# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1877 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1878 --- ## [Filter by attribute possible values dictionary](https://discuss.elastic.co/t/filter-by-attribute-possible-values-dictionary/95278)
**Author:** [@James.Gray](https://discuss.elastic.co/u/James.Gray)\ **Replies:** 1\ **Last updated:** [November 24, 2017, 9:42pm UTC](https://discuss.elastic.co/t/filter-by-attribute-possible-values-dictionary/95278 "2017-11-24T21:42:52Z")
Hello ES team et all, We’re looking to replace our simple search (C# Entity Framework calls) with a more advanced search function. We have been using the EF solution for anything doing internal lookups for our eCommerce… --- ## [Stop phrases rather words](https://discuss.elastic.co/t/stop-phrases-rather-words/108058)
**Author:** [@AmitG](https://discuss.elastic.co/u/AmitG)\ **Replies:** 1\ **Last updated:** [November 24, 2017, 9:35pm UTC](https://discuss.elastic.co/t/stop-phrases-rather-words/108058 "2017-11-24T21:35:39Z")
Hi, I am sure this would have been discussed earlier but not able to find much. We have a requirement to exclude phrase rather than individual word e.g. if name is 'Big Elephant', it should be excluded but it is either '… --- ## [Simpler bulk api](https://discuss.elastic.co/t/simpler-bulk-api/108579)
**Author:** [@konstantino](https://discuss.elastic.co/u/konstantino)\ **Replies:** 2\ **Last updated:** [November 24, 2017, 9:17pm UTC](https://discuss.elastic.co/t/simpler-bulk-api/108579 "2017-11-24T21:17:20Z")
OK, so \_bulk api over HTTP follows this structure: POST \_bulk {index, type=foo} {foo : my data} {index, type=foo} {foo : my other data} Would it be possible to still use the bulk api but instead place index and typ… --- ## [Disable Snapshots Elastic](https://discuss.elastic.co/t/disable-snapshots-elastic/109080)
**Author:** [@handyc](https://discuss.elastic.co/u/handyc)\ **Replies:** 1\ **Last updated:** [November 24, 2017, 8:28pm UTC](https://discuss.elastic.co/t/disable-snapshots-elastic/109080 "2017-11-24T20:28:01Z")
Hi !!! I need to stop snapshots on my cluster asap, can you pleas help me? My cluster ID is ca8979, i do understand the risk of that. Thanks !!! --- ## [Network.host issue](https://discuss.elastic.co/t/network-host-issue/109063)
**Author:** [@AskingBoy](https://discuss.elastic.co/u/AskingBoy)\ **Replies:** 3\ **Last updated:** [November 24, 2017, 7:46pm UTC](https://discuss.elastic.co/t/network-host-issue/109063 "2017-11-24T19:46:44Z")
when network.host: 127.0.0.1, es can be working normally. However, when i set network.host: (real ip like ) "234.233.232.0", the error will come up .... does anyone know this issue...please kindly help... logs here: \[2… --- ## [Parse date error](https://discuss.elastic.co/t/parse-date-error/107962)
**Author:** [@Luc](https://discuss.elastic.co/u/Luc)\ **Replies:** 1\ **Last updated:** [November 24, 2017, 6:01pm UTC](https://discuss.elastic.co/t/parse-date-error/107962 "2017-11-24T18:01:16Z")
Executing the query: { "query": { "bool": { "must": \[ { "match": { "foo": "pattern" } }, { "range": { "@timestamp": { "gte": "bar.start\_time", "format… --- ## [Elasticsearch 5.x goes to YELLOW state more frequently due to high GC activity](https://discuss.elastic.co/t/elasticsearch-5-x-goes-to-yellow-state-more-frequently-due-to-high-gc-activity/105339)
**Author:** [@bsarkar](https://discuss.elastic.co/u/bsarkar)\ **Replies:** 5\ **Last updated:** [November 24, 2017, 5:27pm UTC](https://discuss.elastic.co/t/elasticsearch-5-x-goes-to-yellow-state-more-frequently-due-to-high-gc-activity/105339 "2017-11-24T17:27:05Z")
We recently moved from ES 2.x to ES 5.4.1 and are seeing an increased GC activity on the data nodes. We're seeing frequent young GC happening and each cycle taking just less than a second. Due to lots of GC, data nodes a… --- ## [Trier une réponse en fonction de données dynamique](https://discuss.elastic.co/t/trier-une-reponse-en-fonction-de-donnees-dynamique/108695)
**Author:** [@Ugo\_Bourdon](https://discuss.elastic.co/u/Ugo_Bourdon)\ **Replies:** 1\ **Last updated:** [November 24, 2017, 5:12pm UTC](https://discuss.elastic.co/t/trier-une-reponse-en-fonction-de-donnees-dynamique/108695 "2017-11-24T17:12:59Z")
Bonjour, Je souhaite pouvoir trier des documents en fonction d'une donnée dynamique disponible au moment de la requête. J'ai le mapping minimum suivant : { "perf\_immo\_dev\_idxtodolist": { "mappings": { "tod… --- ## [@timestamp picked as string instead of date](https://discuss.elastic.co/t/timestamp-picked-as-string-instead-of-date/108876)
**Author:** [@gvdm90](https://discuss.elastic.co/u/gvdm90)\ **Replies:** 7\ **Last updated:** [November 24, 2017, 5:00pm UTC](https://discuss.elastic.co/t/timestamp-picked-as-string-instead-of-date/108876 "2017-11-24T17:00:30Z")
Hi all, I'm using Elasticsearch 6.0.0 and Filebeat 6.0.0 to forward and analyze some JMeter CSV test files. I configured Filebeat to send some CSV data to an Elasticsearch instance through a pipeline, defined this way … --- ## [To which elasticsearch node should logstash send to](https://discuss.elastic.co/t/to-which-elasticsearch-node-should-logstash-send-to/108909)
**Author:** [@subin](https://discuss.elastic.co/u/subin)\ **Replies:** 11\ **Last updated:** [November 24, 2017, 4:48pm UTC](https://discuss.elastic.co/t/to-which-elasticsearch-node-should-logstash-send-to/108909 "2017-11-24T16:48:52Z")
Hi all, A little background about my production test-bed before my question: Elasticsearch 6.0: 3 nodes, both data and master-eligible nodes. Each with 16G of RAM, with JVM heap set to 8G. 1 node, coordinating-only n… --- ## [How do I connect to the application when I have dedicated master nodes?](https://discuss.elastic.co/t/how-do-i-connect-to-the-application-when-i-have-dedicated-master-nodes/108932)
**Author:** [@RafaelPosthaus](https://discuss.elastic.co/u/RafaelPosthaus)\ **Replies:** 7\ **Last updated:** [November 24, 2017, 4:41pm UTC](https://discuss.elastic.co/t/how-do-i-connect-to-the-application-when-i-have-dedicated-master-nodes/108932 "2017-11-24T16:41:41Z")
I have a cluster with 4 date nodes, and 3 dedicated master nodes, I have a question, regarding the connection driver, should I pass the ips of the 3 dedicated master nodes? thank you so much. --- ## [Ingest Node Processor for cumulative count of records](https://discuss.elastic.co/t/ingest-node-processor-for-cumulative-count-of-records/108974)
**Author:** [@RohanKumbhar](https://discuss.elastic.co/u/RohanKumbhar)\ **Replies:** 4\ **Last updated:** [November 24, 2017, 2:41pm UTC](https://discuss.elastic.co/t/ingest-node-processor-for-cumulative-count-of-records/108974 "2017-11-24T14:41:15Z")
Hi Team, Is there any processor in ingest pipeline which will give me the cumulative count the records processed through the ingest node? for example there are 10 records processed by ingest node then cumulative count … --- ## [AWS Endpoint does'nt require 9200 port, and vendor files of ES adds 9200 by default](https://discuss.elastic.co/t/aws-endpoint-doesnt-require-9200-port-and-vendor-files-of-es-adds-9200-by-default/109035)
**Author:** [@rayies](https://discuss.elastic.co/u/rayies)\ **Replies:** 1\ **Last updated:** [November 24, 2017, 1:57pm UTC](https://discuss.elastic.co/t/aws-endpoint-doesnt-require-9200-port-and-vendor-files-of-es-adds-9200-by-default/109035 "2017-11-24T13:57:29Z")
AWS Endpoint of ES does'nt require 9200 port, and vendor files of ES adds 9200 by default. So my the api becomes something like aws\_endpoint:9200 which is wrong. How to resolve this problem? --- ## [cURL required but it's installed](https://discuss.elastic.co/t/curl-required-but-its-installed/109032)
**Author:** [@Sylvain\_Attoumani](https://discuss.elastic.co/u/Sylvain_Attoumani)\ **Replies:** 0\ **Last updated:** [November 24, 2017, 1:04pm UTC](https://discuss.elastic.co/t/curl-required-but-its-installed/109032 "2017-11-24T13:04:12Z")
I'm working with elasticsearch on a php project. I have a file (elastic.php) where there is : \'localhost' \]; $client = Elasticsearch\\ClientBuilder::create()-\>s… --- ## [XPACK Custom Realm with SSO integration](https://discuss.elastic.co/t/xpack-custom-realm-with-sso-integration/108185)
**Author:** [@jvemugunta](https://discuss.elastic.co/u/jvemugunta)\ **Replies:** 1\ **Last updated:** [November 24, 2017, 12:26pm UTC](https://discuss.elastic.co/t/xpack-custom-realm-with-sso-integration/108185 "2017-11-24T12:26:55Z")
We have SiteMinder at your company. After user logs through Siteminder, A SSO token called as JSON Web Token (JWT) is injected as "Authorization Bearer " and sent to the downstream application (Kibana). How to make it w… --- ## [Sort the Results by the Result of a Script](https://discuss.elastic.co/t/sort-the-results-by-the-result-of-a-script/108973)
**Author:** [@joshuabarth](https://discuss.elastic.co/u/joshuabarth)\ **Replies:** 4\ **Last updated:** [November 24, 2017, 11:54am UTC](https://discuss.elastic.co/t/sort-the-results-by-the-result-of-a-script/108973 "2017-11-24T11:54:45Z")
Hi I have a query where I have a script to calculate a number - the l2-distance between a vector. I would like to sort the output. Here is an example query: POST /my\_index/\_search { // some filter query will be here… --- ## [Performance of search requests in cluster from Kibana](https://discuss.elastic.co/t/performance-of-search-requests-in-cluster-from-kibana/108997)
**Author:** [@Evgeniy\_Ivlev](https://discuss.elastic.co/u/Evgeniy_Ivlev)\ **Replies:** 4\ **Last updated:** [November 24, 2017, 11:31am UTC](https://discuss.elastic.co/t/performance-of-search-requests-in-cluster-from-kibana/108997 "2017-11-24T11:31:18Z")
Hi! I deployed new ES cluster with following configuration: 3 master nodes (4Gb RAM per node) 2 data nodes (24Gb RAM per node), Xmx 12G 1 node for Kibana (4 Gb RAM) All nodes are virtual machines. lscpu shows follo… --- ## [Java Client vs .NET Client](https://discuss.elastic.co/t/java-client-vs-net-client/108759)
**Author:** [@kandrew](https://discuss.elastic.co/u/kandrew)\ **Replies:** 1\ **Last updated:** [November 24, 2017, 11:28am UTC](https://discuss.elastic.co/t/java-client-vs-net-client/108759 "2017-11-24T11:28:06Z")
Hi all, I need to develop a solution using elasticsearch and my customer would prefer c # code than java code. No problem, but I'm wondering if there are any major reasons why we should address our choice to Java (for … --- ## [Elasticsearch query for documenting containing OR along with AND](https://discuss.elastic.co/t/elasticsearch-query-for-documenting-containing-or-along-with-and/107555)
**Author:** [@blueren](https://discuss.elastic.co/u/blueren)\ **Replies:** 5\ **Last updated:** [November 24, 2017, 11:04am UTC](https://discuss.elastic.co/t/elasticsearch-query-for-documenting-containing-or-along-with-and/107555 "2017-11-24T11:04:14Z")
I'm new to elasticsearch and am doing a bit of query basics. I have to retrieve count of those documents that: Either contain netflow.src\_port \['10','11','12'\] OR netflow.dst\_port \['20','21','22'\] AND timestamp being wi… --- ## [X-pack Machine Learning not available for download](https://discuss.elastic.co/t/x-pack-machine-learning-not-available-for-download/108962)
**Author:** [@rijinmp](https://discuss.elastic.co/u/rijinmp)\ **Replies:** 7\ **Last updated:** [November 24, 2017, 10:27am UTC](https://discuss.elastic.co/t/x-pack-machine-learning-not-available-for-download/108962 "2017-11-24T10:27:23Z")
Hi All, I have an ELK (5.3) Stack Server and it is working well. It is dealing with OSSEC alerts. I would like to use machine learning in it. When I am going to X-Pack download page ( https://www.elastic.co/downloads… --- ## [Sending data to elasticsearch with json file using CURL, meet records number limitation](https://discuss.elastic.co/t/sending-data-to-elasticsearch-with-json-file-using-curl-meet-records-number-limitation/106789)
**Author:** [@permanz](https://discuss.elastic.co/u/permanz)\ **Replies:** 2\ **Last updated:** [November 24, 2017, 10:18am UTC](https://discuss.elastic.co/t/sending-data-to-elasticsearch-with-json-file-using-curl-meet-records-number-limitation/106789 "2017-11-24T10:18:51Z")
Hi All, I want to using json file to send data to elasticsearch with curl, but got problem with limited records number in json file. Elasticsearch version: 5.6.2, Memory: 16G, Single node with 5 shards. using: curl -X… --- ## [XenForo Search ES6.0 index doesn't work](https://discuss.elastic.co/t/xenforo-search-es6-0-index-doesnt-work/108985)
**Author:** [@pavuk](https://discuss.elastic.co/u/pavuk)\ **Replies:** 6\ **Last updated:** [November 24, 2017, 10:18am UTC](https://discuss.elastic.co/t/xenforo-search-es6-0-index-doesnt-work/108985 "2017-11-24T10:18:33Z")
Hi community! Previously I had Xenforo Elasticsearch with ElasticSearch 5.x and everything worked perfectly. Ten I have updated to Elasticsearch and Kibana to 6.0, installed X-pack, updated Xenforo Elasticsearch plugin… --- ## [Linux SUSE](https://discuss.elastic.co/t/linux-suse/108842)
**Author:** [@ssasporta](https://discuss.elastic.co/u/ssasporta)\ **Replies:** 1\ **Last updated:** [November 24, 2017, 9:37am UTC](https://discuss.elastic.co/t/linux-suse/108842 "2017-11-24T09:37:02Z")
Can Elastic run on Linux SuSE, any latest version? --- ## [Elasticsearch in docker container keeps enabling xpack even if explicitely disabled](https://discuss.elastic.co/t/elasticsearch-in-docker-container-keeps-enabling-xpack-even-if-explicitely-disabled/108465)
**Author:** [@perrohunter](https://discuss.elastic.co/u/perrohunter)\ **Replies:** 2\ **Last updated:** [November 24, 2017, 9:34am UTC](https://discuss.elastic.co/t/elasticsearch-in-docker-container-keeps-enabling-xpack-even-if-explicitely-disabled/108465 "2017-11-24T09:34:11Z")
I'm running elasticsearch for local development in a docker container and disabling xpack explicitely, yet, every x days the container locks itself because the xpack license exprires, elastic stops working I'm disabling… --- ## [Why does SearchScript call multiple times?](https://discuss.elastic.co/t/why-does-searchscript-call-multiple-times/108955)
**Author:** [@tavandung12](https://discuss.elastic.co/u/tavandung12)\ **Replies:** 3\ **Last updated:** [November 24, 2017, 9:16am UTC](https://discuss.elastic.co/t/why-does-searchscript-call-multiple-times/108955 "2017-11-24T09:16:56Z")
my source code: public Function\, SearchScript\> compile( String scriptName, String scriptSource, Map\ params) { checkScriptSource(scriptSource); logger.info("start compl… --- ## [Failed to send join request to master, discovery timed out](https://discuss.elastic.co/t/failed-to-send-join-request-to-master-discovery-timed-out/107975)
**Author:** [@anton-g](https://discuss.elastic.co/u/anton-g)\ **Replies:** 1\ **Last updated:** [November 24, 2017, 9:13am UTC](https://discuss.elastic.co/t/failed-to-send-join-request-to-master-discovery-timed-out/107975 "2017-11-24T09:13:02Z")
Hey! I'm working on setting up a cluster and have run into a problem which I hope you could help me with. The cluster is set up with 2 master nodes (master-1 and master-2) running on the same server, then a data node o… --- ## [504 gateway errors when using postings highlighter](https://discuss.elastic.co/t/504-gateway-errors-when-using-postings-highlighter/108774)
**Author:** [@imranazad](https://discuss.elastic.co/u/imranazad)\ **Replies:** 3\ **Last updated:** [November 24, 2017, 9:01am UTC](https://discuss.elastic.co/t/504-gateway-errors-when-using-postings-highlighter/108774 "2017-11-24T09:01:06Z")
Hi, When specifying a large page size of 500 and use the postings highlighter I'm getting 504 gateway errors. When I remove the highlighter from the query the query runs fine. Is it the highlighter that is the main caus… --- ## [Parsing\_exception occured when i ues es with elastalert](https://discuss.elastic.co/t/parsing-exception-occured-when-i-ues-es-with-elastalert/108982)
**Author:** [@isummersing](https://discuss.elastic.co/u/isummersing)\ **Replies:** 3\ **Last updated:** [November 24, 2017, 7:59am UTC](https://discuss.elastic.co/t/parsing-exception-occured-when-i-ues-es-with-elastalert/108982 "2017-11-24T07:59:50Z")
here is my exceptions: RequestError: TransportError(400, u'parsing\_exception', u'Unknown key for a START\_OBJECT in \[filter\].') WARNING:elasticsearch:GET http://127.0.0.1:9200/logstash-\*/\_search?\_source\_include=%40times… --- ## [ELASTICSEARCH Query plugins/clients](https://discuss.elastic.co/t/elasticsearch-query-plugins-clients/108970)
**Author:** [@Makra](https://discuss.elastic.co/u/Makra)\ **Replies:** 4\ **Last updated:** [November 24, 2017, 7:36am UTC](https://discuss.elastic.co/t/elasticsearch-query-plugins-clients/108970 "2017-11-24T07:36:06Z")
Hi I have elasticsearch index where few fields of logs/events are stored. Now i am trying to fetch the fields from the index and display them in a customized web interface. What is the best available clients or plugins … --- ## [Elasticsearch: Using Collections class method in groovy script](https://discuss.elastic.co/t/elasticsearch-using-collections-class-method-in-groovy-script/108977)
**Author:** [@snigdha1292](https://discuss.elastic.co/u/snigdha1292)\ **Replies:** 0\ **Last updated:** [November 24, 2017, 6:59am UTC](https://discuss.elastic.co/t/elasticsearch-using-collections-class-method-in-groovy-script/108977 "2017-11-24T06:59:39Z")
Hi All, I am trying to use Collections class for some processing to create an entity centric index. But when I use the methods of collections class I get the below error: Caused by: groovy.lang.MissingPropertyException… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1876) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1878)