# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1880 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1881 --- ## [What should be the value of max\_gram and min\_gram in Elastic search](https://discuss.elastic.co/t/what-should-be-the-value-of-max-gram-and-min-gram-in-elastic-search/108717)
**Author:** [@aniketkk](https://discuss.elastic.co/u/aniketkk)\ **Replies:** 0\ **Last updated:** [November 22, 2017, 1:18pm UTC](https://discuss.elastic.co/t/what-should-be-the-value-of-max-gram-and-min-gram-in-elastic-search/108717 "2017-11-22T13:18:22Z")
Hello, I have a question regarding ngram configurations. Elastic search documentation says It usually makes sense to set min\_gram and max\_gram to the same value. Perhaps, too much of difference between min and max gr… --- ## [Partially matched shorter field takes precedence over completely matched larger field](https://discuss.elastic.co/t/partially-matched-shorter-field-takes-precedence-over-completely-matched-larger-field/108523)
**Author:** [@aniketkk](https://discuss.elastic.co/u/aniketkk)\ **Replies:** 6\ **Last updated:** [November 22, 2017, 1:15pm UTC](https://discuss.elastic.co/t/partially-matched-shorter-field-takes-precedence-over-completely-matched-larger-field/108523 "2017-11-22T13:15:35Z")
Hi, I have two fields in my index on which I am querying. One is the title and another is content. Content is a big field and contains entire content of an article. Both fields have the same analyzer with min\_gram as 3… --- ## [Repository hdfs in 5.x is throwing AbstractFileSystem exception](https://discuss.elastic.co/t/repository-hdfs-in-5-x-is-throwing-abstractfilesystem-exception/108710)
**Author:** [@fhalde](https://discuss.elastic.co/u/fhalde)\ **Replies:** 0\ **Last updated:** [November 22, 2017, 12:11pm UTC](https://discuss.elastic.co/t/repository-hdfs-in-5-x-is-throwing-abstractfilesystem-exception/108710 "2017-11-22T12:11:03Z")
i tried installing repository-hdfs-5.6.3 on my elasticsearch-5.6.3 setup when i tried creating a repository, i faced the following error {"error":{"root\_cause":\[{"type":"repository\_exception","reason":"\[fpti\] failed to… --- ## [Multiline pattern for filebeat to parse logs in logstash](https://discuss.elastic.co/t/multiline-pattern-for-filebeat-to-parse-logs-in-logstash/108703)
**Author:** [@NagaRamesh](https://discuss.elastic.co/u/NagaRamesh)\ **Replies:** 0\ **Last updated:** [November 22, 2017, 11:49am UTC](https://discuss.elastic.co/t/multiline-pattern-for-filebeat-to-parse-logs-in-logstash/108703 "2017-11-22T11:49:45Z")
Logfile: 2017/11/21 04:40:05 \[info\] \[application\] free User upgrade to Premium Report Generation Ends.Today Date ::2017-11-21 04:40:05 2017/11/21 03:55:02 \[info\] \[application\] Upgrade to premium - Input data from dashb… --- ## [Migrating from elastic 5.x to 6.0.0 with elastalert](https://discuss.elastic.co/t/migrating-from-elastic-5-x-to-6-0-0-with-elastalert/108702)
**Author:** [@Christian\_H](https://discuss.elastic.co/u/Christian_H)\ **Replies:** 0\ **Last updated:** [November 22, 2017, 11:45am UTC](https://discuss.elastic.co/t/migrating-from-elastic-5-x-to-6-0-0-with-elastalert/108702 "2017-11-22T11:45:53Z")
Hello, I want to migrate from ELK stack 5.4.3 (and 5.6.4) to 6.0.0 and keep on using elastalert. There is a pull request which should make this possbile. However, I need to keep the old elastalert index from the 5.x v… --- ## [Terms Aggregation With Script Field](https://discuss.elastic.co/t/terms-aggregation-with-script-field/108584)
**Author:** [@harshanarayana](https://discuss.elastic.co/u/harshanarayana)\ **Replies:** 2\ **Last updated:** [November 22, 2017, 11:21am UTC](https://discuss.elastic.co/t/terms-aggregation-with-script-field/108584 "2017-11-22T11:21:45Z")
Hi, I'm using Elasticsearch JAVA DSL library with Version 5.6 I am trying to create an Elasticsearch Query that is similar to the one mentioned below. { "aggs": { "aggName": { "terms": { … --- ## [Real time multi metric job analysis](https://discuss.elastic.co/t/real-time-multi-metric-job-analysis/107873)
**Author:** [@anomalyml](https://discuss.elastic.co/u/anomalyml)\ **Replies:** 4\ **Last updated:** [November 22, 2017, 10:49am UTC](https://discuss.elastic.co/t/real-time-multi-metric-job-analysis/107873 "2017-11-22T10:49:24Z")
Hi, Could anyone explain in detail what the "Interval" option is for in creating a watch for real-time job? \[Pic\_1\] The explanation provided in the documents are not elaborative and therefore any help would be appreci… --- ## [Watcher auto acknowledgment, throttle\_period reset](https://discuss.elastic.co/t/watcher-auto-acknowledgment-throttle-period-reset/107915)
**Author:** [@Sergey\_Urushkin](https://discuss.elastic.co/u/Sergey_Urushkin)\ **Replies:** 4\ **Last updated:** [November 22, 2017, 10:39am UTC](https://discuss.elastic.co/t/watcher-auto-acknowledgment-throttle-period-reset/107915 "2017-11-22T10:39:50Z")
This has been discussed earlier. In my case I need oneshot messages for PROBLEM (hits \< N) and OK (hist =\>N). Throttling with large time period will not help in this situation, since condition=false doesn't reset thro… --- ## [Nodes fail to add up and create a cluster](https://discuss.elastic.co/t/nodes-fail-to-add-up-and-create-a-cluster/108675)
**Author:** [@Junaid03](https://discuss.elastic.co/u/Junaid03)\ **Replies:** 2\ **Last updated:** [November 22, 2017, 10:13am UTC](https://discuss.elastic.co/t/nodes-fail-to-add-up-and-create-a-cluster/108675 "2017-11-22T10:13:16Z")
Hi, I setup a cluster with 3 master nodes and 5 data nodes plus a coordinating node which connects with Kibana over localhost. Now I installed xpack on every node (Including the coordinating node) and restarted the enti… --- ## [Search in substring](https://discuss.elastic.co/t/search-in-substring/107917)
**Author:** [@aneesh](https://discuss.elastic.co/u/aneesh)\ **Replies:** 3\ **Last updated:** [November 22, 2017, 10:07am UTC](https://discuss.elastic.co/t/search-in-substring/107917 "2017-11-22T10:07:55Z")
aaaghh defagee ccacc aaa agh ddgdd rarrgrr bbbaghjj I have these values in Name column. I need to get only strings contains "ag". How can I implement it in elasticsearch? GET /student/\_search { … --- ## [Best way to copy very large index](https://discuss.elastic.co/t/best-way-to-copy-very-large-index/108685)
**Author:** [@annaK](https://discuss.elastic.co/u/annaK)\ **Replies:** 6\ **Last updated:** [November 22, 2017, 10:02am UTC](https://discuss.elastic.co/t/best-way-to-copy-very-large-index/108685 "2017-11-22T10:02:15Z")
Hi all, just a short question regarding copying a very large index. The index has ca. 400,000,000 to 500,000,000 documents. I tried it via \_reindex but here it took 30 minutes for 4,000,000 documents. Are there any m… --- ## [Return Object\[\] to Client](https://discuss.elastic.co/t/return-object-to-client/108679)
**Author:** [@Sulaiman\_Aryeetey](https://discuss.elastic.co/u/Sulaiman_Aryeetey)\ **Replies:** 0\ **Last updated:** [November 22, 2017, 9:15am UTC](https://discuss.elastic.co/t/return-object-to-client/108679 "2017-11-22T09:15:19Z")
I am using the search\_after feature of ElasticSearch to send get some results. I want to send the Object\[\] of sortValues to the client so it can be used for the next page query. I am using Java client api. I wants thin… --- ## [\_delete\_by\_query returns "Gateway Timeout"](https://discuss.elastic.co/t/delete-by-query-returns-gateway-timeout/108648)
**Author:** [@sanditech](https://discuss.elastic.co/u/sanditech)\ **Replies:** 2\ **Last updated:** [November 22, 2017, 8:49am UTC](https://discuss.elastic.co/t/delete-by-query-returns-gateway-timeout/108648 "2017-11-22T08:49:36Z")
Hi, I am sending my logs to elasticsearch (v5.6) and want to discard logs that are older than 'x' days. I tried to run \_delete\_by\_query to achieve so. There is Kibana (v5.6.1) interface through which I access the data… --- ## [Document count mismatch in shards](https://discuss.elastic.co/t/document-count-mismatch-in-shards/108640)
**Author:** [@Balamurali](https://discuss.elastic.co/u/Balamurali)\ **Replies:** 4\ **Last updated:** [November 22, 2017, 8:08am UTC](https://discuss.elastic.co/t/document-count-mismatch-in-shards/108640 "2017-11-22T08:08:26Z")
HI team, We are often facing doc\_count mismatch between primary and replica shards, Is there any solution for this ? FYI, we are using elasticsearch 1.3.7 and now working hardly for upgradation. Please suggest us and… --- ## [Is there any way to keep indices older than some days in one cluster and other indices in another cluster?](https://discuss.elastic.co/t/is-there-any-way-to-keep-indices-older-than-some-days-in-one-cluster-and-other-indices-in-another-cluster/108551)
**Author:** [@elasticheart](https://discuss.elastic.co/u/elasticheart)\ **Replies:** 6\ **Last updated:** [November 22, 2017, 8:00am UTC](https://discuss.elastic.co/t/is-there-any-way-to-keep-indices-older-than-some-days-in-one-cluster-and-other-indices-in-another-cluster/108551 "2017-11-22T08:00:43Z")
Hi, I have an ES architecture like below; \[arch\] I have named my indices based on day, like myindexa-2017-11-08, myindexa-2017-11-09, myindexb-2017-11-08, myindexb-2017-11-09 etc. I would like to keep indices older th… --- ## [I can't use setSource(String) this method with ES 5.6](https://discuss.elastic.co/t/i-cant-use-setsource-string-this-method-with-es-5-6/106996)
**Author:** [@GygesM](https://discuss.elastic.co/u/GygesM)\ **Replies:** 2\ **Last updated:** [November 22, 2017, 7:36am UTC](https://discuss.elastic.co/t/i-cant-use-setsource-string-this-method-with-es-5-6/106996 "2017-11-22T07:36:40Z")
Hi when i upgrade my ES from 1.7 to ES 5.6, i can't use this setSource(String) method anymore, please tell me . what kind of method i can use it in order to make my service alive again. thanx . \[image\] this is a ol… --- ## [ES6.X , in IntelliJ IDEA ,from source unable start](https://discuss.elastic.co/t/es6-x-in-intellij-idea-from-source-unable-start/108544)
**Author:** [@sshling](https://discuss.elastic.co/u/sshling)\ **Replies:** 6\ **Last updated:** [November 22, 2017, 7:25am UTC](https://discuss.elastic.co/t/es6-x-in-intellij-idea-from-source-unable-start/108544 "2017-11-22T07:25:37Z")
conf: Main class : org.elasticsearch.bootstrap.Elasticsearch VM options : -Xms1g -Xmx1g -Dlog4j.shutdownHookEnabled=false -Dlog4j2.disable.jmx=true -Des.path.home=/home/sl/02workspace/open/elasticsearch/core -De… --- ## [Events are not indexing after upgradtion 5.6 to 6.0](https://discuss.elastic.co/t/events-are-not-indexing-after-upgradtion-5-6-to-6-0/108337)
**Author:** [@sumeshms](https://discuss.elastic.co/u/sumeshms)\ **Replies:** 17\ **Last updated:** [November 22, 2017, 7:15am UTC](https://discuss.elastic.co/t/events-are-not-indexing-after-upgradtion-5-6-to-6-0/108337 "2017-11-22T07:15:54Z")
Hello I have upgraded elastic 5.6 to 6.0 and after that events are not indexing from any sources. The below is a strip from logstash log. I have tried with and without index mapping. Where can I find the updated ind… --- ## [Error since upgrade from 2.4.1 -\> 5.6.4](https://discuss.elastic.co/t/error-since-upgrade-from-2-4-1-5-6-4/108627)
**Author:** [@Jerry\_Hoffmeister](https://discuss.elastic.co/u/Jerry_Hoffmeister)\ **Replies:** 6\ **Last updated:** [November 22, 2017, 6:10am UTC](https://discuss.elastic.co/t/error-since-upgrade-from-2-4-1-5-6-4/108627 "2017-11-22T06:10:43Z")
I recently upgraded from 2.4.1 to 5.6.4 (on my way to 6.0 eventually...) and I'm seeing the following error every 10 seconds in the elasticsearch log when I have any of the monitoring tabs open in kibana. If I switch to… --- ## [Elastic mapping not working](https://discuss.elastic.co/t/elastic-mapping-not-working/108513)
**Author:** [@Shekhar\_Pandey](https://discuss.elastic.co/u/Shekhar_Pandey)\ **Replies:** 3\ **Last updated:** [November 22, 2017, 4:54am UTC](https://discuss.elastic.co/t/elastic-mapping-not-working/108513 "2017-11-22T04:54:28Z")
I have one mapping which details are given below: PUT my\_index { "mappings": { "product": { "properties": { "search\_data": { "type": "nested", "properties":{ "string\_f… --- ## [Bulk insertion is too slow using php](https://discuss.elastic.co/t/bulk-insertion-is-too-slow-using-php/108547)
**Author:** [@shemilr](https://discuss.elastic.co/u/shemilr)\ **Replies:** 6\ **Last updated:** [November 22, 2017, 5:09am UTC](https://discuss.elastic.co/t/bulk-insertion-is-too-slow-using-php/108547 "2017-11-22T05:09:18Z")
Hi, I am creating the index using bulk insertion and mapping created before inserting the data. I have more than 20 lakhs of data with in one index and one type. After inserting the 2 of 3 lakhs of data bulk insertion b… --- ## [org.elasticsearch.discovery.MasterNotDiscoveredException: nul](https://discuss.elastic.co/t/org-elasticsearch-discovery-masternotdiscoveredexception-nul/108317)
**Author:** [@manikesh](https://discuss.elastic.co/u/manikesh)\ **Replies:** 7\ **Last updated:** [November 22, 2017, 4:33am UTC](https://discuss.elastic.co/t/org-elasticsearch-discovery-masternotdiscoveredexception-nul/108317 "2017-11-22T04:33:04Z")
Everything was working fine until I restarted my cluster this weekend, post that same error is keep on coming no matter what I am doing.. First this issue came in prod and then UAT. not sure what is going on My cluster… --- ## [How to calculate the overlap / elapsed time range in elasticsearch?](https://discuss.elastic.co/t/how-to-calculate-the-overlap-elapsed-time-range-in-elasticsearch/108301)
**Author:** [@betimer](https://discuss.elastic.co/u/betimer)\ **Replies:** 3\ **Last updated:** [November 22, 2017, 2:58am UTC](https://discuss.elastic.co/t/how-to-calculate-the-overlap-elapsed-time-range-in-elasticsearch/108301 "2017-11-22T02:58:34Z")
Hi, I have around million records in ES, they are different online meeting records that people join/leave at the different time. {name:"p1", join:'2017-11-17T00:01:00.293Z', leave: "2017-11-17T00:06:00.293Z"} {name:"p2… --- ## [Elasticsearch 6 official Docker image won't boot with memory\_lock](https://discuss.elastic.co/t/elasticsearch-6-official-docker-image-wont-boot-with-memory-lock/108631)
**Author:** [@xrl](https://discuss.elastic.co/u/xrl)\ **Replies:** 0\ **Last updated:** [November 22, 2017, 1:29am UTC](https://discuss.elastic.co/t/elasticsearch-6-official-docker-image-wont-boot-with-memory-lock/108631 "2017-11-22T01:29:23Z")
Docker image: docker.elastic.co/elasticsearch/elasticsearch:6.0.0 Operating system: (docker info and docker inspect of a running container) https://gist.github.com/xrl/0f84c5f44d201b518ae52baafc00a513 My kubernetes sta… --- ## [Sorting by distance with minimum distance](https://discuss.elastic.co/t/sorting-by-distance-with-minimum-distance/104632)
**Author:** [@lukas-gitl](https://discuss.elastic.co/u/lukas-gitl)\ **Replies:** 5\ **Last updated:** [November 22, 2017, 12:45am UTC](https://discuss.elastic.co/t/sorting-by-distance-with-minimum-distance/104632 "2017-11-22T00:45:58Z")
I'm trying to sort results by distance. Something like this works perfectly: \_geo\_distance: { "nested\_path": ..., "location": \[..., ...\], "order": "asc", "unit": "m", "mode": "min", "distance\_type": "sloppy\_… --- ## [Watermark Settings in the yml file](https://discuss.elastic.co/t/watermark-settings-in-the-yml-file/108611)
**Author:** [@sleepyj222](https://discuss.elastic.co/u/sleepyj222)\ **Replies:** 0\ **Last updated:** [November 21, 2017, 7:50pm UTC](https://discuss.elastic.co/t/watermark-settings-in-the-yml-file/108611 "2017-11-21T19:50:38Z")
I've changed the watermark settings in the persistent settings by the API successfully, but I'd also like to change them in the elasticsearch.yml configuration file. The links referenced in the files get me 404s, but th… --- ## [How to free node memory in elasticseacrh](https://discuss.elastic.co/t/how-to-free-node-memory-in-elasticseacrh/108610)
**Author:** [@arun\_s](https://discuss.elastic.co/u/arun_s)\ **Replies:** 0\ **Last updated:** [November 21, 2017, 7:48pm UTC](https://discuss.elastic.co/t/how-to-free-node-memory-in-elasticseacrh/108610 "2017-11-21T19:48:50Z")
i am getting into low disk space error and always my instance is in yellow using the command curl -s 'localhost:9200/\_cat/allocation?v' i am getting folllowing shards disk.indices disk.used disk.avail disk.total disk.p… --- ## [Elasticsearch Won't Start After Upgrading from 5.5 to 6.0](https://discuss.elastic.co/t/elasticsearch-wont-start-after-upgrading-from-5-5-to-6-0/108167)
**Author:** [@megadevx](https://discuss.elastic.co/u/megadevx)\ **Replies:** 14\ **Last updated:** [November 21, 2017, 7:15pm UTC](https://discuss.elastic.co/t/elasticsearch-wont-start-after-upgrading-from-5-5-to-6-0/108167 "2017-11-21T19:15:45Z")
We have been unable to get Elasticsearch to start back up after upgrading following this guide: https://www.elastic.co/guide/en/elasticsearch/reference/current/restart-upgrade.html Elasticsearchhas this status : elasti… --- ## [Dates in epoch.milliseconds and ingest node](https://discuss.elastic.co/t/dates-in-epoch-milliseconds-and-ingest-node/60124)
**Author:** [@Larry\_Schrader](https://discuss.elastic.co/u/Larry_Schrader)\ **Replies:** 6\ **Last updated:** [June 23, 2017, 1:47am UTC](https://discuss.elastic.co/t/dates-in-epoch-milliseconds-and-ingest-node/60124 "2017-06-23T01:47:46Z")
I am using 5.0 alpha5 with an ingest node and I am trying to get a timestamp field that is in epoch.milliseconds (ie. 1473371994.193595) to be formatted as a time field. The field is processed without errors if I allow … --- ## [Netty inbound and outbound traffic Logs](https://discuss.elastic.co/t/netty-inbound-and-outbound-traffic-logs/108606)
**Author:** [@Luckyj13](https://discuss.elastic.co/u/Luckyj13)\ **Replies:** 0\ **Last updated:** [November 21, 2017, 6:36pm UTC](https://discuss.elastic.co/t/netty-inbound-and-outbound-traffic-logs/108606 "2017-11-21T18:36:21Z")
Is there a way to configure Netty to drop a log file that contains the inbound and outbound traffic? Thanks [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1879) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1881)