# Elasticsearch

**URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1864

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 1865

---

## [Are sorted indexes supported with index templates?](https://discuss.elastic.co/t/are-sorted-indexes-supported-with-index-templates/110484)

<div class="topic-metadata">

**Author:** [@aoeuid](https://discuss.elastic.co/u/aoeuid)\
**Replies:** 0\
**Last updated:** [December 6, 2017, 9:46am UTC](https://discuss.elastic.co/t/are-sorted-indexes-supported-with-index-templates/110484 "2017-12-06T09:46:25Z")

</div>

I've tried to combine them (even with pre-declared fields as the sort keys) but I get the following error: {"type":"illegal\_argument\_exception","reason":"unknown index sort field:\[my\_field\]"} Thank you!

---

## [How to pass token (any type) to the ES(xpack) instead of userNamePassword?](https://discuss.elastic.co/t/how-to-pass-token-any-type-to-the-es-xpack-instead-of-usernamepassword/110390)

<div class="topic-metadata">

**Author:** [@hym](https://discuss.elastic.co/u/hym)\
**Replies:** 3\
**Last updated:** [December 6, 2017, 9:45am UTC](https://discuss.elastic.co/t/how-to-pass-token-any-type-to-the-es-xpack-instead-of-usernamepassword/110390 "2017-12-06T09:45:52Z")

</div>

Hi, I've worked by xpack security and its custom realms with its basic definitions as well as run-as feature. But what I am looking for now, is passing on the token (like SAML) to the ES and then parse that token to au…

---

## [Security using Elasticsearch and X-pack in Angular 2/5](https://discuss.elastic.co/t/security-using-elasticsearch-and-x-pack-in-angular-2-5/109990)

<div class="topic-metadata">

**Author:** [@bradley](https://discuss.elastic.co/u/bradley)\
**Replies:** 1\
**Last updated:** [December 6, 2017, 9:34am UTC](https://discuss.elastic.co/t/security-using-elasticsearch-and-x-pack-in-angular-2-5/109990 "2017-12-06T09:34:47Z")

</div>

I have posted this question to Stack Overflow to gather information about how to plan my application around security. The main question is how to leverage Elasticsearch and X-pack to hide part of my application from the …

---

## [Elasticsearch Fuzzy Search does not work sometimes for correctly spelled words](https://discuss.elastic.co/t/elasticsearch-fuzzy-search-does-not-work-sometimes-for-correctly-spelled-words/110477)

<div class="topic-metadata">

**Author:** [@alexey.gurevskiy](https://discuss.elastic.co/u/alexey.gurevskiy)\
**Replies:** 0\
**Last updated:** [December 6, 2017, 9:27am UTC](https://discuss.elastic.co/t/elasticsearch-fuzzy-search-does-not-work-sometimes-for-correctly-spelled-words/110477 "2017-12-06T09:27:25Z")

</div>

I'm working on FTS feature in our product. Everything has been going smoothly until today. One of our clients complains that if he enters a full and correctly spelled word (e.g. 'important') then the search returns no re…

---

## [SnifferBuilder.sniffOnFailureListener() not honored](https://discuss.elastic.co/t/snifferbuilder-sniffonfailurelistener-not-honored/110468)

<div class="topic-metadata">

**Author:** [@eyasso](https://discuss.elastic.co/u/eyasso)\
**Replies:** 1\
**Last updated:** [December 6, 2017, 9:24am UTC](https://discuss.elastic.co/t/snifferbuilder-sniffonfailurelistener-not-honored/110468 "2017-12-06T09:24:24Z")

</div>

Hi, I am using elasticsearch-rest-client-sniffer version 5.6.3. I am following the example code for getting sniffing nodes health: Sniffer Usage SniffOnFailureListener sniffOnFailureListener = new SniffOnFailureListen…

---

## [Private and group dashboards in X-Pack 6?](https://discuss.elastic.co/t/private-and-group-dashboards-in-x-pack-6/110037)

<div class="topic-metadata">

**Author:** [@JohanRask](https://discuss.elastic.co/u/JohanRask)\
**Replies:** 1\
**Last updated:** [December 6, 2017, 9:19am UTC](https://discuss.elastic.co/t/private-and-group-dashboards-in-x-pack-6/110037 "2017-12-06T09:19:20Z")

</div>

Hi, I was wondering if it is possible to have personal/group dashboards in the latest version of X-Pack? Reading through forums suggests that it is something that has been working on for a while. We will have lots of u…

---

## [Large translog files using 6.0 stack](https://discuss.elastic.co/t/large-translog-files-using-6-0-stack/110375)

<div class="topic-metadata">

**Author:** [@stevedearl](https://discuss.elastic.co/u/stevedearl)\
**Replies:** 9\
**Last updated:** [December 6, 2017, 9:03am UTC](https://discuss.elastic.co/t/large-translog-files-using-6-0-stack/110375 "2017-12-06T09:03:42Z")

</div>

Hi, I switched to using the new 6.0 ELK stack this morning and when loading data (I started from a brand new instance, rather than trying to migrate) I noticed that I was running out of disk space on my server running E…

---

## [FieldStats support](https://discuss.elastic.co/t/fieldstats-support/107144)

<div class="topic-metadata">

**Author:** [@gphadke](https://discuss.elastic.co/u/gphadke)\
**Replies:** 10\
**Last updated:** [December 6, 2017, 8:51am UTC](https://discuss.elastic.co/t/fieldstats-support/107144 "2017-12-06T08:51:46Z")

</div>

Hello FieldStats is removed in ES 6.0. Wanted to know if the functionality is provided by any other API or combination of APIs. We have been using it to filter numbers of indices to search which store time series data.…

---

## [Lucene's index is not compatible, then ES not compatible too?](https://discuss.elastic.co/t/lucenes-index-is-not-compatible-then-es-not-compatible-too/110466)

<div class="topic-metadata">

**Author:** [@shijiebei2009](https://discuss.elastic.co/u/shijiebei2009)\
**Replies:** 0\
**Last updated:** [December 6, 2017, 7:26am UTC](https://discuss.elastic.co/t/lucenes-index-is-not-compatible-then-es-not-compatible-too/110466 "2017-12-06T07:26:11Z")

</div>

Usually, Lucene 7.0.0 is not compatible with 5.5.0, such as (Lucene 7.0.0 read indexes created by Lucene 5.5.0) Format version is not supported (resource BufferedChecksumIndexInput(MMapIndexInput(path="F:\\segments\_1")))…

---

## [Index getting delayed?](https://discuss.elastic.co/t/index-getting-delayed/110395)

<div class="topic-metadata">

**Author:** [@mykael](https://discuss.elastic.co/u/mykael)\
**Replies:** 2\
**Last updated:** [December 6, 2017, 8:44am UTC](https://discuss.elastic.co/t/index-getting-delayed/110395 "2017-12-06T08:44:53Z")

</div>

I'm writing a javascript program that will inject test data records into Elasticsearch, several thousand at a time. It's using a hot sleep to make the program slow down so the timestamp on each record is at least a few …

---

## [Index pattern matching all non-system indices](https://discuss.elastic.co/t/index-pattern-matching-all-non-system-indices/110413)

<div class="topic-metadata">

**Author:** [@Supermathie](https://discuss.elastic.co/u/Supermathie)\
**Replies:** 10\
**Last updated:** [December 6, 2017, 7:38am UTC](https://discuss.elastic.co/t/index-pattern-matching-all-non-system-indices/110413 "2017-12-06T07:38:08Z")

</div>

We are running ES6 and have a number of indices: other-%{+YYYY.MM.dd} nginx-%{+YYYY.MM.dd} haproxy-%{+YYYY.MM.dd} We would like to have an index pattern matching all of these, but discovered that \* also matches the sy…

---

## [Mapping from JSON](https://discuss.elastic.co/t/mapping-from-json/110262)

<div class="topic-metadata">

**Author:** [@nkdev89](https://discuss.elastic.co/u/nkdev89)\
**Replies:** 5\
**Last updated:** [December 6, 2017, 6:01am UTC](https://discuss.elastic.co/t/mapping-from-json/110262 "2017-12-06T06:01:33Z")

</div>

Hi , I have a JSON file which has the mapping details for a index, Please let me know how do i use it when creating Index from NEST Client (C#). Thanks Naveen

---

## [Threat Intelligence](https://discuss.elastic.co/t/threat-intelligence/110453)

<div class="topic-metadata">

**Author:** [@Krunal\_kalaria](https://discuss.elastic.co/u/Krunal_kalaria)\
**Replies:** 6\
**Last updated:** [December 6, 2017, 5:57am UTC](https://discuss.elastic.co/t/threat-intelligence/110453 "2017-12-06T05:57:16Z")

</div>

Hello Everyone, Can you suggest me how to integrate threat intelligence platform with ELK i want to integrate threat intelligence with my ELK please guide me how to integrate. Thnks & Regards, Krunal K.

---

## [Elasticsearch Supports UTF-8 only?](https://discuss.elastic.co/t/elasticsearch-supports-utf-8-only/110454)

<div class="topic-metadata">

**Author:** [@Narmatha](https://discuss.elastic.co/u/Narmatha)\
**Replies:** 0\
**Last updated:** [December 6, 2017, 5:01am UTC](https://discuss.elastic.co/t/elasticsearch-supports-utf-8-only/110454 "2017-12-06T05:01:23Z")

</div>

Does elasticsearch supports UTF-8 only? Is there a way we could change it to UTF-16 through any special configurations from the code.

---

## [Understanding Search Query](https://discuss.elastic.co/t/understanding-search-query/110425)

<div class="topic-metadata">

**Author:** [@rwat090](https://discuss.elastic.co/u/rwat090)\
**Replies:** 2\
**Last updated:** [December 6, 2017, 3:02am UTC](https://discuss.elastic.co/t/understanding-search-query/110425 "2017-12-06T03:02:16Z")

</div>

Hi Everyone, Im just trying to understand the results I’m returned from a search query, I was hoping someone could point me to documentation or explain the reason for the result… “Version” : "5.6.4", "lucene\_version" …

---

## [Ingest node date processor can't save filed type as 'date'](https://discuss.elastic.co/t/ingest-node-date-processor-cant-save-filed-type-as-date/110304)

<div class="topic-metadata">

**Author:** [@shiloong](https://discuss.elastic.co/u/shiloong)\
**Replies:** 4\
**Last updated:** [December 6, 2017, 2:56am UTC](https://discuss.elastic.co/t/ingest-node-date-processor-cant-save-filed-type-as-date/110304 "2017-12-06T02:56:31Z")

</div>

Hi ,I'm using ES5.4. I'm trying to use Ingest node date processor parse a file and save to another，the source filed type is keyword and the target filed type also keyword，why it not date type？

---

## [Replica Shard is in unallocated state after upgrade to 6.0 from 5.6.0](https://discuss.elastic.co/t/replica-shard-is-in-unallocated-state-after-upgrade-to-6-0-from-5-6-0/108375)

<div class="topic-metadata">

**Author:** [@Dheeraj\_Gupta](https://discuss.elastic.co/u/Dheeraj_Gupta)\
**Replies:** 6\
**Last updated:** [December 6, 2017, 2:49am UTC](https://discuss.elastic.co/t/replica-shard-is-in-unallocated-state-after-upgrade-to-6-0-from-5-6-0/108375 "2017-12-06T02:49:32Z")

</div>

I have performed a rolling upgrade on my ES cluster to upgrade it from 5.6.0 to 6.0.0. The upgrade went smoothly and all of my nodes were upgraded. Post upgrade, I noticed that a single replica shard of an index was una…

---

## [Error status : 400](https://discuss.elastic.co/t/error-status-400/110446)

<div class="topic-metadata">

**Author:** [@VidyaKumar](https://discuss.elastic.co/u/VidyaKumar)\
**Replies:** 1\
**Last updated:** [December 6, 2017, 2:38am UTC](https://discuss.elastic.co/t/error-status-400/110446 "2017-12-06T02:38:02Z")

</div>

When trying to import sample data into elasticsearch, getting the following error: "type" : "action\_request\_validation\_exception", "reason" : "Validation Failed: 1: type is missing;2: type is missing;3: type is missing…

---

## [Elasticsearch didn't auto recover from disk space full](https://discuss.elastic.co/t/elasticsearch-didnt-auto-recover-from-disk-space-full/110172)

<div class="topic-metadata">

**Author:** [@songtianyi](https://discuss.elastic.co/u/songtianyi)\
**Replies:** 3\
**Last updated:** [December 6, 2017, 1:46am UTC](https://discuss.elastic.co/t/elasticsearch-didnt-auto-recover-from-disk-space-full/110172 "2017-12-06T01:46:32Z")

</div>

I'm using ES 2.2.2, here is what i am confusing. stages: ES running ok host space full ES running bad delete some nonsense logs ES still running bad(nested: AlreadyClosedException\[translog is already closed\]; ) restar…

---

## [Elasticsearch grandchild aggregation](https://discuss.elastic.co/t/elasticsearch-grandchild-aggregation/110443)

<div class="topic-metadata">

**Author:** [@shrenikgala](https://discuss.elastic.co/u/shrenikgala)\
**Replies:** 0\
**Last updated:** [December 6, 2017, 1:35am UTC](https://discuss.elastic.co/t/elasticsearch-grandchild-aggregation/110443 "2017-12-06T01:35:06Z")

</div>

I have the following data model hierarchy: League cups -\> teams -\> players. League cup is the parent of teams and team is parent of players. League cup model has an attribute called country. I'm trying to write an aggreg…

---

## [Run multiple Elastic search instance in Linux environment](https://discuss.elastic.co/t/run-multiple-elastic-search-instance-in-linux-environment/110433)

<div class="topic-metadata">

**Author:** [@sstest](https://discuss.elastic.co/u/sstest)\
**Replies:** 2\
**Last updated:** [December 6, 2017, 1:23am UTC](https://discuss.elastic.co/t/run-multiple-elastic-search-instance-in-linux-environment/110433 "2017-12-06T01:23:24Z")

</div>

Hi, Is it possible to run 2 Elasticsearch instances like ES-2.x and ES-6 in parallel in the same Linux server as RPM installation. My concern is - if we install it as Linux RPM then the new one will override the existin…

---

## [Error in XPACK elasicsearch](https://discuss.elastic.co/t/error-in-xpack-elasicsearch/110428)

<div class="topic-metadata">

**Author:** [@Vivek\_Nigam](https://discuss.elastic.co/u/Vivek_Nigam)\
**Replies:** 5\
**Last updated:** [December 6, 2017, 1:21am UTC](https://discuss.elastic.co/t/error-in-xpack-elasicsearch/110428 "2017-12-06T01:21:47Z")

</div>

While running XPack elasicserch getting following error: ./elasticsearch \[2017-12-06T03:18:26,851\]\[INFO \]\[o.e.n.Node \] \[\] initializing ... \[2017-12-06T03:18:26,883\]\[WARN \]\[o.e.b.ElasticsearchUncaughtExce…

---

## [What levers are present to control memory usage in Elastic Search?](https://discuss.elastic.co/t/what-levers-are-present-to-control-memory-usage-in-elastic-search/109494)

<div class="topic-metadata">

**Author:** [@antonpious](https://discuss.elastic.co/u/antonpious)\
**Replies:** 11\
**Last updated:** [December 6, 2017, 1:06am UTC](https://discuss.elastic.co/t/what-levers-are-present-to-control-memory-usage-in-elastic-search/109494 "2017-12-06T01:06:15Z")

</div>

Since elastic search is a search engine, the amount of memory given to it would be less than the total data that is stored in search engine. Is this assumption valid? If we have 100 GB of Data can elastic be configured…

---

## [java.net.BindException: Cannot assign requested address](https://discuss.elastic.co/t/java-net-bindexception-cannot-assign-requested-address/110430)

<div class="topic-metadata">

**Author:** [@Bhavana](https://discuss.elastic.co/u/Bhavana)\
**Replies:** 3\
**Last updated:** [December 6, 2017, 12:59am UTC](https://discuss.elastic.co/t/java-net-bindexception-cannot-assign-requested-address/110430 "2017-12-06T00:59:28Z")

</div>

Elasticsearch version - 5.6.4 I am trying to install Elasticsearch in production environment. i have changed network.host: ipaddress in the elasticsearch.yml file I tried changing http.port from 9200 to 9300, it is t…

---

## [How Can i get max id of indexed documents](https://discuss.elastic.co/t/how-can-i-get-max-id-of-indexed-documents/110403)

<div class="topic-metadata">

**Author:** [@pamara](https://discuss.elastic.co/u/pamara)\
**Replies:** 1\
**Last updated:** [December 5, 2017, 11:25pm UTC](https://discuss.elastic.co/t/how-can-i-get-max-id-of-indexed-documents/110403 "2017-12-05T23:25:16Z")

</div>

I am new to elastic search. I indexed few of documents and i want to find the max id which ever inserted across the documents. My URL something like ":/books/dramabooks/\_search?size=0" { "aggs" : { "max\_id" : { "max"…

---

## [Regex running on version 5.4](https://discuss.elastic.co/t/regex-running-on-version-5-4/109501)

<div class="topic-metadata">

**Author:** [@paulohss](https://discuss.elastic.co/u/paulohss)\
**Replies:** 9\
**Last updated:** [December 5, 2017, 11:08pm UTC](https://discuss.elastic.co/t/regex-running-on-version-5-4/109501 "2017-12-05T23:08:21Z")

</div>

Hi guys, I'm not able to find yet what I'm doing wrong here. So, this is the scenario: 1. Config set (script.painless.regex.enabled: true) 2. The Field I'm interested is called "DESCRIPTION". 3. I've tried these quer…

---

## [Job for elasticsearch.service failed because the control process exited with error code](https://discuss.elastic.co/t/job-for-elasticsearch-service-failed-because-the-control-process-exited-with-error-code/109831)

<div class="topic-metadata">

**Author:** [@kyle\_che](https://discuss.elastic.co/u/kyle_che)\
**Replies:** 7\
**Last updated:** [December 5, 2017, 9:26pm UTC](https://discuss.elastic.co/t/job-for-elasticsearch-service-failed-because-the-control-process-exited-with-error-code/109831 "2017-12-05T21:26:35Z")

</div>

root@d-gp2-es46-1:~# service elasticsearch start Job for elasticsearch.service failed because the control process exited with error code. See "systemctl status elasticsearch.service" and "journalctl -xe" for details. r…

---

## [Watcher to delete index](https://discuss.elastic.co/t/watcher-to-delete-index/110333)

<div class="topic-metadata">

**Author:** [@Mads\_Frisk\_Sorensen](https://discuss.elastic.co/u/Mads_Frisk_Sorensen)\
**Replies:** 3\
**Last updated:** [December 5, 2017, 9:19pm UTC](https://discuss.elastic.co/t/watcher-to-delete-index/110333 "2017-12-05T21:19:32Z")

</div>

Hi I have a watcher, that should delete my logstash indices after 31 days. I'm having trouble with the transform part of the watcher. In the 'source' line I would like it to find the date minus 31 days. I have the fo…

---

## [Speed up the pipeline](https://discuss.elastic.co/t/speed-up-the-pipeline/110415)

<div class="topic-metadata">

**Author:** [@amitavmohanty01](https://discuss.elastic.co/u/amitavmohanty01)\
**Replies:** 2\
**Last updated:** [December 5, 2017, 8:05pm UTC](https://discuss.elastic.co/t/speed-up-the-pipeline/110415 "2017-12-05T20:05:48Z")

</div>

I have set up of 3 machines: Single ES process setup with 20gb heap size and 16 processors 2 logstash processes each with 20gb heap size connecting to the same ES on machine 1 filebeat pumping data to the 2 logstash pr…

---

## [Elasticsearch painless](https://discuss.elastic.co/t/elasticsearch-painless/108649)

<div class="topic-metadata">

**Author:** [@shijiebei2009](https://discuss.elastic.co/u/shijiebei2009)\
**Replies:** 7\
**Last updated:** [December 5, 2017, 6:19pm UTC](https://discuss.elastic.co/t/elasticsearch-painless/108649 "2017-12-05T18:19:10Z")

</div>

when using script in elasticsearch, why must we use params.\_source to access \_source in GET query, but use ctx.\_source to access \_source in POST query, es v5.5.0

[Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1863)

[Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1865)
