# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1805 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1806 --- ## [Top hits/bucket agg vs field collapse \[5.3\]](https://discuss.elastic.co/t/top-hits-bucket-agg-vs-field-collapse-5-3/117040)
**Author:** [@Thomas\_Millward\_Wrig](https://discuss.elastic.co/u/Thomas_Millward_Wrig)\ **Replies:** 1\ **Last updated:** [February 2, 2018, 9:32am UTC](https://discuss.elastic.co/t/top-hits-bucket-agg-vs-field-collapse-5-3/117040 "2018-02-02T09:32:29Z")
I'm trying to understand the difference between these types of query, and when to use each. I have documents that have a "unique\_hash" value, and want to return the latest document for each unique hash value within a gi… --- ## [Error NOT\_FOUND(404) during delete](https://discuss.elastic.co/t/error-not-found-404-during-delete/118194)
**Author:** [@r\_camaras](https://discuss.elastic.co/u/r_camaras)\ **Replies:** 0\ **Last updated:** [February 2, 2018, 9:28am UTC](https://discuss.elastic.co/t/error-not-found-404-during-delete/118194 "2018-02-02T09:28:22Z")
Hello, I have following python script where delete call sometimes crashes with error 404 (NOT FOUND), while the entry really exists and it is deleted in the next delete call. What can I do to solve this? query\_body = … --- ## [Error while migrating to es 5.4 from 1.4](https://discuss.elastic.co/t/error-while-migrating-to-es-5-4-from-1-4/118193)
**Author:** [@Nitish\_Goyal](https://discuss.elastic.co/u/Nitish_Goyal)\ **Replies:** 0\ **Last updated:** [February 2, 2018, 9:27am UTC](https://discuss.elastic.co/t/error-while-migrating-to-es-5-4-from-1-4/118193 "2018-02-02T09:27:39Z")
Migrating the cluster from es 1.4 to 5.4. Getting the below error frequently while migrating Caused by: org.elasticsearch.common.util.concurrent.UncategorizedExecutionException: Failed execution at org.elasticsearch.a… --- ## [How could I do to set es query case sensitive?](https://discuss.elastic.co/t/how-could-i-do-to-set-es-query-case-sensitive/118171)
**Author:** [@xuanyetouci](https://discuss.elastic.co/u/xuanyetouci)\ **Replies:** 4\ **Last updated:** [February 2, 2018, 9:25am UTC](https://discuss.elastic.co/t/how-could-i-do-to-set-es-query-case-sensitive/118171 "2018-02-02T09:25:47Z")
GET \_search { "query": { "match": { "name": "3g" } } } now I can get named 3g and 3G how counld I do to only get named 3g? --- ## [How to get field data from other documents in query?](https://discuss.elastic.co/t/how-to-get-field-data-from-other-documents-in-query/118188)
**Author:** [@Piyush\_Aggarwal](https://discuss.elastic.co/u/Piyush_Aggarwal)\ **Replies:** 0\ **Last updated:** [February 2, 2018, 8:47am UTC](https://discuss.elastic.co/t/how-to-get-field-data-from-other-documents-in-query/118188 "2018-02-02T08:47:57Z")
Hello everyone, I am trying to create a structure for feeds where one user can create feeds and it can see the feeds of the persons whom he/she is following, I have a feed structure mappings like this: { "properties": {… --- ## [Elasticsearch failed to collect data blocked by SERVICE\_UNAVAILABLE](https://discuss.elastic.co/t/elasticsearch-failed-to-collect-data-blocked-by-service-unavailable/118191)
**Author:** [@kyuubi](https://discuss.elastic.co/u/kyuubi)\ **Replies:** 0\ **Last updated:** [February 2, 2018, 9:03am UTC](https://discuss.elastic.co/t/elasticsearch-failed-to-collect-data-blocked-by-service-unavailable/118191 "2018-02-02T09:03:28Z")
I am running a set-up with just Elasticsearch, Kibana and Logstash. All components are active and automatically started with systemd. Yesterday I did load data from a CSV into ELK and did create a chart in Kibana. Toda… --- ## [Uneven load on cluster behind ELB with RestClient](https://discuss.elastic.co/t/uneven-load-on-cluster-behind-elb-with-restclient/118179)
**Author:** [@Eduard\_Dudar](https://discuss.elastic.co/u/Eduard_Dudar)\ **Replies:** 0\ **Last updated:** [February 2, 2018, 8:11am UTC](https://discuss.elastic.co/t/uneven-load-on-cluster-behind-elb-with-restclient/118179 "2018-02-02T08:11:12Z")
Hello, We've recently migrated from 1.7 to 5.6 and from Jest REST client to High-level REST Client. Our setup is 3 master nodes, 3 client nodes behind ELB and 6 data nodes in 3 availability zones in AWS. When an applica… --- ## [How to retrieve the raw documents](https://discuss.elastic.co/t/how-to-retrieve-the-raw-documents/116056)
**Author:** [@Raj\_Kumar](https://discuss.elastic.co/u/Raj_Kumar)\ **Replies:** 5\ **Last updated:** [February 2, 2018, 8:41am UTC](https://discuss.elastic.co/t/how-to-retrieve-the-raw-documents/116056 "2018-02-02T08:41:15Z")
Hi All, I have query with regards to raw documents, for example if we send syslogs, netflow data, firewall logs and windows event logs, we can either send it via logstash or directly elasticsearch. If we send through l… --- ## [Installing X-Pack on Windows 2016](https://discuss.elastic.co/t/installing-x-pack-on-windows-2016/118151)
**Author:** [@Yellow](https://discuss.elastic.co/u/Yellow)\ **Replies:** 8\ **Last updated:** [February 2, 2018, 8:37am UTC](https://discuss.elastic.co/t/installing-x-pack-on-windows-2016/118151 "2018-02-02T08:37:32Z")
Hi Guys, Stupid simple question. I'm new to installing Elasticsearch and do not know how to install x-pack, after i completed the msi install of Elasticsearch. During the ES install, i unchecked X-pack and wanted to ins… --- ## [Move path.data](https://discuss.elastic.co/t/move-path-data/118053)
**Author:** [@sbeee](https://discuss.elastic.co/u/sbeee)\ **Replies:** 2\ **Last updated:** [February 2, 2018, 8:12am UTC](https://discuss.elastic.co/t/move-path-data/118053 "2018-02-02T08:12:59Z")
hi, i created a new data dir (/data), stopped elasticsearch, edited elasticsearch.yml (path.data: /data) and started elasticsearch again. user/group rights are the same as /var/lib/elasticsearch. now when i start elast… --- ## [Difference between queries](https://discuss.elastic.co/t/difference-between-queries/118106)
**Author:** [@mario12](https://discuss.elastic.co/u/mario12)\ **Replies:** 5\ **Last updated:** [February 2, 2018, 7:35am UTC](https://discuss.elastic.co/t/difference-between-queries/118106 "2018-02-02T07:35:45Z")
"query": { "range": { createTime: { "gte": "1483142400000" } } } "filtered": { "query": { "match\_all": {} }, "filter": { "range": { "createTime": { "gte": "1483142400000" }}} } } Can you please let me kn… --- ## [How to Analysis images using Elasticsearch](https://discuss.elastic.co/t/how-to-analysis-images-using-elasticsearch/117931)
**Author:** [@Hari\_Baskar](https://discuss.elastic.co/u/Hari_Baskar)\ **Replies:** 2\ **Last updated:** [February 2, 2018, 7:34am UTC](https://discuss.elastic.co/t/how-to-analysis-images-using-elasticsearch/117931 "2018-02-02T07:34:49Z")
Hi, How to compare the images and analyze the images using the Elasticsearch and Kibana? Eg. Employee's security login using the face recognition, We stored already some employee's images in the database, so, Now the l… --- ## [Nested fieds: applying scripts and average calculation](https://discuss.elastic.co/t/nested-fieds-applying-scripts-and-average-calculation/118037)
**Author:** [@Paddy\_Mahadeva](https://discuss.elastic.co/u/Paddy_Mahadeva)\ **Replies:** 0\ **Last updated:** [February 1, 2018, 2:22pm UTC](https://discuss.elastic.co/t/nested-fieds-applying-scripts-and-average-calculation/118037 "2018-02-01T14:22:14Z")
Hi, I have a mapping similar to below for one of my indexes. { "name" : { "type: keyword" }, "age" : { "type" : "long" } "networth" : { "type" : "double" }, "bank\_accounts : { … --- ## [Can no longer enable curl security in elasticsearch:6.3.1?](https://discuss.elastic.co/t/can-no-longer-enable-curl-security-in-elasticsearch-6-3-1/118135)
**Author:** [@truthadjustr](https://discuss.elastic.co/u/truthadjustr)\ **Replies:** 1\ **Last updated:** [February 2, 2018, 7:25am UTC](https://discuss.elastic.co/t/can-no-longer-enable-curl-security-in-elasticsearch-6-3-1/118135 "2018-02-02T07:25:05Z")
I'm using the docker image of elasticsearch:6.3.1 (not the platinum). And I can't seem able to add curl security as like in previous elasticsearch. Before, i am able to protect the URL: curl http://172.17.0.2:9200/ And… --- ## [Cluster.routing.allocation.exclude.\_name stops working \[ES6.1.2\]](https://discuss.elastic.co/t/cluster-routing-allocation-exclude-name-stops-working-es6-1-2/117705)
**Author:** [@loren](https://discuss.elastic.co/u/loren)\ **Replies:** 2\ **Last updated:** [February 2, 2018, 5:58am UTC](https://discuss.elastic.co/t/cluster-routing-allocation-exclude-name-stops-working-es6-1-2/117705 "2018-02-02T05:58:41Z")
I'm migrating shards from some old nodes to some new nodes. I excluded the old nodes as follows: PUT /\_cluster/settings?pretty { "transient": { "cluster.routing.allocation.exclude.\_name": "node-1,node-2,node-3,nod… --- ## [Can we have master and ingest nodes set true on same nodes](https://discuss.elastic.co/t/can-we-have-master-and-ingest-nodes-set-true-on-same-nodes/118055)
**Author:** [@Gaurav\_Harsola](https://discuss.elastic.co/u/Gaurav_Harsola)\ **Replies:** 7\ **Last updated:** [February 2, 2018, 5:10am UTC](https://discuss.elastic.co/t/can-we-have-master-and-ingest-nodes-set-true-on-same-nodes/118055 "2018-02-02T05:10:07Z")
Hi, I have 5 nodes cluster, where i kept 3 nodes , which serve as master and ingest nodes and rest 2 nodes act as only data nodes. Is this good practise? How the flow will be ? and do we need one more node coordinating… --- ## [Why is replica shard in UNASSIGNED state if it exists on disk?](https://discuss.elastic.co/t/why-is-replica-shard-in-unassigned-state-if-it-exists-on-disk/118001)
**Author:** [@YuWatanabe](https://discuss.elastic.co/u/YuWatanabe)\ **Replies:** 3\ **Last updated:** [February 2, 2018, 5:08am UTC](https://discuss.elastic.co/t/why-is-replica-shard-in-unassigned-state-if-it-exists-on-disk/118001 "2018-02-02T05:08:08Z")
I would like to ask question regarding the shard allocation for rolling restart,. I am trying to figure out why shard allocation happens after following steps for rolling restart. I have done below test. Environment 1… --- ## [Elastic Search: all shards failed - search phase executionexception](https://discuss.elastic.co/t/elastic-search-all-shards-failed-search-phase-executionexception/117862)
**Author:** [@CW\_USER](https://discuss.elastic.co/u/CW_USER)\ **Replies:** 2\ **Last updated:** [February 2, 2018, 4:40am UTC](https://discuss.elastic.co/t/elastic-search-all-shards-failed-search-phase-executionexception/117862 "2018-02-02T04:40:26Z")
In our elastic cloud, we created a cluster with one node and three indices. suddenly, query to one of the index gives error:all shards failed - search\_phase\_execution\_exception. when we check for cluster health status, I… --- ## [DB monitoring using Elastic Search](https://discuss.elastic.co/t/db-monitoring-using-elastic-search/117664)
**Author:** [@rajeshb44](https://discuss.elastic.co/u/rajeshb44)\ **Replies:** 1\ **Last updated:** [February 2, 2018, 3:48am UTC](https://discuss.elastic.co/t/db-monitoring-using-elastic-search/117664 "2018-02-02T03:48:10Z")
I want to monitor the Database Oracle, Mysql, Postgresql . Want to monitor Performance, availability & Space usage. --- ## [Troubleshoot elk stack](https://discuss.elastic.co/t/troubleshoot-elk-stack/117672)
**Author:** [@Venkat\_Santhosh](https://discuss.elastic.co/u/Venkat_Santhosh)\ **Replies:** 1\ **Last updated:** [February 2, 2018, 3:47am UTC](https://discuss.elastic.co/t/troubleshoot-elk-stack/117672 "2018-02-02T03:47:57Z")
can anyone help me on documents and materials about advanced level trouble shooting of Kibana and Elasticsearch application --- ## [Upserting field doesn't work with elasticsearch-php](https://discuss.elastic.co/t/upserting-field-doesnt-work-with-elasticsearch-php/118146)
**Author:** [@cloudsthere](https://discuss.elastic.co/u/cloudsthere)\ **Replies:** 0\ **Last updated:** [February 2, 2018, 3:09am UTC](https://discuss.elastic.co/t/upserting-field-doesnt-work-with-elasticsearch-php/118146 "2018-02-02T03:09:29Z")
sentence in elasticsearch-php 6.0: This means an upsert will attempt to run your update script, but if the document does not exist (or the field you are trying to update doesn’t exist), default values will be inserted i… --- ## [ES 6.x : multi indices or one index with field type?](https://discuss.elastic.co/t/es-6-x-multi-indices-or-one-index-with-field-type/117744)
**Author:** [@Maher\_Ben\_Taleb\_Ali](https://discuss.elastic.co/u/Maher_Ben_Taleb_Ali)\ **Replies:** 1\ **Last updated:** [February 2, 2018, 1:25am UTC](https://discuss.elastic.co/t/es-6-x-multi-indices-or-one-index-with-field-type/117744 "2018-02-02T01:25:48Z")
Hi, we are migrating to ES 6.x so we are redesigning our schemas. I am wondering which is better for performance ? to have multiple an index for each type or to create one index and add a new type field. I know that i… --- ## [No fields mapped after creating a mapping template](https://discuss.elastic.co/t/no-fields-mapped-after-creating-a-mapping-template/117766)
**Author:** [@inhinyera16](https://discuss.elastic.co/u/inhinyera16)\ **Replies:** 1\ **Last updated:** [February 2, 2018, 1:24am UTC](https://discuss.elastic.co/t/no-fields-mapped-after-creating-a-mapping-template/117766 "2018-02-02T01:24:40Z")
I created a mapping template below PUT /\_template/eside\_test1 { "index\_patterns" : \["eside-\*"\], "order" : 0, "version": 1, "settings" : { "number\_of\_shards" : "3", "index": { "refresh\_int… --- ## [Unable to get a template to apply to my index](https://discuss.elastic.co/t/unable-to-get-a-template-to-apply-to-my-index/118136)
**Author:** [@bah7303](https://discuss.elastic.co/u/bah7303)\ **Replies:** 0\ **Last updated:** [February 2, 2018, 1:16am UTC](https://discuss.elastic.co/t/unable-to-get-a-template-to-apply-to-my-index/118136 "2018-02-02T01:16:59Z")
I am having trouble getting my template to apply and am wondering if its because we are using logstash. I am applying the template below and then recreating my index via logstash. My template is as follows: PUT /\_templ… --- ## [Check for data type query](https://discuss.elastic.co/t/check-for-data-type-query/117863)
**Author:** [@Abhinav1](https://discuss.elastic.co/u/Abhinav1)\ **Replies:** 1\ **Last updated:** [February 2, 2018, 1:11am UTC](https://discuss.elastic.co/t/check-for-data-type-query/117863 "2018-02-02T01:11:14Z")
Can we update the response in curl (GET) query that, if the field datatype is string or date or integer and we get the value as null or other then change it to 'Some other text'. For example if i have a string field i… --- ## [Change field type of a non indexed field?](https://discuss.elastic.co/t/change-field-type-of-a-non-indexed-field/117844)
**Author:** [@Olivier-L](https://discuss.elastic.co/u/Olivier-L)\ **Replies:** 1\ **Last updated:** [February 2, 2018, 12:42am UTC](https://discuss.elastic.co/t/change-field-type-of-a-non-indexed-field/117844 "2018-02-02T00:42:28Z")
Hello, ATM in our existing index we have a "Document\_FileName" field with following mapping: "Document\_FileName": { "type": "string", "index": "no", "doc\_values": false } We would like to change its mapping t… --- ## [X-Pack 5.6.6 - heavy cpu load](https://discuss.elastic.co/t/x-pack-5-6-6-heavy-cpu-load/117984)
**Author:** [@A.Klos](https://discuss.elastic.co/u/A.Klos)\ **Replies:** 2\ **Last updated:** [February 1, 2018, 11:37pm UTC](https://discuss.elastic.co/t/x-pack-5-6-6-heavy-cpu-load/117984 "2018-02-01T23:37:42Z")
Hi, I upgrade to Elastic 5.6.6 and also x-pack to 5.6.6 relase. Now I have heavy cpu load . Log of elasticsearch: \[2018-02-01T10:30:38,368\]\[ERROR\]\[o.e.x.m.c.c.ClusterStatsCollector\] \[H12Ebd5\] collector \[cluster\_stats… --- ## [Error from watcher in Elasticsearch](https://discuss.elastic.co/t/error-from-watcher-in-elasticsearch/118059)
**Author:** [@cavramescu](https://discuss.elastic.co/u/cavramescu)\ **Replies:** 1\ **Last updated:** [February 1, 2018, 11:21pm UTC](https://discuss.elastic.co/t/error-from-watcher-in-elasticsearch/118059 "2018-02-01T23:21:27Z")
After upgrading from one node to three nodes on my elasticsearch cluster and install x-pack i run a weird error , when trying to access the watcher from kibana , and also when i try to create a new watch \<- trying to … --- ## [Rolling Upgrade Documentation Incorrect?](https://discuss.elastic.co/t/rolling-upgrade-documentation-incorrect/118114)
**Author:** [@priteshkp](https://discuss.elastic.co/u/priteshkp)\ **Replies:** 2\ **Last updated:** [February 1, 2018, 10:51pm UTC](https://discuss.elastic.co/t/rolling-upgrade-documentation-incorrect/118114 "2018-02-01T22:51:03Z")
On this page: https://www.elastic.co/guide/en/elasticsearch/reference/6.1/rolling-upgrades.html Step 1 says to set the allocation to 'none' : PUT \_cluster/settings { "persistent": { "cluster.routing.allocation.en… --- ## [Does elasticsearch reduce bloating?](https://discuss.elastic.co/t/does-elasticsearch-reduce-bloating/118112)
**Author:** [@Jason\_Brooks](https://discuss.elastic.co/u/Jason_Brooks)\ **Replies:** 2\ **Last updated:** [February 1, 2018, 10:36pm UTC](https://discuss.elastic.co/t/does-elasticsearch-reduce-bloating/118112 "2018-02-01T22:36:37Z")
Hello, Does elasticsearch deduplicate data? I mean if there is a name/value combination in common for many events, does elasticsearch do any storage optimization? For example,I have a large ( \>500,000) number of event… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1804) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1806)