# Elasticsearch

**URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1819

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 1820

---

## [Elasticsearch failed to start (Result: signal)](https://discuss.elastic.co/t/elasticsearch-failed-to-start-result-signal/116478)

<div class="topic-metadata">

**Author:** [@chrstmnn](https://discuss.elastic.co/u/chrstmnn)\
**Replies:** 0\
**Last updated:** [January 22, 2018, 12:16pm UTC](https://discuss.elastic.co/t/elasticsearch-failed-to-start-result-signal/116478 "2018-01-22T12:16:12Z")

</div>

Hi from a newbie, I tried to install elasticsearch for zammad on centOS 7. Installing was fine without errors, but starting elasticsearch doesn't work. with systemctl status elasticsearch I get the following: elastic…

---

## [WordDelimiterTokenFilter doesn't seem to be generating expected tokens](https://discuss.elastic.co/t/worddelimitertokenfilter-doesnt-seem-to-be-generating-expected-tokens/116476)

<div class="topic-metadata">

**Author:** [@Atul\_Bagga](https://discuss.elastic.co/u/Atul_Bagga)\
**Replies:** 0\
**Last updated:** [January 22, 2018, 12:11pm UTC](https://discuss.elastic.co/t/worddelimitertokenfilter-doesnt-seem-to-be-generating-expected-tokens/116476 "2018-01-22T12:11:30Z")

</div>

Here is my analyzer - { "analysis": { "filter": { "wordDelimiter": { "type": "word\_delimiter", "generate\_word\_parts": "true", "generate\_number\_parts": "true", "catenate\_words": "false", "catenate\_numbers": "fals…

---

## [Need to start ES instance for test purpose](https://discuss.elastic.co/t/need-to-start-es-instance-for-test-purpose/115918)

<div class="topic-metadata">

**Author:** [@prakharjain17](https://discuss.elastic.co/u/prakharjain17)\
**Replies:** 18\
**Last updated:** [January 22, 2018, 11:51am UTC](https://discuss.elastic.co/t/need-to-start-es-instance-for-test-purpose/115918 "2018-01-22T11:51:48Z")

</div>

Hi Ivan and others, I would like to discuss what I am doing, and need help regarding it. We have two components - App (Jersey client) and Data (Elasticsearch) We used to have Couchbase as a data component but we ar…

---

## [QueryBuilder.add(BoolQueryBuilder) is undefined for the type](https://discuss.elastic.co/t/querybuilder-add-boolquerybuilder-is-undefined-for-the-type/116469)

<div class="topic-metadata">

**Author:** [@Master](https://discuss.elastic.co/u/Master)\
**Replies:** 4\
**Last updated:** [January 22, 2018, 11:47am UTC](https://discuss.elastic.co/t/querybuilder-add-boolquerybuilder-is-undefined-for-the-type/116469 "2018-01-22T11:47:57Z")

</div>

Getting this error "The method add(BoolQueryBuilder) is undefined for the type QueryBuilder " private void addAllSchoolFilters(QueryBuilder andQuery, SchoolSearchForm form) { if (form.hasAgeFilter()) { // actual code …

---

## [Circuit Breaker Exception, Data too large (12gb)](https://discuss.elastic.co/t/circuit-breaker-exception-data-too-large-12gb/116450)

<div class="topic-metadata">

**Author:** [@Abhilash\_Bolla](https://discuss.elastic.co/u/Abhilash_Bolla)\
**Replies:** 3\
**Last updated:** [January 22, 2018, 11:39am UTC](https://discuss.elastic.co/t/circuit-breaker-exception-data-too-large-12gb/116450 "2018-01-22T11:39:01Z")

</div>

Hi, I find this exception in my logs. Please help in debugging the same. ES version: 2.4.1 Java version: 1.8 Heap allocated: 30gb \[2018-01-22 06:59:51,212\]\[DEBUG\]\[action.search \] \[cls-es-master\] \[publicat…

---

## [Splitbrain on a 4 node implementation](https://discuss.elastic.co/t/splitbrain-on-a-4-node-implementation/116461)

<div class="topic-metadata">

**Author:** [@Edmund\_Cheng](https://discuss.elastic.co/u/Edmund_Cheng)\
**Replies:** 6\
**Last updated:** [January 22, 2018, 11:38am UTC](https://discuss.elastic.co/t/splitbrain-on-a-4-node-implementation/116461 "2018-01-22T11:38:11Z")

</div>

Hi, I have done some reading about the splitbrain scenario, but seems to have hit a dilemma. e.g for this structure: machine1: 2 ES nodes (with rack id 1) machine2: 2 ES nodes (with rack id 2) In the above case, all…

---

## [Query with "mandatory" filter](https://discuss.elastic.co/t/query-with-mandatory-filter/116443)

<div class="topic-metadata">

**Author:** [@kuseman](https://discuss.elastic.co/u/kuseman)\
**Replies:** 3\
**Last updated:** [January 22, 2018, 11:02am UTC](https://discuss.elastic.co/t/query-with-mandatory-filter/116443 "2018-01-22T11:02:01Z")

</div>

Hi, Started to migrate our system to ES 6/7 single type and having some troubles i need assistance with. We have a system which makes use of mustache templates and we query (before migration) a type along with a templa…

---

## [Completion suggester using java api 6.1.1](https://discuss.elastic.co/t/completion-suggester-using-java-api-6-1-1/116463)

<div class="topic-metadata">

**Author:** [@manfrid](https://discuss.elastic.co/u/manfrid)\
**Replies:** 4\
**Last updated:** [January 22, 2018, 10:49am UTC](https://discuss.elastic.co/t/completion-suggester-using-java-api-6-1-1/116463 "2018-01-22T10:49:45Z")

</div>

I found some code changes in java api 6.1.1. how can i query with completion suggester using java api 6.1.1 ? help!

---

## [How to work with Machine Learning](https://discuss.elastic.co/t/how-to-work-with-machine-learning/116303)

<div class="topic-metadata">

**Author:** [@Pratiksha\_Tewary](https://discuss.elastic.co/u/Pratiksha_Tewary)\
**Replies:** 1\
**Last updated:** [January 22, 2018, 10:47am UTC](https://discuss.elastic.co/t/how-to-work-with-machine-learning/116303 "2018-01-22T10:47:09Z")

</div>

Hi, I am trying to work with X-Pack's Machine Learning feature. There are several resources available at the Elastic websites and beyond to learn about this tool. However, I am having trouble with making ML take in my d…

---

## [AND operator in dis\_max queries](https://discuss.elastic.co/t/and-operator-in-dis-max-queries/111867)

<div class="topic-metadata">

**Author:** [@AnnaM](https://discuss.elastic.co/u/AnnaM)\
**Replies:** 2\
**Last updated:** [January 8, 2018, 1:20pm UTC](https://discuss.elastic.co/t/and-operator-in-dis-max-queries/111867 "2018-01-08T13:20:03Z")

</div>

Is it possible to define that the conditions in dis\_max queries should use AND operator instead OR ( Elasticsearch 5.6.2) ? For my example I want to see only the results which contains ".31319.67121." as "hierarchyPath"…

---

## [Elastic Search sudden blackout / cluster down](https://discuss.elastic.co/t/elastic-search-sudden-blackout-cluster-down/116467)

<div class="topic-metadata">

**Author:** [@Junaid03](https://discuss.elastic.co/u/Junaid03)\
**Replies:** 0\
**Last updated:** [January 22, 2018, 10:21am UTC](https://discuss.elastic.co/t/elastic-search-sudden-blackout-cluster-down/116467 "2018-01-22T10:21:25Z")

</div>

Hello everyone! Greetings! I am running an elastic cluster with 3 masters and 5 data nodes, I have one coordinator node running on localhost which backsup as kibana fetch node (I mean it supports searches across the clu…

---

## [Why our cluster some data nodes leaving cluster by itself?and why we have a node cpu/load so high?](https://discuss.elastic.co/t/why-our-cluster-some-data-nodes-leaving-cluster-by-itself-and-why-we-have-a-node-cpu-load-so-high/116466)

<div class="topic-metadata">

**Author:** [@beaman](https://discuss.elastic.co/u/beaman)\
**Replies:** 0\
**Last updated:** [January 22, 2018, 10:19am UTC](https://discuss.elastic.co/t/why-our-cluster-some-data-nodes-leaving-cluster-by-itself-and-why-we-have-a-node-cpu-load-so-high/116466 "2018-01-22T10:19:53Z")

</div>

our cluster informations: nodes:14 master nodes:3 data nodes:32C/60G(m4.4xlarge) master nodes:4C/8G(c4.xlarge) disk:6TB SSD (10000IOPS) first question: 1, one of our cluster data nodes left cluster by itself, and …

---

## [HDFS respository issue](https://discuss.elastic.co/t/hdfs-respository-issue/116465)

<div class="topic-metadata">

**Author:** [@saijana](https://discuss.elastic.co/u/saijana)\
**Replies:** 1\
**Last updated:** [January 22, 2018, 10:14am UTC](https://discuss.elastic.co/t/hdfs-respository-issue/116465 "2018-01-22T10:14:57Z")

</div>

Hi, I am trying to create a repository in hdfs 1)elasticsearch.yml file: security.manager.enabled: false repositories.hdfs: uri: "hdfs://hostname:port/" # optional - Hadoop file-system URI path: "user/ESind…

---

## [Vague messages in deprecation log on client node](https://discuss.elastic.co/t/vague-messages-in-deprecation-log-on-client-node/115363)

<div class="topic-metadata">

**Author:** [@jctaylor](https://discuss.elastic.co/u/jctaylor)\
**Replies:** 4\
**Last updated:** [January 22, 2018, 10:08am UTC](https://discuss.elastic.co/t/vague-messages-in-deprecation-log-on-client-node/115363 "2018-01-22T10:08:08Z")

</div>

My organization is preparing to upgrade our Elasticsearch cluster from 2.4.5 to 6.x. After running the Migration Helper and enabling deprecation logging, the deprecation log on one of our client nodes began to fill up wi…

---

## [How to delay allocate data to new added DataNode](https://discuss.elastic.co/t/how-to-delay-allocate-data-to-new-added-datanode/116464)

<div class="topic-metadata">

**Author:** [@Jixin](https://discuss.elastic.co/u/Jixin)\
**Replies:** 0\
**Last updated:** [January 22, 2018, 10:02am UTC](https://discuss.elastic.co/t/how-to-delay-allocate-data-to-new-added-datanode/116464 "2018-01-22T10:02:56Z")

</div>

Hi guys, I encountered an issue which is the new added Data Node may not that stable. This node may offline within 5mins after it joined the cluster, and this node will never back online then. So it will cause that som…

---

## [Elasticsearch Spark plugin](https://discuss.elastic.co/t/elasticsearch-spark-plugin/116460)

<div class="topic-metadata">

**Author:** [@Tomas\_Law](https://discuss.elastic.co/u/Tomas_Law)\
**Replies:** 0\
**Last updated:** [January 22, 2018, 9:55am UTC](https://discuss.elastic.co/t/elasticsearch-spark-plugin/116460 "2018-01-22T09:55:09Z")

</div>

Hello, I want to use Spark SQL to query data in Elasticsearch but, from what I read, it's necessary to build a complete Hadoop structure to be able to connect Elasticsearch to Spark using the elasticsearch-hadoop conne…

---

## [ES Cluster via proxy IP, but listener timeout after waiting for \[30000\] ms](https://discuss.elastic.co/t/es-cluster-via-proxy-ip-but-listener-timeout-after-waiting-for-30000-ms/116192)

<div class="topic-metadata">

**Author:** [@lauea](https://discuss.elastic.co/u/lauea)\
**Replies:** 11\
**Last updated:** [January 22, 2018, 9:52am UTC](https://discuss.elastic.co/t/es-cluster-via-proxy-ip-but-listener-timeout-after-waiting-for-30000-ms/116192 "2018-01-22T09:52:22Z")

</div>

Hi Everyone, I ran into below issue. My ES cluster has 3 nodes, and I setup one proxy IP, you can regard it as Loadbalance IP, which points to 3 nodes with ip\_hash. ES Version: 6.0.0 But when I call search API via es…

---

## [Exception while storing data more than 32K](https://discuss.elastic.co/t/exception-while-storing-data-more-than-32k/116444)

<div class="topic-metadata">

**Author:** [@Hanish\_Bansal](https://discuss.elastic.co/u/Hanish_Bansal)\
**Replies:** 4\
**Last updated:** [January 22, 2018, 9:47am UTC](https://discuss.elastic.co/t/exception-while-storing-data-more-than-32k/116444 "2018-01-22T09:47:04Z")

</div>

Hi All, We are getting exception while storing data more than 32K in an index field. We just need to store the data without any indexing. Elasticsearch version: 6.0.0 Field Data Type: "type": "keyword" and "index": f…

---

## [Role mapping and Custom Security realm](https://discuss.elastic.co/t/role-mapping-and-custom-security-realm/115491)

<div class="topic-metadata">

**Author:** [@gsu](https://discuss.elastic.co/u/gsu)\
**Replies:** 3\
**Last updated:** [January 22, 2018, 9:41am UTC](https://discuss.elastic.co/t/role-mapping-and-custom-security-realm/115491 "2018-01-22T09:41:58Z")

</div>

As I understand it the role mapping API allows me to create mappings that (currently?) only the LDAP and AD authentication realms use. If I want to implement my own custom authentication realm I have to do the role mapp…

---

## [JLH score calculation](https://discuss.elastic.co/t/jlh-score-calculation/115835)

<div class="topic-metadata">

**Author:** [@Adam4](https://discuss.elastic.co/u/Adam4)\
**Replies:** 3\
**Last updated:** [January 22, 2018, 9:39am UTC](https://discuss.elastic.co/t/jlh-score-calculation/115835 "2018-01-22T09:39:43Z")

</div>

I'm trying to manually calculate the jlh score while running a significant term query and I don't get the same score. Steps: query: { "query": { "terms": { "${myFieldName}": \[ "hurricane" \] …

---

## [Ignore shingle tokens when highlighting](https://discuss.elastic.co/t/ignore-shingle-tokens-when-highlighting/115695)

<div class="topic-metadata">

**Author:** [@bslinger](https://discuss.elastic.co/u/bslinger)\
**Replies:** 4\
**Last updated:** [January 22, 2018, 9:18am UTC](https://discuss.elastic.co/t/ignore-shingle-tokens-when-highlighting/115695 "2018-01-22T09:18:24Z")

</div>

I'm using shingles in our index to allow for matches on multi-words when a search using a joined version of the word is entered, eg. to allow 'giantbomb' to match a field with the term 'giant bomb' in it. This is workin…

---

## [How to get shard allocating time](https://discuss.elastic.co/t/how-to-get-shard-allocating-time/116431)

<div class="topic-metadata">

**Author:** [@8a98bb2968a03fe24acf](https://discuss.elastic.co/u/8a98bb2968a03fe24acf)\
**Replies:** 3\
**Last updated:** [January 22, 2018, 8:52am UTC](https://discuss.elastic.co/t/how-to-get-shard-allocating-time/116431 "2018-01-22T08:52:35Z")

</div>

Hi there I want to get shards allocating time in Elasticsearch when these allocated How can I get that?

---

## [Index/Sharding design](https://discuss.elastic.co/t/index-sharding-design/116439)

<div class="topic-metadata">

**Author:** [@blanks](https://discuss.elastic.co/u/blanks)\
**Replies:** 0\
**Last updated:** [January 22, 2018, 7:40am UTC](https://discuss.elastic.co/t/index-sharding-design/116439 "2018-01-22T07:40:23Z")

</div>

I read through many guides and currently I'm defining an index for our production Cluster (three nodes for the start). I have questons about the following things: Is the document count relevant at all for an index ? I…

---

## [How to wrap nested query with filter by \_index field in ElasticSearch?](https://discuss.elastic.co/t/how-to-wrap-nested-query-with-filter-by-index-field-in-elasticsearch/113095)

<div class="topic-metadata">

**Author:** [@SimpleCode](https://discuss.elastic.co/u/SimpleCode)\
**Replies:** 3\
**Last updated:** [January 22, 2018, 7:40am UTC](https://discuss.elastic.co/t/how-to-wrap-nested-query-with-filter-by-index-field-in-elasticsearch/113095 "2018-01-22T07:40:21Z")

</div>

I have the following query GET product,account/producttype,accounttype/\_search { "query": { "bool": { "should": \[ { "bool": { "must": \[ { "nested": { "query": { "bool": { "should": \[ { "match": { "keyword…

---

## [How to access es with certification?](https://discuss.elastic.co/t/how-to-access-es-with-certification/116027)

<div class="topic-metadata">

**Author:** [@foxfire881](https://discuss.elastic.co/u/foxfire881)\
**Replies:** 5\
**Last updated:** [January 22, 2018, 7:37am UTC](https://discuss.elastic.co/t/how-to-access-es-with-certification/116027 "2018-01-22T07:37:40Z")

</div>

we use 'http://10.0.0.1:9200' to access es without certification in the earlier versions, but in es 6.1.1， I secure es with certification(truststore/keystore), then how to access es form another client host with certific…

---

## [Taking more time in Elastic Search](https://discuss.elastic.co/t/taking-more-time-in-elastic-search/116206)

<div class="topic-metadata">

**Author:** [@aneesh](https://discuss.elastic.co/u/aneesh)\
**Replies:** 3\
**Last updated:** [January 22, 2018, 7:35am UTC](https://discuss.elastic.co/t/taking-more-time-in-elastic-search/116206 "2018-01-22T07:35:34Z")

</div>

Hi I have an index, which is having 4 records. But its taking more 700 milliseconds. Note : index.max\_result\_window : 100000 when decreasing window size, time also For each index number of records is different(some \< …

---

## [Sizing an ELK Stack for analyzing \>1TB of logs from S3](https://discuss.elastic.co/t/sizing-an-elk-stack-for-analyzing-1tb-of-logs-from-s3/116321)

<div class="topic-metadata">

**Author:** [@Henry\_N](https://discuss.elastic.co/u/Henry_N)\
**Replies:** 0\
**Last updated:** [January 20, 2018, 3:09am UTC](https://discuss.elastic.co/t/sizing-an-elk-stack-for-analyzing-1tb-of-logs-from-s3/116321 "2018-01-20T03:09:39Z")

</div>

Hello. I'm new to ELK stack. In order to accomplish this, do I need the same if not greater amount of storage space on the EC2 where ELK is installed?

---

## [Searched for single item =\> ES return near whole index](https://discuss.elastic.co/t/searched-for-single-item-es-return-near-whole-index/115094)

<div class="topic-metadata">

**Author:** [@Mojster](https://discuss.elastic.co/u/Mojster)\
**Replies:** 7\
**Last updated:** [January 22, 2018, 6:31am UTC](https://discuss.elastic.co/t/searched-for-single-item-es-return-near-whole-index/115094 "2018-01-22T06:31:24Z")

</div>

I'm using ES 6.1.1. I want to select single item by message. My query in Kibana is: GET MY\_INDEX/\_search { "query": { "constant\_score": { "filter": { "bool": { "must": \[ { …

---

## [Null data from hive table with only index (excluding type)](https://discuss.elastic.co/t/null-data-from-hive-table-with-only-index-excluding-type/115824)

<div class="topic-metadata">

**Author:** [@Dante](https://discuss.elastic.co/u/Dante)\
**Replies:** 2\
**Last updated:** [January 22, 2018, 2:52am UTC](https://discuss.elastic.co/t/null-data-from-hive-table-with-only-index-excluding-type/115824 "2018-01-22T02:52:41Z")

</div>

Hi All, I have met a strange problem as below: Steps1: Create one hive table with only index (like 'es.resource' = 'tomcat' without \_type) Query the table Results1: I got null data occasionally! And sometimes the r…

---

## [Is there a way to ignore the aggregation value in metrics like 'min\_doc\_count' in term aggregation?](https://discuss.elastic.co/t/is-there-a-way-to-ignore-the-aggregation-value-in-metrics-like-min-doc-count-in-term-aggregation/116421)

<div class="topic-metadata">

**Author:** [@bglee](https://discuss.elastic.co/u/bglee)\
**Replies:** 0\
**Last updated:** [January 22, 2018, 2:36am UTC](https://discuss.elastic.co/t/is-there-a-way-to-ignore-the-aggregation-value-in-metrics-like-min-doc-count-in-term-aggregation/116421 "2018-01-22T02:36:41Z")

</div>

Hi, I am bglee. GET myIndex/\_search { "size":0, "query":{ ... }, "aggs":{ "only\_values\_​​return\_greater\_than\_10":{ "sum":{ "field":"only\_values\_​​return\_greater\_…

[Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1818)

[Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1820)
