12Z")

</div>

hi there , Can I aggregate on time series depending on state? e.g. if a group of people took a pill on different occasions. and I want to see the impact of the group blood pressure on the continuing week. can I do this…

---

## ["Merge" Two elasticsearch 5.6 clusters](https://discuss.elastic.co/t/merge-two-elasticsearch-5-6-clusters/118848)

<div class="topic-metadata">

**Author:** [@GBXavier](https://discuss.elastic.co/u/GBXavier)\
**Replies:** 0\
**Last updated:** [February 7, 2018, 1:17pm UTC](https://discuss.elastic.co/t/merge-two-elasticsearch-5-6-clusters/118848 "2018-02-07T13:17:23Z")

</div>

I have two Open Source licensed clusters of elasticsearch 5.6 in diferents virtual machines. I really want to make a unique cluster with both these clusters, but i don't know how do it in the right way and guarantee no l…

---

## [Can't get EC2 discovery to work, always using zen](https://discuss.elastic.co/t/cant-get-ec2-discovery-to-work-always-using-zen/118815)

<div class="topic-metadata">

**Author:** [@fredsted](https://discuss.elastic.co/u/fredsted)\
**Replies:** 2\
**Last updated:** [February 7, 2018, 1:06pm UTC](https://discuss.elastic.co/t/cant-get-ec2-discovery-to-work-always-using-zen/118815 "2018-02-07T13:06:31Z")

</div>

Hi, I'm trying to use EC2 discovery with ES 6.1 and ES 6.2. It doesn't seem to work at all. I did of course install the plugin and add the neccessary config file, as well as adding the EC2 instance IAM role, but the log …

---

## [Deeply nested aggregations with large dataset](https://discuss.elastic.co/t/deeply-nested-aggregations-with-large-dataset/118564)

<div class="topic-metadata">

**Author:** [@lstilo](https://discuss.elastic.co/u/lstilo)\
**Replies:** 3\
**Last updated:** [February 7, 2018, 11:53am UTC](https://discuss.elastic.co/t/deeply-nested-aggregations-with-large-dataset/118564 "2018-02-07T11:53:08Z")

</div>

Hello, We’re looking to use ES for reporting and analytics in addition to search, however I’ve been hitting some limits when running some deeply nested aggregates with large datasets. I’ve tried various approaches in or…

---

## [Elasticsearch 5.6 Installation - single node](https://discuss.elastic.co/t/elasticsearch-5-6-installation-single-node/118549)

<div class="topic-metadata">

**Author:** [@chitraj8](https://discuss.elastic.co/u/chitraj8)\
**Replies:** 4\
**Last updated:** [February 7, 2018, 11:43am UTC](https://discuss.elastic.co/t/elasticsearch-5-6-installation-single-node/118549 "2018-02-07T11:43:06Z")

</div>

I am trying to install ES 5.6 as a single node and currently would like to explore in development mode. Once known to be a stable application after necessary checks for indices, later would like to switch to production m…

---

## [Date historgram - forcing upper date bound](https://discuss.elastic.co/t/date-historgram-forcing-upper-date-bound/118826)

<div class="topic-metadata">

**Author:** [@LazPix](https://discuss.elastic.co/u/LazPix)\
**Replies:** 0\
**Last updated:** [February 7, 2018, 11:26am UTC](https://discuss.elastic.co/t/date-historgram-forcing-upper-date-bound/118826 "2018-02-07T11:26:05Z")

</div>

I am aggregating records where I have a field samplingDate and a field users. I want to get a weekly aggregation, where the last item in the bucket is from the last date in the range, but I cannot find a way to force it…

---

## [Not able to install the elastic search report plugin](https://discuss.elastic.co/t/not-able-to-install-the-elastic-search-report-plugin/117805)

<div class="topic-metadata">

**Author:** [@PrabakarKaruppasamy](https://discuss.elastic.co/u/PrabakarKaruppasamy)\
**Replies:** 14\
**Last updated:** [February 7, 2018, 11:12am UTC](https://discuss.elastic.co/t/not-able-to-install-the-elastic-search-report-plugin/117805 "2018-02-07T11:12:46Z")

</div>

Hi All, We are trying to install the elastic search report plugin which one is available on git hub malike/elasticsearch-report-engine But getting the error ERROR: elasticsearch directory is missing in the plugin zip …

---

## [Questions about field mapping unicity and filter context transitivity](https://discuss.elastic.co/t/questions-about-field-mapping-unicity-and-filter-context-transitivity/118817)

<div class="topic-metadata">

**Author:** [@Olivier-L](https://discuss.elastic.co/u/Olivier-L)\
**Replies:** 0\
**Last updated:** [February 7, 2018, 11:08am UTC](https://discuss.elastic.co/t/questions-about-field-mapping-unicity-and-filter-context-transitivity/118817 "2018-02-07T11:08:14Z")

</div>

Hello, I have two questions: I know that a field mapping (with same name) must be unique accross types in an index, but does this apply also when the field is inside two different objects? Like: "mappings": { "typ…

---

## [Scroll API](https://discuss.elastic.co/t/scroll-api/118816)

<div class="topic-metadata">

**Author:** [@Hassan\_Shaitou](https://discuss.elastic.co/u/Hassan_Shaitou)\
**Replies:** 0\
**Last updated:** [February 7, 2018, 11:04am UTC](https://discuss.elastic.co/t/scroll-api/118816 "2018-02-07T11:04:17Z")

</div>

As far as I understand, Scroll API is used to handle response of more than 10000 documents, where you surpass the limit... I am doing it with NEST C# package as follows: var response = client.Search\<JoinTestOneTwo\>(s =\>…

---

## [Error in elasticsearch logs](https://discuss.elastic.co/t/error-in-elasticsearch-logs/118233)

<div class="topic-metadata">

**Author:** [@Kaouther\_Mechri](https://discuss.elastic.co/u/Kaouther_Mechri)\
**Replies:** 8\
**Last updated:** [February 7, 2018, 10:55am UTC](https://discuss.elastic.co/t/error-in-elasticsearch-logs/118233 "2018-02-07T10:55:52Z")

</div>

Hello everyone, I have this Error in my Elasticsearch logs . Do you have any idea please ? ELK 6.1.1 thanks \[2018-02-02T14:20:03,624\]\[DEBUG\]\[o.e.a.b.TransportShardBulkAction\] \[logstash-2018.02.02\]\[2\] failed to execut…

---

## [Cluster Allocation explain API](https://discuss.elastic.co/t/cluster-allocation-explain-api/118813)

<div class="topic-metadata">

**Author:** [@vach](https://discuss.elastic.co/u/vach)\
**Replies:** 0\
**Last updated:** [February 7, 2018, 10:47am UTC](https://discuss.elastic.co/t/cluster-allocation-explain-api/118813 "2018-02-07T10:47:19Z")

</div>

Hello. I have some problems with Cluster Allocation Explain API. When I do GET request to /\_cluster/allocation/explain URI I get following response: Blockquote{ "error": { "root\_cause": \[ { "type": "index\_not\_foun…

---

## [Netapp metrics collect](https://discuss.elastic.co/t/netapp-metrics-collect/118796)

<div class="topic-metadata">

**Author:** [@Kaouther\_Mechri](https://discuss.elastic.co/u/Kaouther_Mechri)\
**Replies:** 0\
**Last updated:** [February 7, 2018, 10:02am UTC](https://discuss.elastic.co/t/netapp-metrics-collect/118796 "2018-02-07T10:02:25Z")

</div>

Hello Everyone; I want to collect Netapp metrics and send them to elasticsearch. How can i proceed ? thank you

---

## [Elasticsearch is not starting after installing X-Pack](https://discuss.elastic.co/t/elasticsearch-is-not-starting-after-installing-x-pack/118782)

<div class="topic-metadata">

**Author:** [@itspecialistsimon](https://discuss.elastic.co/u/itspecialistsimon)\
**Replies:** 5\
**Last updated:** [February 7, 2018, 9:50am UTC](https://discuss.elastic.co/t/elasticsearch-is-not-starting-after-installing-x-pack/118782 "2018-02-07T09:50:13Z")

</div>

Hi everyone, I'm trying to get elasticsearch run with x-pack. I adhered strictly to the official guide Installing X-Pack in Elasticsearch Here the logfile's extract: \[2018-02-07T09:43:52,972\]\[INFO \]\[o.e.x.s.t.n.Secur…

---

## [ES, Kibana, Filebeat, Logstash Upgrade / Downwards Compatibility](https://discuss.elastic.co/t/es-kibana-filebeat-logstash-upgrade-downwards-compatibility/118786)

<div class="topic-metadata">

**Author:** [@atom](https://discuss.elastic.co/u/atom)\
**Replies:** 0\
**Last updated:** [February 7, 2018, 9:24am UTC](https://discuss.elastic.co/t/es-kibana-filebeat-logstash-upgrade-downwards-compatibility/118786 "2018-02-07T09:24:17Z")

</div>

Hi, im want to upgrade my kibana elasticsearch filebeat and logstash instances from 5.6.x to 6.x There are a lot of breaking changes. Do i need to "fix" all possible problems oris 6.x downwards compatible with 5.6 vers…

---

## [Elastic stack with X-Pack to replace GFI EventsManager](https://discuss.elastic.co/t/elastic-stack-with-x-pack-to-replace-gfi-eventsmanager/118778)

<div class="topic-metadata">

**Author:** [@ShinyMcShine](https://discuss.elastic.co/u/ShinyMcShine)\
**Replies:** 2\
**Last updated:** [February 7, 2018, 9:42am UTC](https://discuss.elastic.co/t/elastic-stack-with-x-pack-to-replace-gfi-eventsmanager/118778 "2018-02-07T09:42:46Z")

</div>

Hello \*, I'm currently investigating, if we can replace "GFI EventsManager" with an Elastic stack. The GFI EM is not actively developed anymore and the latest version is from 2013. In our project we're switching to Wi…

---

## [Startup scripts for E and L and K from tar.gz](https://discuss.elastic.co/t/startup-scripts-for-e-and-l-and-k-from-tar-gz/118461)

<div class="topic-metadata">

**Author:** [@HansCama](https://discuss.elastic.co/u/HansCama)\
**Replies:** 1\
**Last updated:** [February 7, 2018, 9:34am UTC](https://discuss.elastic.co/t/startup-scripts-for-e-and-l-and-k-from-tar-gz/118461 "2018-02-07T09:34:14Z")

</div>

Hi all, I've installed the latest ELK stack on CentOS. Since I don't like how the things are sparse using the package installation, I've downloaded and unpacked the tar.gz. Now I want to have a /etc/init.d/ start/stop s…

---

## [Elasticsearch not returning mongoose object id](https://discuss.elastic.co/t/elasticsearch-not-returning-mongoose-object-id/118558)

<div class="topic-metadata">

**Author:** [@Moumita\_Mandal](https://discuss.elastic.co/u/Moumita_Mandal)\
**Replies:** 1\
**Last updated:** [February 7, 2018, 9:32am UTC](https://discuss.elastic.co/t/elasticsearch-not-returning-mongoose-object-id/118558 "2018-02-07T09:32:39Z")

</div>

Hi, Currently, I am using Elasticsearch version "5.3.2".I am developing an application in Nodejs and MongoDB(For Elasticsearch I am using mongoosastic npm module). I am performing a search query which is working fine. …

---

## [Watch store not started](https://discuss.elastic.co/t/watch-store-not-started/118775)

<div class="topic-metadata">

**Author:** [@ajayrc](https://discuss.elastic.co/u/ajayrc)\
**Replies:** 1\
**Last updated:** [February 7, 2018, 9:24am UTC](https://discuss.elastic.co/t/watch-store-not-started/118775 "2018-02-07T09:24:11Z")

</div>

Am using dockerized version of elastic-search-5.6.1 and using volume to persist data am getting this error frequently ..... any ideas how to debug it? java.lang.IllegalStateException: watch store not started at org.ela…

---

## [Very Old Data](https://discuss.elastic.co/t/very-old-data/118777)

<div class="topic-metadata">

**Author:** [@aneesh](https://discuss.elastic.co/u/aneesh)\
**Replies:** 1\
**Last updated:** [February 7, 2018, 9:23am UTC](https://discuss.elastic.co/t/very-old-data/118777 "2018-02-07T09:23:33Z")

</div>

Hi In elastic what happens to the older data or the data that is not referenced (Very old data). Whether it will delete automatically? Do we have any option to delete them? Thanks Aneesh L

---

## [Loop through ctx.payload.hits.hits in transform](https://discuss.elastic.co/t/loop-through-ctx-payload-hits-hits-in-transform/115527)

<div class="topic-metadata">

**Author:** [@Steve\_Stevens](https://discuss.elastic.co/u/Steve_Stevens)\
**Replies:** 4\
**Last updated:** [February 7, 2018, 9:14am UTC](https://discuss.elastic.co/t/loop-through-ctx-payload-hits-hits-in-transform/115527 "2018-02-07T09:14:54Z")

</div>

Excuse the basic questions but I am new to the product and forum. I am attempting to build a watcher that parses a some of the hits messages and updates an index, but I feel my syntax is wrong. Unfortunately I only get …

---

## [Recursively Returning Results from a Watch, Newline Output](https://discuss.elastic.co/t/recursively-returning-results-from-a-watch-newline-output/118433)

<div class="topic-metadata">

**Author:** [@MultiplierMultiplier](https://discuss.elastic.co/u/MultiplierMultiplier)\
**Replies:** 2\
**Last updated:** [February 7, 2018, 9:05am UTC](https://discuss.elastic.co/t/recursively-returning-results-from-a-watch-newline-output/118433 "2018-02-07T09:05:38Z")

</div>

Hi guys, I have managed to get my watch to output all of the usernames when someone fails to logon, they appear one after the other with a space in between, like so: "text": "The following user(s) failed to logon: Test…

---

## [Wildcard in ctx.payload fileds](https://discuss.elastic.co/t/wildcard-in-ctx-payload-fileds/118009)

<div class="topic-metadata">

**Author:** [@bodi4](https://discuss.elastic.co/u/bodi4)\
**Replies:** 1\
**Last updated:** [February 7, 2018, 8:50am UTC](https://discuss.elastic.co/t/wildcard-in-ctx-payload-fileds/118009 "2018-02-07T08:50:40Z")

</div>

Hi there! I am making a watch with 2 chain searches: \[search1, search2\]. They differ only in query body and return same fields so I'd like to put it in one watch. The question is: How to write multiple conditions, i.e…

---

## [How to insert evaluated some specific documents results into another elasticsearch index using watcher actions?](https://discuss.elastic.co/t/how-to-insert-evaluated-some-specific-documents-results-into-another-elasticsearch-index-using-watcher-actions/117969)

<div class="topic-metadata">

**Author:** [@yash\_mangla](https://discuss.elastic.co/u/yash_mangla)\
**Replies:** 1\
**Last updated:** [February 7, 2018, 8:48am UTC](https://discuss.elastic.co/t/how-to-insert-evaluated-some-specific-documents-results-into-another-elasticsearch-index-using-watcher-actions/117969 "2018-02-07T08:48:43Z")

</div>

Hello Folks, I want to insert evaluated documents on the basis of written condition in a separate elastic-search index other than .watcher-history using watcher Action . during this process i also want to associate som…

---

## [How to check sum of unique events in watcher & list those unique events in output action using wathers](https://discuss.elastic.co/t/how-to-check-sum-of-unique-events-in-watcher-list-those-unique-events-in-output-action-using-wathers/117614)

<div class="topic-metadata">

**Author:** [@yash\_mangla](https://discuss.elastic.co/u/yash_mangla)\
**Replies:** 3\
**Last updated:** [February 7, 2018, 8:45am UTC](https://discuss.elastic.co/t/how-to-check-sum-of-unique-events-in-watcher-list-those-unique-events-in-output-action-using-wathers/117614 "2018-02-07T08:45:37Z")

</div>

Hello Folks, I recently started working on watcher. I have certain condition which i want to check in one watcher step wise step and then it will push those condition result in output action. how to check sum of uniq…

---

## [Implementing elasticsearch(1.0x) watcher using Java](https://discuss.elastic.co/t/implementing-elasticsearch-1-0x-watcher-using-java/117880)

<div class="topic-metadata">

**Author:** [@Sumeet\_B](https://discuss.elastic.co/u/Sumeet_B)\
**Replies:** 1\
**Last updated:** [February 7, 2018, 8:43am UTC](https://discuss.elastic.co/t/implementing-elasticsearch-1-0x-watcher-using-java/117880 "2018-02-07T08:43:09Z")

</div>

I am a novice in ES... I want to work with watcher of ES. Let's assume a scenario: Let's say I am a doctor. I have data about my patients in ES. Whenever the diagnostic team claims that the patient's health status is d…

---

## [Best practice for multilang website with multiple database tables](https://discuss.elastic.co/t/best-practice-for-multilang-website-with-multiple-database-tables/118673)

<div class="topic-metadata">

**Author:** [@andreknieriem](https://discuss.elastic.co/u/andreknieriem)\
**Replies:** 2\
**Last updated:** [February 7, 2018, 8:37am UTC](https://discuss.elastic.co/t/best-practice-for-multilang-website-with-multiple-database-tables/118673 "2018-02-07T08:37:35Z")

</div>

Hi there, I am new to the new elasticsearch version. My first try with elasticsearch was with version 2.x. Now I want to have a search for my multilang website with many tables I want to index. My idea was to create an …

---

## [ClassCastException](https://discuss.elastic.co/t/classcastexception/118764)

<div class="topic-metadata">

**Author:** [@huajing](https://discuss.elastic.co/u/huajing)\
**Replies:** 1\
**Last updated:** [February 7, 2018, 8:37am UTC](https://discuss.elastic.co/t/classcastexception/118764 "2018-02-07T08:37:09Z")

</div>

Hi guys: There is a mistake here about elasticsearch1.7.5 : { "error": "SearchPhaseExecutionException\[Failed to execute phase \[query\], all shards failed; shardFailures {\[EklIxB3jTH2gBt6-sjT6wA\]\[i\_dsrhx\]\[0\]: ClassCastE…

[Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1797)

[Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1799)
