# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1879 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1880 --- ## [Data saving structure best practices](https://discuss.elastic.co/t/data-saving-structure-best-practices/108827)
**Author:** [@yenos](https://discuss.elastic.co/u/yenos)\ **Replies:** 0\ **Last updated:** [November 23, 2017, 7:32am UTC](https://discuss.elastic.co/t/data-saving-structure-best-practices/108827 "2017-11-23T07:32:26Z")
HI! I want some logging for my service data. my log has like this(jus example): user-sigin , user-signup, user-actions.. So, I structured it as follows. index: servicename-user-singin-2017-11-21-signin, servicena… --- ## [CloudTrail data to ElasticSearch](https://discuss.elastic.co/t/cloudtrail-data-to-elasticsearch/106587)
**Author:** [@john.akash](https://discuss.elastic.co/u/john.akash)\ **Replies:** 1\ **Last updated:** [November 23, 2017, 7:29am UTC](https://discuss.elastic.co/t/cloudtrail-data-to-elasticsearch/106587 "2017-11-23T07:29:35Z")
Hi Team, We having nearly 20 AWS accounts and we centralised CloudTrail logs to a single management account. We have a custom build ElasticSearch (5.6) in the EC2 in the same account. Now we are trying to push all Clou… --- ## [Elasticsearch can't find Java](https://discuss.elastic.co/t/elasticsearch-cant-find-java/108821)
**Author:** [@tkzv](https://discuss.elastic.co/u/tkzv)\ **Replies:** 6\ **Last updated:** [November 23, 2017, 7:15am UTC](https://discuss.elastic.co/t/elasticsearch-cant-find-java/108821 "2017-11-23T07:15:53Z")
I tried installing Elastic Stack to a clean Windows 7 x64 and couldn't run it because it can't see Java. Both PATH and JAVA\_HOME are set. The user is an admin. Same result with and without "Run as admin" command. Same re… --- ## [ML Aggregation and Fields](https://discuss.elastic.co/t/ml-aggregation-and-fields/107474)
**Author:** [@mathurin68](https://discuss.elastic.co/u/mathurin68)\ **Replies:** 4\ **Last updated:** [November 23, 2017, 4:04am UTC](https://discuss.elastic.co/t/ml-aggregation-and-fields/107474 "2017-11-23T04:04:49Z")
I have x-pack up and running and am collecting event logs containing windows and powershell command line activities. Basically, I want to see the anomalies in command line activity. I don't care about something like th… --- ## [Working EsIntegrationTest example](https://discuss.elastic.co/t/working-esintegrationtest-example/108804)
**Author:** [@joel-costigliola](https://discuss.elastic.co/u/joel-costigliola)\ **Replies:** 2\ **Last updated:** [November 23, 2017, 3:35am UTC](https://discuss.elastic.co/t/working-esintegrationtest-example/108804 "2017-11-23T03:35:39Z")
Hi, I really struggled to get a working EsIntegrationTest but finally did it, it would have been great to have that out of the box in ES, here's what I did (it should work with maven and gradle): Hope that helps C… --- ## [How to ignore IllegalArgumentException: no mapping found for field when using suggester with elasticsearch 5.5](https://discuss.elastic.co/t/how-to-ignore-illegalargumentexception-no-mapping-found-for-field-when-using-suggester-with-elasticsearch-5-5/108811)
**Author:** [@niaomingjian](https://discuss.elastic.co/u/niaomingjian)\ **Replies:** 0\ **Last updated:** [November 23, 2017, 1:24am UTC](https://discuss.elastic.co/t/how-to-ignore-illegalargumentexception-no-mapping-found-for-field-when-using-suggester-with-elasticsearch-5-5/108811 "2017-11-23T01:24:06Z")
Post is at StackOverflow --- ## [Multi-index query and sorting by range per index](https://discuss.elastic.co/t/multi-index-query-and-sorting-by-range-per-index/108114)
**Author:** [@MaKro](https://discuss.elastic.co/u/MaKro)\ **Replies:** 1\ **Last updated:** [November 22, 2017, 10:54pm UTC](https://discuss.elastic.co/t/multi-index-query-and-sorting-by-range-per-index/108114 "2017-11-22T22:54:49Z")
Hi. I have multiple indices. I would like to execute search against them, and first of all: Group by index Sort results in the scope of the index by score. I'm wondering if the better idea is to send one query per in… --- ## [Delete the document in elasticsearch](https://discuss.elastic.co/t/delete-the-document-in-elasticsearch/108383)
**Author:** [@Jay\_Dabhi](https://discuss.elastic.co/u/Jay_Dabhi)\ **Replies:** 1\ **Last updated:** [November 22, 2017, 10:36pm UTC](https://discuss.elastic.co/t/delete-the-document-in-elasticsearch/108383 "2017-11-22T22:36:29Z")
I want to delete the document in elasticserach by timestamp and one of the custom field "cu\_hostname". I want to remove all the documents which are in the specific time stamp which have the value "cu\_hostname=abc" I ha… --- ## [Does the health endpoint returns yellow/red if there is bad or missing index?](https://discuss.elastic.co/t/does-the-health-endpoint-returns-yellow-red-if-there-is-bad-or-missing-index/108799)
**Author:** [@shabnamjahromi](https://discuss.elastic.co/u/shabnamjahromi)\ **Replies:** 0\ **Last updated:** [November 22, 2017, 9:40pm UTC](https://discuss.elastic.co/t/does-the-health-endpoint-returns-yellow-red-if-there-is-bad-or-missing-index/108799 "2017-11-22T21:40:14Z")
Hello, I have been reading about when the cluster health check returns yellow or red. We use elasticsearch in our application. One of our customers keep seeing issues with our application search e.g. the search result … --- ## [Cannot insert a geopoint](https://discuss.elastic.co/t/cannot-insert-a-geopoint/107234)
**Author:** [@Marek](https://discuss.elastic.co/u/Marek)\ **Replies:** 5\ **Last updated:** [November 22, 2017, 9:37pm UTC](https://discuss.elastic.co/t/cannot-insert-a-geopoint/107234 "2017-11-22T21:37:21Z")
I try to insert a document with body: { "user\_uuid":"234", "description":"", "category":"art", "location":{ "lat":52.582014799999996, "lon":13.4913122 }, "url":"http://172.19.0.4:9000/arbotti/r1RgVuQJMS1xRg4\_Xkz"… --- ## [Cannot execute update by script](https://discuss.elastic.co/t/cannot-execute-update-by-script/108795)
**Author:** [@Marek](https://discuss.elastic.co/u/Marek)\ **Replies:** 0\ **Last updated:** [November 22, 2017, 9:25pm UTC](https://discuss.elastic.co/t/cannot-execute-update-by-script/108795 "2017-11-22T21:25:48Z")
I am having a problem with this simple update: http://localhost:9200/post\_elastic/AV\_e3-gqARzXw\_Stq0-5/\_update { "script" : { "inline": "ctx.\_source.likes += 1", "lang": "painless" } } This lea… --- ## [How to "unicode\_escape" decode a text with painless script?](https://discuss.elastic.co/t/how-to-unicode-escape-decode-a-text-with-painless-script/108792)
**Author:** [@tumluliu](https://discuss.elastic.co/u/tumluliu)\ **Replies:** 0\ **Last updated:** [November 22, 2017, 9:22pm UTC](https://discuss.elastic.co/t/how-to-unicode-escape-decode-a-text-with-painless-script/108792 "2017-11-22T21:22:43Z")
I have messages with escaped unicode characters, e.g. {\\x22hostname\\x22:\\x22ea55b62367a9\\x22,\\x22address\\x22:\\x22172.18.0.4\\x22,\\x22components\\x22:\[{\\x22name\\x22:\\x22engine-api\\x22,\\x22version\\x22:\\x221.0.9-12\\x22},{\\x2… --- ## [Daily Snapshot script question](https://discuss.elastic.co/t/daily-snapshot-script-question/108762)
**Author:** [@nsur1](https://discuss.elastic.co/u/nsur1)\ **Replies:** 3\ **Last updated:** [November 22, 2017, 9:01pm UTC](https://discuss.elastic.co/t/daily-snapshot-script-question/108762 "2017-11-22T21:01:29Z")
I have a snapshot repository in which I would like to have backups of my daily indices. I wanted to automate this process by creating a snapshot of the previous day's index daily. My script thus far is: yesterday="$(da… --- ## [Limit "clients" to ElasticSearch](https://discuss.elastic.co/t/limit-clients-to-elasticsearch/108786)
**Author:** [@Maekee](https://discuss.elastic.co/u/Maekee)\ **Replies:** 2\ **Last updated:** [November 22, 2017, 8:31pm UTC](https://discuss.elastic.co/t/limit-clients-to-elasticsearch/108786 "2017-11-22T20:31:29Z")
Hi, Is there a way to limit who can send data to elasticsearch in elasticsearch config? I will be using Logstash and want to limit so no one else can send data to elasticsearch. Yes, the security part will partly solv… --- ## [NoClassDefFoundError exception with SearchSourceBuilder (6.0) in GWT server side](https://discuss.elastic.co/t/noclassdeffounderror-exception-with-searchsourcebuilder-6-0-in-gwt-server-side/108281)
**Author:** [@wassx](https://discuss.elastic.co/u/wassx)\ **Replies:** 6\ **Last updated:** [November 22, 2017, 8:19pm UTC](https://discuss.elastic.co/t/noclassdeffounderror-exception-with-searchsourcebuilder-6-0-in-gwt-server-side/108281 "2017-11-22T20:19:39Z")
Hi! I try to query my local elastic search instance via high level rest client with: SearchRequest searchRequest = new SearchRequest("jobs"); searchRequest.types("job"); SearchSourceBuilder ssb = new SearchSourceBuil… --- ## [Configuring-tls-docker - permission denied](https://discuss.elastic.co/t/configuring-tls-docker-permission-denied/108779)
**Author:** [@aram535](https://discuss.elastic.co/u/aram535)\ **Replies:** 0\ **Last updated:** [November 22, 2017, 6:47pm UTC](https://discuss.elastic.co/t/configuring-tls-docker-permission-denied/108779 "2017-11-22T18:47:22Z")
Hi, I'm following the instructions on https://www.elastic.co/guide/en/elasticsearch/reference/6.0/configuring-tls-docker.html docker-compose -f create-certs.yml up results in: Creating create\_certs ... Creating crea… --- ## [ES 6 SignificantTextAggregation's DeDuplicatingTokenFilter usage](https://discuss.elastic.co/t/es-6-significanttextaggregations-deduplicatingtokenfilter-usage/108754)
**Author:** [@rkrombho](https://discuss.elastic.co/u/rkrombho)\ **Replies:** 2\ **Last updated:** [November 22, 2017, 5:43pm UTC](https://discuss.elastic.co/t/es-6-significanttextaggregations-deduplicatingtokenfilter-usage/108754 "2017-11-22T17:43:01Z")
Hi, I really like the new Significant Text Aggregation in ES 6 but what I really love is the filter\_duplicate\_text parameter backed by the DuplicateByteSequenceSpotter. We have a strong interest in detecting duplicate … --- ## [Filtering out event\_data.TargetUserName ending in $](https://discuss.elastic.co/t/filtering-out-event-data-targetusername-ending-in/108750)
**Author:** [@Maekee](https://discuss.elastic.co/u/Maekee)\ **Replies:** 2\ **Last updated:** [November 22, 2017, 5:13pm UTC](https://discuss.elastic.co/t/filtering-out-event-data-targetusername-ending-in/108750 "2017-11-22T17:13:05Z")
Trying to figure out how to create a working kibana-filter to filter out where event\_data.TargetUserName ends in a dollar sign ($). For example computer accounts in AD or managed service accounts. And by filterng out i … --- ## [Clean Elasticserch backup conf](https://discuss.elastic.co/t/clean-elasticserch-backup-conf/108769)
**Author:** [@Frederico\_Ferreira](https://discuss.elastic.co/u/Frederico_Ferreira)\ **Replies:** 0\ **Last updated:** [November 22, 2017, 5:13pm UTC](https://discuss.elastic.co/t/clean-elasticserch-backup-conf/108769 "2017-11-22T17:13:03Z")
Hello everyone. I have this cluster with lots and lots of backup configuration. It is so much configuration that when a restart a node, it takes more then 5 minutes to start it. Is there a way for me to clean the backu… --- ## [Timestamp difference between different documents](https://discuss.elastic.co/t/timestamp-difference-between-different-documents/108764)
**Author:** [@Inventorix](https://discuss.elastic.co/u/Inventorix)\ **Replies:** 0\ **Last updated:** [November 22, 2017, 4:58pm UTC](https://discuss.elastic.co/t/timestamp-difference-between-different-documents/108764 "2017-11-22T16:58:55Z")
Hello, I want to calculate and visualize the difference between 2 timestamps in 2 different documents using Kibana 6.0. It would be cool to work with the time difference, e.g t\_difference \> 2s etc. Is there a possibilit… --- ## [Is that good practice to manually merge sort the search result per shards?](https://discuss.elastic.co/t/is-that-good-practice-to-manually-merge-sort-the-search-result-per-shards/108480)
**Author:** [@richardxin](https://discuss.elastic.co/u/richardxin)\ **Replies:** 9\ **Last updated:** [November 22, 2017, 4:58pm UTC](https://discuss.elastic.co/t/is-that-good-practice-to-manually-merge-sort-the-search-result-per-shards/108480 "2017-11-22T16:58:10Z")
We are having a debate internally on whether it's good practice to manually merge the search result per shards. main index has 135 shards with single replica on 90 data nodes. The biggest query we are running is "Top N… --- ## [Removal of mapping types - cluster shard limit](https://discuss.elastic.co/t/removal-of-mapping-types-cluster-shard-limit/108756)
**Author:** [@jondruse](https://discuss.elastic.co/u/jondruse)\ **Replies:** 0\ **Last updated:** [November 22, 2017, 4:34pm UTC](https://discuss.elastic.co/t/removal-of-mapping-types-cluster-shard-limit/108756 "2017-11-22T16:34:09Z")
In the docs for Removal of mapping types it's casually mentioned that a cluster has a "limit on how many primary shards a cluster can have". Here's the link: https://www.elastic.co/guide/en/elasticsearch/reference/mast… --- ## [Bulkprocess timeout](https://discuss.elastic.co/t/bulkprocess-timeout/108758)
**Author:** [@Derrick](https://discuss.elastic.co/u/Derrick)\ **Replies:** 0\ **Last updated:** [November 22, 2017, 4:35pm UTC](https://discuss.elastic.co/t/bulkprocess-timeout/108758 "2017-11-22T16:35:56Z")
HI, I have one eod job to dump over 240000 objects to ES, but I got this erro message, any idea? ERROR \[11:27:07.777\] \[I/O dispatcher 1\] b.g.d.s.t.e.e.BulkProcessorManager - Failed to execute bulk java.util.concurre… --- ## [Example is not working](https://discuss.elastic.co/t/example-is-not-working/108745)
**Author:** [@steveLuo](https://discuss.elastic.co/u/steveLuo)\ **Replies:** 2\ **Last updated:** [November 22, 2017, 4:20pm UTC](https://discuss.elastic.co/t/example-is-not-working/108745 "2017-11-22T16:20:09Z")
I got the error { "error": { "root\_cause": \[ { "type": "parsing\_exception", "reason": "no \[query\] registered for \[filtered\]", "line": 3, "col": 17 } \], "type": "parsing\_exception", "reason": "no \[query\] regis… --- ## [Update Basic License](https://discuss.elastic.co/t/update-basic-license/108731)
**Author:** [@saad](https://discuss.elastic.co/u/saad)\ **Replies:** 1\ **Last updated:** [November 22, 2017, 3:36pm UTC](https://discuss.elastic.co/t/update-basic-license/108731 "2017-11-22T15:36:53Z")
Hi, I did the basic license and download the .json file. I am trying to update the license but using the following code curl -XPUT "http://x.x.x.x:9200/\_xpack/license" -H "Content-Type: application/json" -d @license.js… --- ## [Watcher reporting basic auth not working, password not saved](https://discuss.elastic.co/t/watcher-reporting-basic-auth-not-working-password-not-saved/108597)
**Author:** [@Tommaso](https://discuss.elastic.co/u/Tommaso)\ **Replies:** 9\ **Last updated:** [November 22, 2017, 3:01pm UTC](https://discuss.elastic.co/t/watcher-reporting-basic-auth-not-working-password-not-saved/108597 "2017-11-22T15:01:53Z")
Hello, this watcher below is not working for me. Whenever I add the password field, it doesn't get saved. I thought it was only hidden, but running the watcher returns: "Watcher: \[parse\_exception\] password is a required… --- ## [How to calculate a monthly availability of my website?](https://discuss.elastic.co/t/how-to-calculate-a-monthly-availability-of-my-website/108735)
**Author:** [@OucemaBellagha](https://discuss.elastic.co/u/OucemaBellagha)\ **Replies:** 0\ **Last updated:** [November 22, 2017, 2:58pm UTC](https://discuss.elastic.co/t/how-to-calculate-a-monthly-availability-of-my-website/108735 "2017-11-22T14:58:49Z")
Greetings, I have the following index populated each 3 minutes: { "template": "web-\*", "settings": { "number\_of\_shards": 1 }, "mappings": { "web-": { "\_source": { "enabled": true }, … --- ## [Elastic stack, solr, silk stack - social media analysis question](https://discuss.elastic.co/t/elastic-stack-solr-silk-stack-social-media-analysis-question/108728)
**Author:** [@angeliczka](https://discuss.elastic.co/u/angeliczka)\ **Replies:** 0\ **Last updated:** [November 22, 2017, 2:15pm UTC](https://discuss.elastic.co/t/elastic-stack-solr-silk-stack-social-media-analysis-question/108728 "2017-11-22T14:15:33Z")
Hello In advance I apologize as I realize it is probably a very silly question but I am just plain confused and very new to the subject. I am trying to do some research comparing elastic stack, solr, and other platform… --- ## [Unbalanced primary shards affects index performance?](https://discuss.elastic.co/t/unbalanced-primary-shards-affects-index-performance/105489)
**Author:** [@drs](https://discuss.elastic.co/u/drs)\ **Replies:** 9\ **Last updated:** [November 22, 2017, 1:45pm UTC](https://discuss.elastic.co/t/unbalanced-primary-shards-affects-index-performance/105489 "2017-11-22T13:45:09Z")
In a previous discussion there's a claim that we shouldn't worry about balancing primary shards across all nodes because primaries and replicas do almost the same amount of work during indexing. Currently my primaries a… --- ## [Creating/Restoring snapshot from one cluster to another](https://discuss.elastic.co/t/creating-restoring-snapshot-from-one-cluster-to-another/108570)
**Author:** [@ParitoshBh](https://discuss.elastic.co/u/ParitoshBh)\ **Replies:** 2\ **Last updated:** [November 22, 2017, 1:43pm UTC](https://discuss.elastic.co/t/creating-restoring-snapshot-from-one-cluster-to-another/108570 "2017-11-22T13:43:21Z")
I have 2 clusters, Cluster A with 2 nodes (Node A1 -\> Master+Data, Node A2 -\> Data) - Acts as development environment Cluster B with 1 node (Node B1 -\> Master+Data) - Acts as live environment With this setup, I am try… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1878) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1880)