# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1809 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1810 --- ## [Create a mapping from the JSON File to the index](https://discuss.elastic.co/t/create-a-mapping-from-the-json-file-to-the-index/117679)
**Author:** [@tejaswicwd](https://discuss.elastic.co/u/tejaswicwd)\ **Replies:** 0\ **Last updated:** [January 30, 2018, 6:03pm UTC](https://discuss.elastic.co/t/create-a-mapping-from-the-json-file-to-the-index/117679 "2018-01-30T18:03:10Z")
I want to define the mapping of the index in the JSON file. I am searching for using the proper NEST command to create an index by reading that file. I came across using the PostData and PUT commands, but quite not sure… --- ## [Certificate without IP-Address for node-to-node communication](https://discuss.elastic.co/t/certificate-without-ip-address-for-node-to-node-communication/117032)
**Author:** [@jupp](https://discuss.elastic.co/u/jupp)\ **Replies:** 4\ **Last updated:** [January 30, 2018, 7:47pm UTC](https://discuss.elastic.co/t/certificate-without-ip-address-for-node-to-node-communication/117032 "2018-01-30T19:47:09Z")
Hi Folks, is it possible to leave the IP in the SAN for node-to-node communication. We want to verify only based on the DNS of the Server. I ask because we won't Change our Certificate when the ip-adress changes (think… --- ## [Optimal value for indices.query.bool.max\_clause\_count](https://discuss.elastic.co/t/optimal-value-for-indices-query-bool-max-clause-count/117645)
**Author:** [@ffoysal](https://discuss.elastic.co/u/ffoysal)\ **Replies:** 3\ **Last updated:** [January 30, 2018, 6:42pm UTC](https://discuss.elastic.co/t/optimal-value-for-indices-query-bool-max-clause-count/117645 "2018-01-30T18:42:23Z")
We have 200K documents and each one has a title field. When we search for a single letter, it will generate huge number of search hits. Just wondering what value should we chose for the setting indices.query.bool.max\_cl… --- ## [Elasticsearch for Apache Hadoop 6.1.3 released](https://discuss.elastic.co/t/elasticsearch-for-apache-hadoop-6-1-3-released/117681)
**Author:** [@james.baiera](https://discuss.elastic.co/u/james.baiera)\ **Replies:** 0\ **Last updated:** [January 30, 2018, 6:05pm UTC](https://discuss.elastic.co/t/elasticsearch-for-apache-hadoop-6-1-3-released/117681 "2018-01-30T18:05:59Z")
I am proud to announce that ES-Hadoop 6.1.3 has been released! You can read more about these releases here. --- ## [Elasticsearch for Apache Hadoop 5.6.7 released](https://discuss.elastic.co/t/elasticsearch-for-apache-hadoop-5-6-7-released/117678)
**Author:** [@james.baiera](https://discuss.elastic.co/u/james.baiera)\ **Replies:** 0\ **Last updated:** [January 30, 2018, 6:01pm UTC](https://discuss.elastic.co/t/elasticsearch-for-apache-hadoop-5-6-7-released/117678 "2018-01-30T18:01:43Z")
I am proud to announce that ES-Hadoop 5.6.7 has been released! You can read more about these releases here. --- ## [Time pattern recognized as string](https://discuss.elastic.co/t/time-pattern-recognized-as-string/117677)
**Author:** [@suryagprakash](https://discuss.elastic.co/u/suryagprakash)\ **Replies:** 0\ **Last updated:** [January 30, 2018, 6:00pm UTC](https://discuss.elastic.co/t/time-pattern-recognized-as-string/117677 "2018-01-30T18:00:26Z")
Hi, I am new with ELK concepts, I need a help with TIME pattern. The value from input is in HH:mi:ss format (00:01:05) and in elasticsearch its recognized as string. Can elasticsearch be forced to recognize this as dat… --- ## [Kibana Setup with ElasticSeach Cluster - To ELB or Not to ELB?](https://discuss.elastic.co/t/kibana-setup-with-elasticseach-cluster-to-elb-or-not-to-elb/117384)
**Author:** [@titan1978](https://discuss.elastic.co/u/titan1978)\ **Replies:** 0\ **Last updated:** [January 29, 2018, 12:48am UTC](https://discuss.elastic.co/t/kibana-setup-with-elasticseach-cluster-to-elb-or-not-to-elb/117384 "2018-01-29T00:48:14Z")
Hello - as part of my continuous learning on setting up an AWS EC2 based architecture of my Kibana Stack with ElasticSearch, on trawling forums I've come to understand there are TWO approaches: Front the entire ES cl… --- ## [How to Just Update Template Settings?!?!](https://discuss.elastic.co/t/how-to-just-update-template-settings/117675)
**Author:** [@Daniel\_Sanchez](https://discuss.elastic.co/u/Daniel_Sanchez)\ **Replies:** 0\ **Last updated:** [January 30, 2018, 5:59pm UTC](https://discuss.elastic.co/t/how-to-just-update-template-settings/117675 "2018-01-30T17:59:49Z")
All I want to do, is update an existing templates settings(number\_of\_shards, number\_of\_replicas, and refresh\_interval). However, the error message I keep getting makes it seem like it wants me to create a new index(keep… --- ## [Create index fails with shard\_acknowledged = false](https://discuss.elastic.co/t/create-index-fails-with-shard-acknowledged-false/117640)
**Author:** [@m.hashemian](https://discuss.elastic.co/u/m.hashemian)\ **Replies:** 2\ **Last updated:** [January 30, 2018, 5:58pm UTC](https://discuss.elastic.co/t/create-index-fails-with-shard-acknowledged-false/117640 "2018-01-30T17:58:25Z")
Hi, I'm using elastic 6.1 on CentOS 7. The server is a bit slow. When I try to create an index using this command: curl -XPUT 'localhost:9200/user\_activity?pretty' -H 'Content-Type: application/json' -d' { "setting… --- ## [Elasticsearch process is killed on Centos 7 - Newbie](https://discuss.elastic.co/t/elasticsearch-process-is-killed-on-centos-7-newbie/117635)
**Author:** [@Dwijadas](https://discuss.elastic.co/u/Dwijadas)\ **Replies:** 2\ **Last updated:** [January 30, 2018, 5:36pm UTC](https://discuss.elastic.co/t/elasticsearch-process-is-killed-on-centos-7-newbie/117635 "2018-01-30T17:36:31Z")
Continuing the discussion from Elasticsearch process is killed on Centos 7: Since existing topic was closed I open a new one. I cant even see any logs at /var/log/elasticsearch/ any idea ? --- ## [Fail to create S3 Repository](https://discuss.elastic.co/t/fail-to-create-s3-repository/117549)
**Author:** [@smithomega](https://discuss.elastic.co/u/smithomega)\ **Replies:** 3\ **Last updated:** [January 30, 2018, 5:25pm UTC](https://discuss.elastic.co/t/fail-to-create-s3-repository/117549 "2018-01-30T17:25:43Z")
hi, I am unable to create an S3 Repository. Ive tried against a Cloudian and AWS but I cant seem to get it to create and I get a very generic error. name component version RNtA5y5 repository-s3 6.1.2 I am tryi… --- ## [Can I set language-specific multi-fields?](https://discuss.elastic.co/t/can-i-set-language-specific-multi-fields/117667)
**Author:** [@IanRC72](https://discuss.elastic.co/u/IanRC72)\ **Replies:** 0\ **Last updated:** [January 30, 2018, 4:55pm UTC](https://discuss.elastic.co/t/can-i-set-language-specific-multi-fields/117667 "2018-01-30T16:55:07Z")
Is it possible to use multi-fields to set and query multilingual fields? Consider this mapping: PUT multi\_test { "mappings": { "data": { "\_field\_names": { "enabled": false }, "properties… --- ## [Total Count of a word from multiple documents (should not count only once but number of times it is present)](https://discuss.elastic.co/t/total-count-of-a-word-from-multiple-documents-should-not-count-only-once-but-number-of-times-it-is-present/117662)
**Author:** [@manasguduri](https://discuss.elastic.co/u/manasguduri)\ **Replies:** 0\ **Last updated:** [January 30, 2018, 4:37pm UTC](https://discuss.elastic.co/t/total-count-of-a-word-from-multiple-documents-should-not-count-only-once-but-number-of-times-it-is-present/117662 "2018-01-30T16:37:03Z")
Using elasticsearch, I can be able to see the count of documents containing a specific word using 'terms' aggregation and then 'filter' the word. But, I want something like Doc 1 - text text text good Doc 2 - good one … --- ## [ES 2.4 unable to create new index](https://discuss.elastic.co/t/es-2-4-unable-to-create-new-index/117660)
**Author:** [@fletch](https://discuss.elastic.co/u/fletch)\ **Replies:** 1\ **Last updated:** [January 30, 2018, 4:31pm UTC](https://discuss.elastic.co/t/es-2-4-unable-to-create-new-index/117660 "2018-01-30T16:31:30Z")
I ran a curl script to create a new index on an existing happy cluster, and found that the shards don't seem to have been allocated. Got the below error when I tried to index a document against the new index. $ curl -X… --- ## [Using elasticsearch-py client to import dashboards](https://discuss.elastic.co/t/using-elasticsearch-py-client-to-import-dashboards/117477)
**Author:** [@mksavic](https://discuss.elastic.co/u/mksavic)\ **Replies:** 4\ **Last updated:** [January 30, 2018, 4:22pm UTC](https://discuss.elastic.co/t/using-elasticsearch-py-client-to-import-dashboards/117477 "2018-01-30T16:22:05Z")
Hello, I am trying to import a dashboard via the elasticsearch api with elastic search-py. I have a sample dashboard from https://demo.elastic.co/ (the http one). I have exported it and it looks like this: \[ { "… --- ## [Create parent/child index with java api](https://discuss.elastic.co/t/create-parent-child-index-with-java-api/116079)
**Author:** [@Infire](https://discuss.elastic.co/u/Infire)\ **Replies:** 3\ **Last updated:** [January 30, 2018, 3:35pm UTC](https://discuss.elastic.co/t/create-parent-child-index-with-java-api/116079 "2018-01-30T15:35:51Z")
Hi, I'm trying to create an index with a parent/child relationship but I'm getting an error while creating the child: "can't specify parent if no parent field has been configured". I don't know how I am supposed to crea… --- ## [Query against \_all matches for a field not contained in \_all](https://discuss.elastic.co/t/query-against-all-matches-for-a-field-not-contained-in-all/117608)
**Author:** [@Hrachya\_Yeghishyan](https://discuss.elastic.co/u/Hrachya_Yeghishyan)\ **Replies:** 2\ **Last updated:** [January 30, 2018, 3:31pm UTC](https://discuss.elastic.co/t/query-against-all-matches-for-a-field-not-contained-in-all/117608 "2018-01-30T15:31:15Z")
I have used the following index template for my indices: { "template": "crashlytics\*", "settings": { "number\_of\_shards": "5", "number\_of\_replicas": "1", "analysis": { "filter": { "nGr… --- ## [ML monthly forecast](https://discuss.elastic.co/t/ml-monthly-forecast/117497)
**Author:** [@fwerkmeister](https://discuss.elastic.co/u/fwerkmeister)\ **Replies:** 4\ **Last updated:** [January 30, 2018, 3:27pm UTC](https://discuss.elastic.co/t/ml-monthly-forecast/117497 "2018-01-30T15:27:51Z")
Hi community, I just started to do some testing with X-Pack machine learning and especially the forecasting feature. I have very simple data with (time, value) on a monthly basis with 60 datapoints (5 years) in history.… --- ## [Implementing SSL elastic 6.1.1 / X-PACK](https://discuss.elastic.co/t/implementing-ssl-elastic-6-1-1-x-pack/117460)
**Author:** [@JCLHN](https://discuss.elastic.co/u/JCLHN)\ **Replies:** 2\ **Last updated:** [January 30, 2018, 3:24pm UTC](https://discuss.elastic.co/t/implementing-ssl-elastic-6-1-1-x-pack/117460 "2018-01-30T15:24:40Z")
Hi everybody, I am trying to implement the SSL transport layer between the nodes, but I can't start elastic after modifying the elastic.yml. Does anyone already try to implement that ? FYI, I don't use certutil tool, t… --- ## [Dangling index and auto import to cluster state](https://discuss.elastic.co/t/dangling-index-and-auto-import-to-cluster-state/117651)
**Author:** [@Ihjaz](https://discuss.elastic.co/u/Ihjaz)\ **Replies:** 0\ **Last updated:** [January 30, 2018, 3:22pm UTC](https://discuss.elastic.co/t/dangling-index-and-auto-import-to-cluster-state/117651 "2018-01-30T15:22:36Z")
Hi All, I have an ELK cluster with 3 nodes. ELK version is 5.5.1. There were some connectivity issues between the servers and they couldn't ping each other for a minute or so. This led to log data or shards being out o… --- ## [Multiple path.data for one elastic data node](https://discuss.elastic.co/t/multiple-path-data-for-one-elastic-data-node/116884)
**Author:** [@111126](https://discuss.elastic.co/u/111126)\ **Replies:** 6\ **Last updated:** [January 30, 2018, 3:05pm UTC](https://discuss.elastic.co/t/multiple-path-data-for-one-elastic-data-node/116884 "2018-01-30T15:05:29Z")
Hello. Explain me please, how to work elastic data node if I set multiple path.data with different volumes. For explain, I set path.data: \[/path/for/data1, /path/for/data2, /path/for/data3\] where /path/for/data1 - 1Tb … --- ## [Inserting logs with TimeStamp out of order](https://discuss.elastic.co/t/inserting-logs-with-timestamp-out-of-order/117638)
**Author:** [@pbsf](https://discuss.elastic.co/u/pbsf)\ **Replies:** 1\ **Last updated:** [January 30, 2018, 2:47pm UTC](https://discuss.elastic.co/t/inserting-logs-with-timestamp-out-of-order/117638 "2018-01-30T14:47:33Z")
Previously, the LogInfoEvent.TimeStamp from my application used to be the UTC time the log message was received. Recently, I parameterized it to allow my application to insert logs of operations that occurred in the past… --- ## [Could not initialize class org.elasticsearch.test.ESTestCase alternate solution](https://discuss.elastic.co/t/could-not-initialize-class-org-elasticsearch-test-estestcase-alternate-solution/117641)
**Author:** [@Michael\_Ihde](https://discuss.elastic.co/u/Michael_Ihde)\ **Replies:** 0\ **Last updated:** [January 30, 2018, 2:45pm UTC](https://discuss.elastic.co/t/could-not-initialize-class-org-elasticsearch-test-estestcase-alternate-solution/117641 "2018-01-30T14:45:03Z")
I've seen two forum messages related to errors starting up ESTestCase and ESIntegTestCase: https://discuss.elastic.co/t/could-not-initialize-class-org-elasticsearch-test-estestcase/78770 https://discuss.elastic.co/… --- ## [Perform aggregation on already aggregated result](https://discuss.elastic.co/t/perform-aggregation-on-already-aggregated-result/117639)
**Author:** [@clindo](https://discuss.elastic.co/u/clindo)\ **Replies:** 0\ **Last updated:** [January 30, 2018, 2:39pm UTC](https://discuss.elastic.co/t/perform-aggregation-on-already-aggregated-result/117639 "2018-01-30T14:39:31Z")
Hello, I am performing an aggregation of Netflow records. My first aggregation is to collect all documents within a "100ms" interval. Now I want to do an aggregation on a particular field in this interval, say protocol … --- ## [Trying to apply filter on time-difference scripted field](https://discuss.elastic.co/t/trying-to-apply-filter-on-time-difference-scripted-field/117025)
**Author:** [@Shubham\_Mahajan](https://discuss.elastic.co/u/Shubham_Mahajan)\ **Replies:** 1\ **Last updated:** [January 30, 2018, 2:35pm UTC](https://discuss.elastic.co/t/trying-to-apply-filter-on-time-difference-scripted-field/117025 "2018-01-30T14:35:09Z")
Continuing the discussion from Elasticsearch giving warning for painless script: time-diff: new Date().getTime() - doc\['@timestamp'\].value.getMillis() @rjernst hey Ryan, I need some urgent help regarding this functioni… --- ## [Cluster node for elasticsearch](https://discuss.elastic.co/t/cluster-node-for-elasticsearch/117609)
**Author:** [@shrikantgulia](https://discuss.elastic.co/u/shrikantgulia)\ **Replies:** 1\ **Last updated:** [January 30, 2018, 2:31pm UTC](https://discuss.elastic.co/t/cluster-node-for-elasticsearch/117609 "2018-01-30T14:31:53Z")
I have three nodes with settings server1: node.name: node-03 node.master: false node.data: true server2: node.name: node-02 node.master: true node.data: true Server3: node.name: node-01 node.master: true node… --- ## [Maximum size of reports?](https://discuss.elastic.co/t/maximum-size-of-reports/117536)
**Author:** [@Mike\_Dreyfus](https://discuss.elastic.co/u/Mike_Dreyfus)\ **Replies:** 2\ **Last updated:** [January 30, 2018, 2:26pm UTC](https://discuss.elastic.co/t/maximum-size-of-reports/117536 "2018-01-30T14:26:33Z")
Hi, I seem to be having an issue while generating reports for large amounts of data. I wanted to confirm if I'm hitting some kind of max size or if this is some kind of configuration issue. Currently, I am trying to pul… --- ## [Regexp in searching for aliases](https://discuss.elastic.co/t/regexp-in-searching-for-aliases/117269)
**Author:** [@m.hashemian](https://discuss.elastic.co/u/m.hashemian)\ **Replies:** 5\ **Last updated:** [January 30, 2018, 2:08pm UTC](https://discuss.elastic.co/t/regexp-in-searching-for-aliases/117269 "2018-01-30T14:08:51Z")
Hi, I have multiple indices and each index has multiple aliases. Is there a way to search for aliases using regexp? For example, I can use this query: curl -XGET 'localhost:9200/\_alias/2016\*?pretty' to get all aliase… --- ## [Drools Engine](https://discuss.elastic.co/t/drools-engine/116433)
**Author:** [@dilipchiru](https://discuss.elastic.co/u/dilipchiru)\ **Replies:** 7\ **Last updated:** [January 30, 2018, 2:06pm UTC](https://discuss.elastic.co/t/drools-engine/116433 "2018-01-30T14:06:00Z")
Hi , I want to know how to write the drools rule to send the data to another elastic search which is not in cluster --- ## [Why doesn't the size of my index double with replicas?](https://discuss.elastic.co/t/why-doesnt-the-size-of-my-index-double-with-replicas/117160)
**Author:** [@cemremengu](https://discuss.elastic.co/u/cemremengu)\ **Replies:** 2\ **Last updated:** [January 30, 2018, 1:30pm UTC](https://discuss.elastic.co/t/why-doesnt-the-size-of-my-index-double-with-replicas/117160 "2018-01-30T13:30:03Z")
With or without the replicas I see that the disk size of my index is reported as the same. I expected it to double since replicas hold the exact copies. Is size really the same or just reported the same for brevity? [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1808) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1810)