# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1844 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1845 --- ## [30 shards or daily index?](https://discuss.elastic.co/t/30-shards-or-daily-index/112121)
**Author:** [@80c1141eb6d0c564dd90](https://discuss.elastic.co/u/80c1141eb6d0c564dd90)\ **Replies:** 2\ **Last updated:** [December 25, 2017, 8:57am UTC](https://discuss.elastic.co/t/30-shards-or-daily-index/112121 "2017-12-25T08:57:51Z")
What is better for performance - make 30 shards in index =\> \["prod-%{+YYYY.MM}"\] or daily index like index =\> \["prod-%{+YYYY.MM.dd}"\]? P.s. I plan to use ELK for storing app logs for 2-3 years P.p.s. Approximate amount… --- ## [Unable to access elasticsearch instance from browser after changing the port](https://discuss.elastic.co/t/unable-to-access-elasticsearch-instance-from-browser-after-changing-the-port/112996)
**Author:** [@Milad\_Hamid](https://discuss.elastic.co/u/Milad_Hamid)\ **Replies:** 4\ **Last updated:** [December 25, 2017, 8:20am UTC](https://discuss.elastic.co/t/unable-to-access-elasticsearch-instance-from-browser-after-changing-the-port/112996 "2017-12-25T08:20:40Z")
Hi, Just to make my production setup more secure i changed the default http.port in elasticsearch.yml, then i restarted the elasticsearch service. Now i can't access the ES instance from browser! It was working fine wi… --- ## [Elastisearch + update+range time filter](https://discuss.elastic.co/t/elastisearch-update-range-time-filter/112067)
**Author:** [@bruno-d](https://discuss.elastic.co/u/bruno-d)\ **Replies:** 14\ **Last updated:** [December 23, 2017, 10:17pm UTC](https://discuss.elastic.co/t/elastisearch-update-range-time-filter/112067 "2017-12-23T22:17:15Z")
Hi i have an update\_by\_query using specific field. i am looking for the filter that will update the last 15 minutes only of a syslog message timestamp. Have you got the syntax please in release 5.6.4 of ELK, please ? ( i… --- ## [Detecting Data Loss](https://discuss.elastic.co/t/detecting-data-loss/113010)
**Author:** [@Jeff\_Bolle](https://discuss.elastic.co/u/Jeff_Bolle)\ **Replies:** 5\ **Last updated:** [December 24, 2017, 8:30pm UTC](https://discuss.elastic.co/t/detecting-data-loss/113010 "2017-12-24T20:30:59Z")
Last night we lost 3 nodes in our cluster. From the logging I have it looks like they died sequentially over the course of about 2 hours. The cause of why they became unresponsive is not yet known. I was able to SSH in… --- ## [MultiTermVectorsRequest using .Net client nest](https://discuss.elastic.co/t/multitermvectorsrequest-using-net-client-nest/113039)
**Author:** [@sramalin](https://discuss.elastic.co/u/sramalin)\ **Replies:** 1\ **Last updated:** [December 24, 2017, 5:39pm UTC](https://discuss.elastic.co/t/multitermvectorsrequest-using-net-client-nest/113039 "2017-12-24T17:39:46Z")
All, From the docs here https://www.elastic.co/guide/en/elasticsearch/reference/current/docs-multi-termvectors.html i see there are multiple ways to make the request. I can do the POST /\_mtermvectors as MultiTermVecto… --- ## [How can I add a open source (free) sentiment filter](https://discuss.elastic.co/t/how-can-i-add-a-open-source-free-sentiment-filter/109684)
**Author:** [@bsongcc](https://discuss.elastic.co/u/bsongcc)\ **Replies:** 6\ **Last updated:** [December 24, 2017, 4:59pm UTC](https://discuss.elastic.co/t/how-can-i-add-a-open-source-free-sentiment-filter/109684 "2017-12-24T16:59:42Z")
Anybody know if I there's a free/open source sentiment analysis API available for elasticsearch? The Alchemy API used to be the one to go to, but now it's bought by IBM and not in use anymore. Please suggest, thanks! --- ## [Elasticsearch Reindex Big Index](https://discuss.elastic.co/t/elasticsearch-reindex-big-index/107569)
**Author:** [@eng.behjati](https://discuss.elastic.co/u/eng.behjati)\ **Replies:** 4\ **Last updated:** [December 18, 2017, 8:41am UTC](https://discuss.elastic.co/t/elasticsearch-reindex-big-index/107569 "2017-12-18T08:41:24Z")
Hi everyone! I have a problem with elasticsearch reindex API. when I run reindex API on big index , after ES reindexes certain number of documents, it responses "search context not found" exception. I should mention th… --- ## [Is X-pack a trial product?](https://discuss.elastic.co/t/is-x-pack-a-trial-product/113090)
**Author:** [@Michael\_Tsikerdekis](https://discuss.elastic.co/u/Michael_Tsikerdekis)\ **Replies:** 2\ **Last updated:** [December 24, 2017, 4:09am UTC](https://discuss.elastic.co/t/is-x-pack-a-trial-product/113090 "2017-12-24T04:09:45Z")
I am planning to implemented for a course that I am teaching at my university but if it is a trial there is no way I can force students to buy it. Is x-pack a trial product? --- ## [Kibana, elasticsearch and filebeat. Do i need logstash?](https://discuss.elastic.co/t/kibana-elasticsearch-and-filebeat-do-i-need-logstash/113070)
**Author:** [@mvanhemert](https://discuss.elastic.co/u/mvanhemert)\ **Replies:** 3\ **Last updated:** [December 23, 2017, 6:50pm UTC](https://discuss.elastic.co/t/kibana-elasticsearch-and-filebeat-do-i-need-logstash/113070 "2017-12-23T18:50:25Z")
Hello, I'm a compleet n00b concerning the ELK stack. I'm a network engineer and doing some research about logging and analytics. I wanna do 3 things. Grab log out of /var/log on the local machine. Grab log via filebea… --- ## [Elasticsearch giving warning for painless script](https://discuss.elastic.co/t/elasticsearch-giving-warning-for-painless-script/113030)
**Author:** [@Shubham\_Mahajan](https://discuss.elastic.co/u/Shubham_Mahajan)\ **Replies:** 3\ **Last updated:** [December 23, 2017, 1:28pm UTC](https://discuss.elastic.co/t/elasticsearch-giving-warning-for-painless-script/113030 "2017-12-23T13:28:04Z")
Hi team, I have a question regarding Date API. As you can see in the below script, i am trying to subtract two dates. As this script does give me the result but with that it's also giving me a Deprecation warning. \[ima… --- ## [Elasticsearch 6.1.0 settings parser error](https://discuss.elastic.co/t/elasticsearch-6-1-0-settings-parser-error/112805)
**Author:** [@trondhindenes](https://discuss.elastic.co/u/trondhindenes)\ **Replies:** 2\ **Last updated:** [December 23, 2017, 10:09am UTC](https://discuss.elastic.co/t/elasticsearch-6-1-0-settings-parser-error/112805 "2017-12-23T10:09:12Z")
It seems that 6.1.0 is more strict in how it parses settings. We're trying to upgrade to 6.1.0 but are blocked because our config file is no longer working. We're using readonlyrest, and with this config, ES refuses to s… --- ## [Elastic search Q'ing issue](https://discuss.elastic.co/t/elastic-search-qing-issue/113050)
**Author:** [@melvilgit](https://discuss.elastic.co/u/melvilgit)\ **Replies:** 2\ **Last updated:** [December 23, 2017, 8:05am UTC](https://discuss.elastic.co/t/elastic-search-qing-issue/113050 "2017-12-23T08:05:50Z")
I have a kafka consumer that reads from broker and send it to ElasticSearch.The QPS is pretty high. My consumer is in Node.js and it asynchronously post to Elasticsearch for all events incoming. Getting this error wh… --- ## [How to import json file through Restful java api?](https://discuss.elastic.co/t/how-to-import-json-file-through-restful-java-api/113061)
**Author:** [@gou02rav32](https://discuss.elastic.co/u/gou02rav32)\ **Replies:** 0\ **Last updated:** [December 23, 2017, 4:39am UTC](https://discuss.elastic.co/t/how-to-import-json-file-through-restful-java-api/113061 "2017-12-23T04:39:21Z")
Please give me some syntax which helps me through it, If possible some links also. my code:-1: ObjectMapper mapper = new ObjectMapper(); String path = "C:\\Users\\Gourav Bhattacharya\\Downloads\\accounts\\accounts.json"; … --- ## [Elasticsearch 6.1 Maven](https://discuss.elastic.co/t/elasticsearch-6-1-maven/111660)
**Author:** [@questar](https://discuss.elastic.co/u/questar)\ **Replies:** 8\ **Last updated:** [December 18, 2017, 4:19pm UTC](https://discuss.elastic.co/t/elasticsearch-6-1-maven/111660 "2017-12-18T16:19:40Z")
Hello, Can't retrieve the maven dependency to 6.1.0 as yet. Thanks --- ## [Elastalertrule - exclude ip#](https://discuss.elastic.co/t/elastalertrule-exclude-ip/113028)
**Author:** [@musican73](https://discuss.elastic.co/u/musican73)\ **Replies:** 1\ **Last updated:** [December 22, 2017, 11:04pm UTC](https://discuss.elastic.co/t/elastalertrule-exclude-ip/113028 "2017-12-22T23:04:21Z")
Hello! I need help to exclude an IP# in a rule. This rule watches for firewall\_rejects. I have started with this: filter: - regexp: \*\* ip\_address: "^(?!192.168.0.2).\*$"\*\* I do not need alertings or emails from the… --- ## [Wants to configure live data from MS sql server to Elasticsearch](https://discuss.elastic.co/t/wants-to-configure-live-data-from-ms-sql-server-to-elasticsearch/113045)
**Author:** [@pingmehere](https://discuss.elastic.co/u/pingmehere)\ **Replies:** 2\ **Last updated:** [December 22, 2017, 10:31pm UTC](https://discuss.elastic.co/t/wants-to-configure-live-data-from-ms-sql-server-to-elasticsearch/113045 "2017-12-22T22:31:35Z")
Hey anyone can help me to configure live data to elasticsearch from my MS SQL SERVER database. Thanks:) --- ## [Combine Should and Must](https://discuss.elastic.co/t/combine-should-and-must/112691)
**Author:** [@bevikra](https://discuss.elastic.co/u/bevikra)\ **Replies:** 1\ **Last updated:** [December 22, 2017, 8:07pm UTC](https://discuss.elastic.co/t/combine-should-and-must/112691 "2017-12-22T20:07:31Z")
nodeid = 1234 AND channel = 1 AND ( objects = car OR objects = truck ) AND ( conditions = day OR conditions = dusk ) on the following record. { "assetProps": { "contentSha1": "202301b9931ab9… --- ## [Make painless script conditional on presence of field](https://discuss.elastic.co/t/make-painless-script-conditional-on-presence-of-field/112904)
**Author:** [@tun0](https://discuss.elastic.co/u/tun0)\ **Replies:** 1\ **Last updated:** [December 22, 2017, 8:02pm UTC](https://discuss.elastic.co/t/make-painless-script-conditional-on-presence-of-field/112904 "2017-12-22T20:02:38Z")
I currently have the following painless script: def m = /^(/\[^/?&\]+).+/.matcher(doc\['request\_uri.keyword'\].value); if ( m.matches() ) { return m.group(1) } else { return "" } This works just fine, as long as request\_ur… --- ## [java.lang.NoClassDefFoundError: org/elasticsearch/transport/TcpChannel](https://discuss.elastic.co/t/java-lang-noclassdeffounderror-org-elasticsearch-transport-tcpchannel/112875)
**Author:** [@ankur\_singla](https://discuss.elastic.co/u/ankur_singla)\ **Replies:** 11\ **Last updated:** [December 22, 2017, 7:57pm UTC](https://discuss.elastic.co/t/java-lang-noclassdeffounderror-org-elasticsearch-transport-tcpchannel/112875 "2017-12-22T19:57:08Z")
I am using 6.1.1 version of elastic but while building TransportClient using PreBuiltTransportClient this error comes up. Settings settings = Settings.builder() .put("cluster.name", "abcdef").build(); Transpor… --- ## [Elasticsearch fails to restart after upgrade](https://discuss.elastic.co/t/elasticsearch-fails-to-restart-after-upgrade/111821)
**Author:** [@jattenberg](https://discuss.elastic.co/u/jattenberg)\ **Replies:** 9\ **Last updated:** [December 22, 2017, 5:50pm UTC](https://discuss.elastic.co/t/elasticsearch-fails-to-restart-after-upgrade/111821 "2017-12-22T17:50:15Z")
I recently upgraded a local elasticsearch service via apt from 5.2.2 to 5.6.1. Things were working well before, and I've followed the provided upgrade instructions. However, the when attempting to restart the service I s… --- ## [X-Pack Security :: Role Index Restriction with Regexp](https://discuss.elastic.co/t/x-pack-security-role-index-restriction-with-regexp/112908)
**Author:** [@aaronloesattv](https://discuss.elastic.co/u/aaronloesattv)\ **Replies:** 2\ **Last updated:** [December 22, 2017, 5:20pm UTC](https://discuss.elastic.co/t/x-pack-security-role-index-restriction-with-regexp/112908 "2017-12-22T17:20:16Z")
We have an ES cluster we're using for logs. We have many indexes that are prefixed with "log-". I'm trying to create two roles, one which has access to all log indexes which is easy enough, but another that has access to… --- ## [Get built in analyzer configuration as JSON](https://discuss.elastic.co/t/get-built-in-analyzer-configuration-as-json/112529)
**Author:** [@sramalin](https://discuss.elastic.co/u/sramalin)\ **Replies:** 3\ **Last updated:** [December 22, 2017, 4:48pm UTC](https://discuss.elastic.co/t/get-built-in-analyzer-configuration-as-json/112529 "2017-12-22T16:48:18Z")
Hello All, Is there a rest call to get the JSON representation of the built in analyzers available in Elasticsearch. For example if i request the "english" analyzer, I would like to get the JSON shown here https://www… --- ## [How do you make geo\_points in Elasticsearch 6.x?](https://discuss.elastic.co/t/how-do-you-make-geo-points-in-elasticsearch-6-x/112729)
**Author:** [@tehowe](https://discuss.elastic.co/u/tehowe)\ **Replies:** 4\ **Last updated:** [December 22, 2017, 4:30pm UTC](https://discuss.elastic.co/t/how-do-you-make-geo-points-in-elasticsearch-6-x/112729 "2017-12-22T16:30:26Z")
Hello, so I think I so far have a pretty good basic foundation for my central logging project set up. I have a number of hosts running filebeat, shipping syslogs, apache2 logs, and the apt history log to one of two iden… --- ## [Not abe to connect to elastic search cloud cluster from Transport Client](https://discuss.elastic.co/t/not-abe-to-connect-to-elastic-search-cloud-cluster-from-transport-client/112942)
**Author:** [@ankur\_singla](https://discuss.elastic.co/u/ankur_singla)\ **Replies:** 1\ **Last updated:** [December 22, 2017, 4:10pm UTC](https://discuss.elastic.co/t/not-abe-to-connect-to-elastic-search-cloud-cluster-from-transport-client/112942 "2017-12-22T16:10:56Z")
I am using 6.1.1 elastic search but while connecting to elastic cloud with transport client i am getting java.io.StreamCorruptedException: invalid internal transport message format, got (48,54,54,50) I am using X-pack … --- ## [How to display data in kibana](https://discuss.elastic.co/t/how-to-display-data-in-kibana/112989)
**Author:** [@narasiman1986](https://discuss.elastic.co/u/narasiman1986)\ **Replies:** 1\ **Last updated:** [December 22, 2017, 4:07pm UTC](https://discuss.elastic.co/t/how-to-display-data-in-kibana/112989 "2017-12-22T16:07:24Z")
in discover i have details as follows Name Age City Diseases Raj 25 Chennai Myopia Ravi 35 Chennai Glaucoma Ram 48 Chennai catract Sam … --- ## [How many open files/handles should ES have?](https://discuss.elastic.co/t/how-many-open-files-handles-should-es-have/110245)
**Author:** [@Jose\_Ramierez](https://discuss.elastic.co/u/Jose_Ramierez)\ **Replies:** 6\ **Last updated:** [December 22, 2017, 3:57pm UTC](https://discuss.elastic.co/t/how-many-open-files-handles-should-es-have/110245 "2017-12-22T15:57:32Z")
5.6.4 on CentOS 7 \[root@localhost ~\]# lsof |grep elasticsearch|wc -l 6780 is that a normal number? This ES instance is behind logstash, fwiw. The same command against logstash shows 170-200 open files. --- ## [Typeahead using edge\_ngram](https://discuss.elastic.co/t/typeahead-using-edge-ngram/112021)
**Author:** [@bjd14](https://discuss.elastic.co/u/bjd14)\ **Replies:** 1\ **Last updated:** [December 22, 2017, 3:57pm UTC](https://discuss.elastic.co/t/typeahead-using-edge-ngram/112021 "2017-12-22T15:57:08Z")
I'm using edge\_ngram for an auto-complete in a text box of course. The index I'm trying to convert to a typeaheadable index "Code" : { "type" : "text", "fields" : { "so… --- ## [Index ignoring template](https://discuss.elastic.co/t/index-ignoring-template/112292)
**Author:** [@turnlikeawheel](https://discuss.elastic.co/u/turnlikeawheel)\ **Replies:** 1\ **Last updated:** [December 22, 2017, 3:44pm UTC](https://discuss.elastic.co/t/index-ignoring-template/112292 "2017-12-22T15:44:47Z")
Disclaimer: I'm a bit new to ES/Filebeat so I may be misunderstanding something. The problem is that ES is indexing the Filebeat field "beat.hostname" as text rather than keyword on seemingly random days when the daily … --- ## [Deleting elastic search logs](https://discuss.elastic.co/t/deleting-elastic-search-logs/113020)
**Author:** [@surendran](https://discuss.elastic.co/u/surendran)\ **Replies:** 1\ **Last updated:** [December 22, 2017, 3:44pm UTC](https://discuss.elastic.co/t/deleting-elastic-search-logs/113020 "2017-12-22T15:44:11Z")
How we can retain last 10 days elastic search logs for ES\_5.x and remaining have to delete automatically based on time frame or yyyy/mm/dd ? So is there any plugins or config changes available to take care this task ? … --- ## [Show the server that is down](https://discuss.elastic.co/t/show-the-server-that-is-down/112221)
**Author:** [@deuskars](https://discuss.elastic.co/u/deuskars)\ **Replies:** 1\ **Last updated:** [December 22, 2017, 3:32pm UTC](https://discuss.elastic.co/t/show-the-server-that-is-down/112221 "2017-12-22T15:32:08Z")
Hi, I am sending following data to elasticsearch from multiple servers. SysTime, HostName, MemFree, CPULoad I am sending this data every 5 minutes. That is every 5 minutes some 10 servers in my deployment will send th… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1843) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1845)