# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1812 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1813 --- ## [How to keep retain logs online and backup those?](https://discuss.elastic.co/t/how-to-keep-retain-logs-online-and-backup-those/117391)
**Author:** [@Blason](https://discuss.elastic.co/u/Blason)\ **Replies:** 2\ **Last updated:** [January 29, 2018, 5:11am UTC](https://discuss.elastic.co/t/how-to-keep-retain-logs-online-and-backup-those/117391 "2018-01-29T05:11:28Z")
Hi Guys, I need to store the logs online for 6 months while need to backup the indices offline and store it for 7 years. How can I restore those later? Can someone suggest the procedure to achieve the same? --- ## [Spark querying on ELK Stack](https://discuss.elastic.co/t/spark-querying-on-elk-stack/116275)
**Author:** [@Tomas\_Law](https://discuss.elastic.co/u/Tomas_Law)\ **Replies:** 1\ **Last updated:** [January 29, 2018, 4:44am UTC](https://discuss.elastic.co/t/spark-querying-on-elk-stack/116275 "2018-01-29T04:44:43Z")
Hello, I currently have an ELK Stack cluster with the following nodes: Logstash Elasticsearch 1 (ES1) Elasticsearch 2 (ES2) Elasticsearch (orchestrator) + Kibana I'm importing logs into Logstash, sending them to Elas… --- ## [Using alias from spark SQL](https://discuss.elastic.co/t/using-alias-from-spark-sql/114239)
**Author:** [@frederic.boissiere](https://discuss.elastic.co/u/frederic.boissiere)\ **Replies:** 3\ **Last updated:** [January 29, 2018, 4:41am UTC](https://discuss.elastic.co/t/using-alias-from-spark-sql/114239 "2018-01-29T04:41:05Z")
Hello, I'm using spark SQL in order to extract data from elastic into csv files. used software versions : elastic 5.5.2 spark SQL 2.1.1 elasticsearch-spark-20\_2.11 5.5.2 scala 2.11.8 I query elastic using alias. Whe… --- ## [Trouble writing a query with a basic search, a term aggregation, top\_hits and sorting both on top\_hits and buckets](https://discuss.elastic.co/t/trouble-writing-a-query-with-a-basic-search-a-term-aggregation-top-hits-and-sorting-both-on-top-hits-and-buckets/114925)
**Author:** [@Ikaer](https://discuss.elastic.co/u/Ikaer)\ **Replies:** 1\ **Last updated:** [January 29, 2018, 3:18am UTC](https://discuss.elastic.co/t/trouble-writing-a-query-with-a-basic-search-a-term-aggregation-top-hits-and-sorting-both-on-top-hits-and-buckets/114925 "2018-01-29T03:18:44Z")
Hi, I have trouble to write a specific query in elasticsearch. The context: I have an index where each document represents a “SKU”: a declination of a product (symbolized by pId). For example, the first 3 documents a… --- ## [ElasticSearch 5.2.2 Retention Period - Clarification](https://discuss.elastic.co/t/elasticsearch-5-2-2-retention-period-clarification/117387)
**Author:** [@titan1978](https://discuss.elastic.co/u/titan1978)\ **Replies:** 3\ **Last updated:** [January 29, 2018, 2:40am UTC](https://discuss.elastic.co/t/elasticsearch-5-2-2-retention-period-clarification/117387 "2018-01-29T02:40:27Z")
Hello Reading through a few forums I've come across TWO separate opinions on ElasticSearch's DEFAULT Retention Period. One indicated its 7 days whilst another Indicated its unlimited and one would manually need to DEL… --- ## [Building discovery platform with AWS services + Elastic running on premise](https://discuss.elastic.co/t/building-discovery-platform-with-aws-services-elastic-running-on-premise/117381)
**Author:** [@urketadic](https://discuss.elastic.co/u/urketadic)\ **Replies:** 0\ **Last updated:** [January 28, 2018, 8:07pm UTC](https://discuss.elastic.co/t/building-discovery-platform-with-aws-services-elastic-running-on-premise/117381 "2018-01-28T20:07:27Z")
I have finished this tutorial: The problem is I would like to change the logo in the top left corner, change the long URL from kibana and some other stuff which is not possible if Elasticsearch is running on cloud. … --- ## [Total count of matched phrase in each result document](https://discuss.elastic.co/t/total-count-of-matched-phrase-in-each-result-document/116815)
**Author:** [@elastic1](https://discuss.elastic.co/u/elastic1)\ **Replies:** 2\ **Last updated:** [January 28, 2018, 7:42pm UTC](https://discuss.elastic.co/t/total-count-of-matched-phrase-in-each-result-document/116815 "2018-01-28T19:42:11Z")
Hi everyone, Thanks for the great software! I have a query about total hit count across multiple documents, where one document can have more than 1 hit for my search term. So let's say my search term is "information",… --- ## [No handler for type \[attachment\] declared on field \[content\]](https://discuss.elastic.co/t/no-handler-for-type-attachment-declared-on-field-content/117375)
**Author:** [@Royner\_Valerio\_Valve](https://discuss.elastic.co/u/Royner_Valerio_Valve)\ **Replies:** 2\ **Last updated:** [January 28, 2018, 6:15pm UTC](https://discuss.elastic.co/t/no-handler-for-type-attachment-declared-on-field-content/117375 "2018-01-28T18:15:39Z")
I was working with ingest attachment but when I delete current index because I wanted to regenerate my index but I'm getting this error: { "error": { "root\_cause": \[ { "type": "mapper\_parsing\_exception", "reason": … --- ## [ElasticSearch doesn't initialize](https://discuss.elastic.co/t/elasticsearch-doesnt-initialize/117123)
**Author:** [@cfls](https://discuss.elastic.co/u/cfls)\ **Replies:** 11\ **Last updated:** [January 28, 2018, 4:54pm UTC](https://discuss.elastic.co/t/elasticsearch-doesnt-initialize/117123 "2018-01-28T16:54:32Z")
I use ElasticSearch with a Rails application and the ES stopped. I have tried several tips from other users with similar problem and nothing happens. What I do: start the service with "sudo service elasticsearch start"… --- ## [Searching for multiple values in array using wildcards](https://discuss.elastic.co/t/searching-for-multiple-values-in-array-using-wildcards/117349)
**Author:** [@arieltk](https://discuss.elastic.co/u/arieltk)\ **Replies:** 2\ **Last updated:** [January 28, 2018, 2:55pm UTC](https://discuss.elastic.co/t/searching-for-multiple-values-in-array-using-wildcards/117349 "2018-01-28T14:55:58Z")
Hi all, I have an array with several values. For example, in these two documents I have the following arrays: 1 - tags: \["Apple TV", "TV"\] 2 - tags: \["Apple", "TV"\] If I want to search for "Apple TV", I can send a qu… --- ## [Filter children in elasticsearch Nest](https://discuss.elastic.co/t/filter-children-in-elasticsearch-nest/117361)
**Author:** [@Qutaiba\_Mustafa](https://discuss.elastic.co/u/Qutaiba_Mustafa)\ **Replies:** 1\ **Last updated:** [January 28, 2018, 1:31pm UTC](https://discuss.elastic.co/t/filter-children-in-elasticsearch-nest/117361 "2018-01-28T13:31:31Z")
I want to filter children in elastic search without changing the parent node, i have something like this data, and want to all games, but only "isVisible = true" members should appear with each game { "\_index": "test",… --- ## [High number of deleted docs in segment](https://discuss.elastic.co/t/high-number-of-deleted-docs-in-segment/114372)
**Author:** [@Pankaj.s](https://discuss.elastic.co/u/Pankaj.s)\ **Replies:** 1\ **Last updated:** [January 28, 2018, 1:04pm UTC](https://discuss.elastic.co/t/high-number-of-deleted-docs-in-segment/114372 "2018-01-28T13:04:24Z")
Hi, We've a fairly big elastic cluster (ES version is 2.4.1 and lucene is 5.5.2) having 30 data nodes. We've seen that our biggest index (3.2 TB primary with replication factor of 2 i.e. total ~10 TB. Number of primary … --- ## [Kibana break message into multiple line](https://discuss.elastic.co/t/kibana-break-message-into-multiple-line/117355)
**Author:** [@Farhad\_Yousefi](https://discuss.elastic.co/u/Farhad_Yousefi)\ **Replies:** 0\ **Last updated:** [January 28, 2018, 11:21am UTC](https://discuss.elastic.co/t/kibana-break-message-into-multiple-line/117355 "2018-01-28T11:21:24Z")
I want to monitor "messages" and my application log. For doing that I define two pattern in grok (one for messages and other for my exception in application) filter { if \[type\] == "log" { grok { … --- ## [Span queries](https://discuss.elastic.co/t/span-queries/117352)
**Author:** [@Vishal\_Chaurasia](https://discuss.elastic.co/u/Vishal_Chaurasia)\ **Replies:** 3\ **Last updated:** [January 28, 2018, 10:51am UTC](https://discuss.elastic.co/t/span-queries/117352 "2018-01-28T10:51:01Z")
I want to perform span query on different field. Use case is like this, i have firstname and lastname indexed and i want to perform fuzzy search first on firstname and then lastname. --- ## [Sorting with a custom order - ES 5.6](https://discuss.elastic.co/t/sorting-with-a-custom-order-es-5-6/117351)
**Author:** [@teteu](https://discuss.elastic.co/u/teteu)\ **Replies:** 0\ **Last updated:** [January 28, 2018, 10:02am UTC](https://discuss.elastic.co/t/sorting-with-a-custom-order-es-5-6/117351 "2018-01-28T10:02:13Z")
I'm trying to change the sorting to use an specific order, but it doesn't seem to be working. The order never changes to what I've set up. For the example below, records with posted state should come first This is the c… --- ## [Elasticsearch Maven Plugin using gradle](https://discuss.elastic.co/t/elasticsearch-maven-plugin-using-gradle/115557)
**Author:** [@prakharjain17](https://discuss.elastic.co/u/prakharjain17)\ **Replies:** 10\ **Last updated:** [January 28, 2018, 5:46am UTC](https://discuss.elastic.co/t/elasticsearch-maven-plugin-using-gradle/115557 "2018-01-28T05:46:46Z")
how to use this plugin in gradle project? I know to add dependency // https://mvnrepository.com/artifact/com.github.alexcojocaru/elasticsearch-maven-plugin compile group: 'com.github.alexcojocaru', name: 'elasticsea… --- ## [How can i do, for this problem? this normal befor installed IK , who knew?](https://discuss.elastic.co/t/how-can-i-do-for-this-problem-this-normal-befor-installed-ik-who-knew/117328)
**Author:** [@harisuperman](https://discuss.elastic.co/u/harisuperman)\ **Replies:** 2\ **Last updated:** [January 28, 2018, 4:55am UTC](https://discuss.elastic.co/t/how-can-i-do-for-this-problem-this-normal-befor-installed-ik-who-knew/117328 "2018-01-28T04:55:05Z")
\[2018-01-28T03:34:58,083\]\[INFO \]\[o.e.g.GatewayService \] \[4HMM42y\] recovered \[4\] indices into cluster\_state \[2018-01-28T03:35:03,182\]\[ERROR\]\[o.e.x.m.AgentService \] \[4HMM42y\] exception when exporting documents org.… --- ## [Watch actions proxy authentication](https://discuss.elastic.co/t/watch-actions-proxy-authentication/116894)
**Author:** [@jcoward](https://discuss.elastic.co/u/jcoward)\ **Replies:** 2\ **Last updated:** [January 27, 2018, 10:20pm UTC](https://discuss.elastic.co/t/watch-actions-proxy-authentication/116894 "2018-01-27T22:20:15Z")
I have been trying to get a watcher slack action to post a message to one of my workspace's channels. In the environment where the message must originate from there is a requirement to use a proxy server for egress to th… --- ## [Defines one mapping type for a set of of subfields](https://discuss.elastic.co/t/defines-one-mapping-type-for-a-set-of-of-subfields/117187)
**Author:** [@anon24174512](https://discuss.elastic.co/u/anon24174512)\ **Replies:** 7\ **Last updated:** [January 27, 2018, 10:00pm UTC](https://discuss.elastic.co/t/defines-one-mapping-type-for-a-set-of-of-subfields/117187 "2018-01-27T22:00:42Z")
Hello, Is there a way to define a type for a set of sub fields ? Let say I have: myfield.mysubfield1 myfield.mysubfield2 Is it possible to define the mapping like that : "myfield": { "type": "float", }, So … --- ## [Leading backslash important in Elastic Cloud but not in the official docker container](https://discuss.elastic.co/t/leading-backslash-important-in-elastic-cloud-but-not-in-the-official-docker-container/117292)
**Author:** [@robisrob](https://discuss.elastic.co/u/robisrob)\ **Replies:** 8\ **Last updated:** [January 27, 2018, 8:02pm UTC](https://discuss.elastic.co/t/leading-backslash-important-in-elastic-cloud-but-not-in-the-official-docker-container/117292 "2018-01-27T20:02:37Z")
POST indexname/\_update\_by\_query HTTP/1.1 is failing on Elastic Cloud POST /indexname/\_update\_by\_query HTTP/1.1 is working on Elastic Cloud POST indexname/\_update\_by\_query HTTP/1.1 is working on the official docker cont… --- ## [Bool query with range](https://discuss.elastic.co/t/bool-query-with-range/117321)
**Author:** [@riccardone1](https://discuss.elastic.co/u/riccardone1)\ **Replies:** 1\ **Last updated:** [January 27, 2018, 7:06pm UTC](https://discuss.elastic.co/t/bool-query-with-range/117321 "2018-01-27T19:06:28Z")
Hi Given that in my index there is a document with "LogType": "Terapy" and "LogDate": { "gte": "2015-01-01"} why the following bool query doesn't return any document? { "query": { "bool" : { "must" : { "term" : { … --- ## [Querying Nested Datatype](https://discuss.elastic.co/t/querying-nested-datatype/116408)
**Author:** [@animageofmine](https://discuss.elastic.co/u/animageofmine)\ **Replies:** 6\ **Last updated:** [January 27, 2018, 5:56pm UTC](https://discuss.elastic.co/t/querying-nested-datatype/116408 "2018-01-27T17:56:13Z")
If I have following index mapping for nested type, can I filter on two different fields in the same document? Mapping: { "mappings": { "records": { "properties": { "record": { "type": "nes… --- ## [CPU Throttling](https://discuss.elastic.co/t/cpu-throttling/116392)
**Author:** [@Karl\_Stoney](https://discuss.elastic.co/u/Karl_Stoney)\ **Replies:** 4\ **Last updated:** [January 27, 2018, 5:28pm UTC](https://discuss.elastic.co/t/cpu-throttling/116392 "2018-01-27T17:28:17Z")
Hi All, I'm trying to understand why my master nodes are reporting CPU throttling? I've had a good google but can't find any guidance at all. They are master and ingest nodes, we have separate data nodes, we're doing … --- ## [About aggregations request with scroll, only the first results can be output?](https://discuss.elastic.co/t/about-aggregations-request-with-scroll-only-the-first-results-can-be-output/117300)
**Author:** [@Pelin\_li](https://discuss.elastic.co/u/Pelin_li)\ **Replies:** 4\ **Last updated:** [January 27, 2018, 1:30pm UTC](https://discuss.elastic.co/t/about-aggregations-request-with-scroll-only-the-first-results-can-be-output/117300 "2018-01-27T13:30:14Z")
Version Elasticsearch: "version" : { "number" : "5.0.0", "build\_hash" : "253032b", "build\_date" : "2016-10-26T05:11:34.737Z", "build\_snapshot" : false, "lucene\_version" : "6.2.0" } Java: openjdk … --- ## [Failed shards with top\_hits](https://discuss.elastic.co/t/failed-shards-with-top-hits/116407)
**Author:** [@mihalikv](https://discuss.elastic.co/u/mihalikv)\ **Replies:** 10\ **Last updated:** [January 27, 2018, 11:47am UTC](https://discuss.elastic.co/t/failed-shards-with-top-hits/116407 "2018-01-27T11:47:44Z")
Hi, i'am using ES 5.5.0 in one index with default 5 shards. When i run query with following aggregation: "attributes":{ "global":{ }, "aggs":{ "attributes\_products":{ "filter":{ … --- ## [Why I am not seeing data after upgrade to 6.1 from 5.6](https://discuss.elastic.co/t/why-i-am-not-seeing-data-after-upgrade-to-6-1-from-5-6/117297)
**Author:** [@sachin8778](https://discuss.elastic.co/u/sachin8778)\ **Replies:** 2\ **Last updated:** [January 27, 2018, 11:25am UTC](https://discuss.elastic.co/t/why-i-am-not-seeing-data-after-upgrade-to-6-1-from-5-6/117297 "2018-01-27T11:25:38Z")
I am not finding any data after upgrade is completed. Could you please help me find out what did I miss while upgrading 5.6 to 6.1? I followed the steps as per this link-- https://www.elastic.co/guide/en/elasticsearch/… --- ## [ELK TAR Or RPM Installation is more useful](https://discuss.elastic.co/t/elk-tar-or-rpm-installation-is-more-useful/117294)
**Author:** [@rijinmp](https://discuss.elastic.co/u/rijinmp)\ **Replies:** 3\ **Last updated:** [January 27, 2018, 9:26am UTC](https://discuss.elastic.co/t/elk-tar-or-rpm-installation-is-more-useful/117294 "2018-01-27T09:26:37Z")
Hi all , Its a theoretical question . I am using Tar file for ELK. Extracting and using it . Working well . Xpack also installed in Elasticsearch and Kibana . My question is in a production environment , which option… --- ## [Elasticsearch data node - read & write affect performance](https://discuss.elastic.co/t/elasticsearch-data-node-read-write-affect-performance/117287)
**Author:** [@Hitesh\_Baldaniya](https://discuss.elastic.co/u/Hitesh_Baldaniya)\ **Replies:** 0\ **Last updated:** [January 27, 2018, 6:26am UTC](https://discuss.elastic.co/t/elasticsearch-data-node-read-write-affect-performance/117287 "2018-01-27T06:26:11Z")
As per documentation, we can have separate data node by making configuration. When i actually did this configuration on my cluster i experienced following. My read and write at same moment are affected, when ever I am … --- ## [java.io.IOException: listener timeout after waiting for \[60000\] ms](https://discuss.elastic.co/t/java-io-ioexception-listener-timeout-after-waiting-for-60000-ms/117281)
**Author:** [@rupanjanbaidya](https://discuss.elastic.co/u/rupanjanbaidya)\ **Replies:** 0\ **Last updated:** [January 27, 2018, 3:49am UTC](https://discuss.elastic.co/t/java-io-ioexception-listener-timeout-after-waiting-for-60000-ms/117281 "2018-01-27T03:49:40Z")
I am getting the exception everytime while starting the server, java.io.IOException: listener timeout after waiting for \[60000\] ms at org.elasticsearch.client.RestClient$SyncResponseListener.get(RestClient.java:661) ~\[… --- ## [Visualize: no \[query\] registered for \[query\]](https://discuss.elastic.co/t/visualize-no-query-registered-for-query/117262)
**Author:** [@alexus](https://discuss.elastic.co/u/alexus)\ **Replies:** 2\ **Last updated:** [January 26, 2018, 8:55pm UTC](https://discuss.elastic.co/t/visualize-no-query-registered-for-query/117262 "2018-01-26T20:55:24Z")
I'm trying to follow Setting Up Field and Document Level Security | X-Pack for the Elastic Stack \[6.0\] | Elastic and running into a bit of the issue there... I logged into Kibana, generated a filter that I'd like to app… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1811) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1813)