# Elasticsearch

**URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1838

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 1839

---

## [ElasticSearch bulk insert not OK using curl, message](https://discuss.elastic.co/t/elasticsearch-bulk-insert-not-ok-using-curl-message/112863)

<div class="topic-metadata">

**Author:** [@Amouzigh\_Driss](https://discuss.elastic.co/u/Amouzigh_Driss)\
**Replies:** 4\
**Last updated:** [January 4, 2018, 11:55am UTC](https://discuss.elastic.co/t/elasticsearch-bulk-insert-not-ok-using-curl-message/112863 "2018-01-04T11:55:18Z")

</div>

Hello, I'm trying to use curl and call ElasticSearch bulk API. The call is like this: curl -XPOST "http://localhost:9200/myindex/mytype/\_bulk" --data-binary @req -H "Con tent-Type: application/x-ndjson" --user elast…

---

## [Performance problem on a single cluster node](https://discuss.elastic.co/t/performance-problem-on-a-single-cluster-node/114042)

<div class="topic-metadata">

**Author:** [@jayjay](https://discuss.elastic.co/u/jayjay)\
**Replies:** 2\
**Last updated:** [January 4, 2018, 11:53am UTC](https://discuss.elastic.co/t/performance-problem-on-a-single-cluster-node/114042 "2018-01-04T11:53:53Z")

</div>

Hi all, I m curently upgrading our elasticsearch single node from 1.4.2 to 6.1. The new version is installed on a new server but the new logstash receive the same data (mainly logs). I have a really strange behavior, T…

---

## [Multiple primary shards and how this work on multiple node](https://discuss.elastic.co/t/multiple-primary-shards-and-how-this-work-on-multiple-node/114080)

<div class="topic-metadata">

**Author:** [@tremk](https://discuss.elastic.co/u/tremk)\
**Replies:** 1\
**Last updated:** [January 4, 2018, 11:47am UTC](https://discuss.elastic.co/t/multiple-primary-shards-and-how-this-work-on-multiple-node/114080 "2018-01-04T11:47:33Z")

</div>

Hello In elasticsearch we can have multiple primary shards i.e by default we have 5 primary shards for one index. How elasticsearch store 5 primary shard, i.e if i have 3 nodes in the clusters and create an index with …

---

## [java.lang.NoClassDefFoundError: org/elasticsearch/common/transport/InetSocketTransportAddress](https://discuss.elastic.co/t/java-lang-noclassdeffounderror-org-elasticsearch-common-transport-inetsockettransportaddress/114073)

<div class="topic-metadata">

**Author:** [@Master](https://discuss.elastic.co/u/Master)\
**Replies:** 0\
**Last updated:** [January 4, 2018, 11:29am UTC](https://discuss.elastic.co/t/java-lang-noclassdeffounderror-org-elasticsearch-common-transport-inetsockettransportaddress/114073 "2018-01-04T11:29:20Z")

</div>

java.lang.NoClassDefFoundError: org/elasticsearch/common/transport/InetSocketTransportAddress at org.springframework.beans.factory.annotation.AutowiredAnnotationBeanPostProcessor.postProcessPropertyValues(AutowiredAnnot…

---

## [Having issues in elasticsearch geo\_point search query in node js application](https://discuss.elastic.co/t/having-issues-in-elasticsearch-geo-point-search-query-in-node-js-application/114064)

<div class="topic-metadata">

**Author:** [@thealitahir](https://discuss.elastic.co/u/thealitahir)\
**Replies:** 0\
**Last updated:** [January 4, 2018, 10:50am UTC](https://discuss.elastic.co/t/having-issues-in-elasticsearch-geo-point-search-query-in-node-js-application/114064 "2018-01-04T10:50:10Z")

</div>

Hey there! Hope you doing fine. I'm working on node js (version 6.1.0 ) application and using elasticsearch (version 5.0.1) in it. But I'm having issues in geo\_point query. I'm doing mapping like this client.indices.pu…

---

## [How can I use ElasticSearch for my usecase?](https://discuss.elastic.co/t/how-can-i-use-elasticsearch-for-my-usecase/114062)

<div class="topic-metadata">

**Author:** [@simkimsia](https://discuss.elastic.co/u/simkimsia)\
**Replies:** 0\
**Last updated:** [January 4, 2018, 10:38am UTC](https://discuss.elastic.co/t/how-can-i-use-elasticsearch-for-my-usecase/114062 "2018-01-04T10:38:29Z")

</div>

Hi there, I have primarily web development background and now in business development. I like to equip myself with more knowledge in technologies I am not aware of in order to put together better solutions for my custom…

---

## [How to update all the documents in elastic seach](https://discuss.elastic.co/t/how-to-update-all-the-documents-in-elastic-seach/114018)

<div class="topic-metadata">

**Author:** [@happy0088](https://discuss.elastic.co/u/happy0088)\
**Replies:** 5\
**Last updated:** [January 4, 2018, 10:24am UTC](https://discuss.elastic.co/t/how-to-update-all-the-documents-in-elastic-seach/114018 "2018-01-04T10:24:30Z")

</div>

Hi, I need to update all the value of the keys named as "per\_name" (key is the document Json key:value pair entry ) in all the documents in all the indexes present in my Elastic Search . I have an update curl which tak…

---

## [How do add Junt Test in ES6 plugin](https://discuss.elastic.co/t/how-do-add-junt-test-in-es6-plugin/113166)

<div class="topic-metadata">

**Author:** [@arliang](https://discuss.elastic.co/u/arliang)\
**Replies:** 3\
**Last updated:** [January 4, 2018, 9:15am UTC](https://discuss.elastic.co/t/how-do-add-junt-test-in-es6-plugin/113166 "2018-01-04T09:15:48Z")

</div>

Dear All I want to add a Junit Test for the elasticsearch-analysis-ik project, read the official documents there are haves many questions. Can give me more detailed instructions or examples for ElasticSearch6 and Mave…

---

## [Yellow cluster....why?](https://discuss.elastic.co/t/yellow-cluster-why/113941)

<div class="topic-metadata">

**Author:** [@sbampa](https://discuss.elastic.co/u/sbampa)\
**Replies:** 25\
**Last updated:** [January 4, 2018, 8:28am UTC](https://discuss.elastic.co/t/yellow-cluster-why/113941 "2018-01-04T08:28:08Z")

</div>

Hi all, my kibana monitoring says: Elasticsearch cluster status is yellow. Allocate missing replica shards. But all shards seems to be allocated: GET \_cat/shards return taht all shards are started. Nothing else. How…

---

## [Dynamo2es-lambda plugin versionField is showing FieldNotFoundError](https://discuss.elastic.co/t/dynamo2es-lambda-plugin-versionfield-is-showing-fieldnotfounderror/114036)

<div class="topic-metadata">

**Author:** [@vaidehi9039](https://discuss.elastic.co/u/vaidehi9039)\
**Replies:** 0\
**Last updated:** [January 4, 2018, 8:09am UTC](https://discuss.elastic.co/t/dynamo2es-lambda-plugin-versionfield-is-showing-fieldnotfounderror/114036 "2018-01-04T08:09:13Z")

</div>

Hi, I am trying to insert data from dynamodb to elasticsearch through lambda function. But it is creating new indices in elasticsearch whenever I insert data in dynamoDB. The versionField in "dynamo2es-lambda" plugin is…

---

## [How can I do substring match without fuzzy search](https://discuss.elastic.co/t/how-can-i-do-substring-match-without-fuzzy-search/114032)

<div class="topic-metadata">

**Author:** [@a0e775adb87d82f8fc3a](https://discuss.elastic.co/u/a0e775adb87d82f8fc3a)\
**Replies:** 0\
**Last updated:** [January 4, 2018, 7:27am UTC](https://discuss.elastic.co/t/how-can-i-do-substring-match-without-fuzzy-search/114032 "2018-01-04T07:27:26Z")

</div>

I have indexed 2 columns of my table name and description. I am using a lib to call the ES to get my result. But the result it is giving me is not what I want. I want a substring match, but it does fuzzy search. I do hav…

---

## [Wildcard search with \_ (underscore) is giving no result](https://discuss.elastic.co/t/wildcard-search-with-underscore-is-giving-no-result/114010)

<div class="topic-metadata">

**Author:** [@RohanKumbhar](https://discuss.elastic.co/u/RohanKumbhar)\
**Replies:** 6\
**Last updated:** [January 4, 2018, 6:41am UTC](https://discuss.elastic.co/t/wildcard-search-with-underscore-is-giving-no-result/114010 "2018-01-04T06:41:43Z")

</div>

Hi Team, I facing the issue while using wild card search with query containing understore (\_) in it with elasticsearch version 6.0.1 And i'm using word\_delimiter\_filter for the field my\_field as mentioned in below quer…

---

## [Distinct count of many fields in a single ES query](https://discuss.elastic.co/t/distinct-count-of-many-fields-in-a-single-es-query/114011)

<div class="topic-metadata">

**Author:** [@shemilr](https://discuss.elastic.co/u/shemilr)\
**Replies:** 0\
**Last updated:** [January 4, 2018, 5:32am UTC](https://discuss.elastic.co/t/distinct-count-of-many-fields-in-a-single-es-query/114011 "2018-01-04T05:32:23Z")

</div>

Hi, I am trying to find the distinct values from one of my index. My requirement is, need to find distinct count of more than one filed and I am using group by also. I am getting the distinct value of single field. But…

---

## [How to validate painless scripts?](https://discuss.elastic.co/t/how-to-validate-painless-scripts/114004)

<div class="topic-metadata">

**Author:** [@sunil\_purushothaman](https://discuss.elastic.co/u/sunil_purushothaman)\
**Replies:** 1\
**Last updated:** [January 4, 2018, 5:21am UTC](https://discuss.elastic.co/t/how-to-validate-painless-scripts/114004 "2018-01-04T05:21:55Z")

</div>

We use many ScriptQuery and ScriptField in our project, and provide inline scripts for them in painless language. My question is, how can we validate these painless scripts? In other words, how to make sure that they wi…

---

## [Upper limit on cluster state](https://discuss.elastic.co/t/upper-limit-on-cluster-state/113816)

<div class="topic-metadata">

**Author:** [@animageofmine](https://discuss.elastic.co/u/animageofmine)\
**Replies:** 12\
**Last updated:** [January 4, 2018, 4:33am UTC](https://discuss.elastic.co/t/upper-limit-on-cluster-state/113816 "2018-01-04T04:33:25Z")

</div>

I have spent good amount of time reading multiple blogs and documents, both on elasticsearch and other websites to understand the scalability limits of Elasticsearch. It looks like Cluster state is one of the critical d…

---

## [ES 6.1 windows service: can't have multiple clusters on one VM any more?](https://discuss.elastic.co/t/es-6-1-windows-service-cant-have-multiple-clusters-on-one-vm-any-more/113991)

<div class="topic-metadata">

**Author:** [@Thomas\_Doman](https://discuss.elastic.co/u/Thomas_Doman)\
**Replies:** 2\
**Last updated:** [January 4, 2018, 3:24am UTC](https://discuss.elastic.co/t/es-6-1-windows-service-cant-have-multiple-clusters-on-one-vm-any-more/113991 "2018-01-04T03:24:22Z")

</div>

For development purposes, we have been running multiple ES 1.7.5 clusters on one VM. Right now, we're in the process of upgrading to ES 6.1. In using the MSI installer, I've discovered that, apparently I cannot do this…

---

## [Cluster Died during Downgrade. We are dead in the water](https://discuss.elastic.co/t/cluster-died-during-downgrade-we-are-dead-in-the-water/113984)

<div class="topic-metadata">

**Author:** [@Mike\_Maddox](https://discuss.elastic.co/u/Mike_Maddox)\
**Replies:** 1\
**Last updated:** [January 3, 2018, 11:01pm UTC](https://discuss.elastic.co/t/cluster-died-during-downgrade-we-are-dead-in-the-water/113984 "2018-01-03T23:01:28Z")

</div>

We've had ElasticCloud for a long time and tried to downgrade and it somehow messed up and created multiple shards. Ours is stuck in a bad state and we can't do anything. The backups are too old. Anything we can do. Any …

---

## [5.6 -\> 6.1 Upgrade logstash template woes (SOLVED)](https://discuss.elastic.co/t/5-6-6-1-upgrade-logstash-template-woes-solved/113968)

<div class="topic-metadata">

**Author:** [@Chris\_Stone](https://discuss.elastic.co/u/Chris_Stone)\
**Replies:** 1\
**Last updated:** [January 3, 2018, 9:39pm UTC](https://discuss.elastic.co/t/5-6-6-1-upgrade-logstash-template-woes-solved/113968 "2018-01-03T21:39:19Z")

</div>

After performing a 5.6 to 6.1 upgrade of my ELK stack, I noticed these errors in the logstash logs: \[2018-01-03T08:16:53,027\]\[WARN \]\[logstash.outputs.elasticsearch\] Could not index event to Elasticsearch. {:status=\>400,…

---

## [Error during elasticsearch deployment via puppet](https://discuss.elastic.co/t/error-during-elasticsearch-deployment-via-puppet/108008)

<div class="topic-metadata">

**Author:** [@shoshoro99](https://discuss.elastic.co/u/shoshoro99)\
**Replies:** 13\
**Last updated:** [January 3, 2018, 9:32pm UTC](https://discuss.elastic.co/t/error-during-elasticsearch-deployment-via-puppet/108008 "2018-01-03T21:32:36Z")

</div>

Deploying elasticsearch via puppet ( puppet version 4.10.8) elasticsearch module (elastic-elasticsearch (v5.4.3)) , i got te below errors Info: Applying configuration version '1510860503' Error: /Stage\[main\]/Analytic::E…

---

## [Text mining: mtermvectors for multiple fields](https://discuss.elastic.co/t/text-mining-mtermvectors-for-multiple-fields/113981)

<div class="topic-metadata">

**Author:** [@ACJ](https://discuss.elastic.co/u/ACJ)\
**Replies:** 0\
**Last updated:** [January 3, 2018, 8:54pm UTC](https://discuss.elastic.co/t/text-mining-mtermvectors-for-multiple-fields/113981 "2018-01-03T20:54:33Z")

</div>

Hi everyone! I'm currently doing some text mining. I'm looking for a way to insert a second field (storyline) in my following code: res=es.mtermvectors(index="movies",doc\_type="movie",ids=",".join(str(x) for x in docI…

---

## [Maybe to add more nodes on a single hardware box?](https://discuss.elastic.co/t/maybe-to-add-more-nodes-on-a-single-hardware-box/111870)

<div class="topic-metadata">

**Author:** [@learner](https://discuss.elastic.co/u/learner)\
**Replies:** 2\
**Last updated:** [January 3, 2018, 6:56pm UTC](https://discuss.elastic.co/t/maybe-to-add-more-nodes-on-a-single-hardware-box/111870 "2018-01-03T18:56:07Z")

</div>

Hi, I have a single powerful hardware box that has 48 CPU cores and 254 GB of RAM to run the Elastic Stack 6.1. And, I've assigned 3GB of heap for ES. Otherwise, everything else has been left with the default configur…

---

## [How to get rid of dangling indices](https://discuss.elastic.co/t/how-to-get-rid-of-dangling-indices/113805)

<div class="topic-metadata">

**Author:** [@Diverking](https://discuss.elastic.co/u/Diverking)\
**Replies:** 1\
**Last updated:** [January 3, 2018, 5:22pm UTC](https://discuss.elastic.co/t/how-to-get-rid-of-dangling-indices/113805 "2018-01-03T17:22:40Z")

</div>

We are running a cluster of 3 nodes and I find in the logfiles continious repeating messages: \[2018-01-02T16:24:58,539\]\[WARN \]\[o.e.g.DanglingIndicesState\] \[lrv171d1\] \[\[.watches/dT22WrbgTM24J0ZuROKQ2A\]\] can not be import…

---

## [2.x Yum repo is down](https://discuss.elastic.co/t/2-x-yum-repo-is-down/113955)

<div class="topic-metadata">

**Author:** [@tnadeau](https://discuss.elastic.co/u/tnadeau)\
**Replies:** 1\
**Last updated:** [January 3, 2018, 5:01pm UTC](https://discuss.elastic.co/t/2-x-yum-repo-is-down/113955 "2018-01-03T17:01:47Z")

</div>

It looks like the 2.x Yum repo (https://artifacts.elastic.co/packages/2.x/yum/repodata/repomd.xml) is down. They give a NoSuchKey error with the message "The specified key does not exist.".

---

## [How to remove stuck persistent setting after upgrade](https://discuss.elastic.co/t/how-to-remove-stuck-persistent-setting-after-upgrade/113366)

<div class="topic-metadata">

**Author:** [@Jacket](https://discuss.elastic.co/u/Jacket)\
**Replies:** 8\
**Last updated:** [January 3, 2018, 4:26pm UTC](https://discuss.elastic.co/t/how-to-remove-stuck-persistent-setting-after-upgrade/113366 "2018-01-03T16:26:36Z")

</div>

I have just upgraded my cluster from 5.6 to 6.1. I did a rolling upgrade as the documentation specified. It looks like a setting that I was using isn't available anymore in 6.1. That would've been fine, but now I can't e…

---

## [Use a timestamp to version documents in an index ingested with 'org.elasticsearch.hadoop.hive.EsStorageHandler'](https://discuss.elastic.co/t/use-a-timestamp-to-version-documents-in-an-index-ingested-with-org-elasticsearch-hadoop-hive-esstoragehandler/110774)

<div class="topic-metadata">

**Author:** [@Matthew\_Henricks](https://discuss.elastic.co/u/Matthew_Henricks)\
**Replies:** 1\
**Last updated:** [January 3, 2018, 4:14pm UTC](https://discuss.elastic.co/t/use-a-timestamp-to-version-documents-in-an-index-ingested-with-org-elasticsearch-hadoop-hive-esstoragehandler/110774 "2018-01-03T16:14:20Z")

</div>

Hi Everyone, I'm looking to update/version a series of documents based on a timestamp within them. For this process, it seems like the best of doing so would be to use external versioning with the index API - datetime.t…

---

## [Genre syntax didn't return classification data](https://discuss.elastic.co/t/genre-syntax-didnt-return-classification-data/113940)

<div class="topic-metadata">

**Author:** [@f26227279](https://discuss.elastic.co/u/f26227279)\
**Replies:** 0\
**Last updated:** [January 3, 2018, 2:38pm UTC](https://discuss.elastic.co/t/genre-syntax-didnt-return-classification-data/113940 "2018-01-03T14:38:36Z")

</div>

AS title my data index is:"ntopng-2018.01.02" this is my Restful API: GET ntopng-2018.01.02/\_search { "size" : 0, "query": { "bool": { "should": \[ { "term":{"IPV4\_SRC\_ADDR":"120.127.160.91"} }, { "term":{"IPV4\_D…

---

## [A watch Alert on an Aggregation's Aggregation AKA an array of arrays](https://discuss.elastic.co/t/a-watch-alert-on-an-aggregations-aggregation-aka-an-array-of-arrays/113840)

<div class="topic-metadata">

**Author:** [@megadevx](https://discuss.elastic.co/u/megadevx)\
**Replies:** 3\
**Last updated:** [January 3, 2018, 2:19pm UTC](https://discuss.elastic.co/t/a-watch-alert-on-an-aggregations-aggregation-aka-an-array-of-arrays/113840 "2018-01-03T14:19:49Z")

</div>

I need help creating the correct compare to trigger with watch. The bolded doc count is what I need to trigger the watch however it appears multiple times. I am trying to create a watch on count of dst\_ip by each clien…

---

## [Elasticsearch - limit to half of available cpu cores](https://discuss.elastic.co/t/elasticsearch-limit-to-half-of-available-cpu-cores/113917)

<div class="topic-metadata">

**Author:** [@rs\_ela](https://discuss.elastic.co/u/rs_ela)\
**Replies:** 4\
**Last updated:** [January 3, 2018, 1:57pm UTC](https://discuss.elastic.co/t/elasticsearch-limit-to-half-of-available-cpu-cores/113917 "2018-01-03T13:57:44Z")

</div>

Hi. Is there an option to limit Elasticsearch to run, for example, on only half of available cpu cores on the machine? I'm running some heavy queries on my ELK instance which sometimes loads all cores at 100%. Since ther…

---

## [Best mapping/architecture for querying latest members from join/leave documents?](https://discuss.elastic.co/t/best-mapping-architecture-for-querying-latest-members-from-join-leave-documents/111695)

<div class="topic-metadata">

**Author:** [@michaelcheung](https://discuss.elastic.co/u/michaelcheung)\
**Replies:** 0\
**Last updated:** [December 14, 2017, 7:16am UTC](https://discuss.elastic.co/t/best-mapping-architecture-for-querying-latest-members-from-join-leave-documents/111695 "2017-12-14T07:16:35Z")

</div>

There are a number of groups, where people can join and leave any groups. I have logs on all join and leave action, i.e. {"user": "Alice", "action": "JOIN", "group": "group-0", "@timestamp": "2017-12-12T20:00:00.000Z"} a…

---

## [What is the different between feature and endpoint in elasticsearch?](https://discuss.elastic.co/t/what-is-the-different-between-feature-and-endpoint-in-elasticsearch/113913)

<div class="topic-metadata">

**Author:** [@tremk](https://discuss.elastic.co/u/tremk)\
**Replies:** 2\
**Last updated:** [January 3, 2018, 12:10pm UTC](https://discuss.elastic.co/t/what-is-the-different-between-feature-and-endpoint-in-elasticsearch/113913 "2018-01-03T12:10:30Z")

</div>

What is the different between feature and endpoint in elasticsearch? \[image\] I have try with GET my\_index/\_mappings or GET my\_index/\_mapping and both return same result

[Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1837)

[Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1839)
