# Elasticsearch

**URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1893

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 1894

---

## [Keep-words-tokenfilter example](https://discuss.elastic.co/t/keep-words-tokenfilter-example/107150)

<div class="topic-metadata">

**Author:** [@vnaresh666666](https://discuss.elastic.co/u/vnaresh666666)\
**Replies:** 2\
**Last updated:** [November 10, 2017, 9:51am UTC](https://discuss.elastic.co/t/keep-words-tokenfilter-example/107150 "2017-11-10T09:51:55Z")

</div>

Can some one provide me a full working example of keep-words-token filter(with a file having some keywords, only which are to be indexed). I have followed the documentation but I didn't get through it. thank you.

---

## [Elasticsearch Reindex using script](https://discuss.elastic.co/t/elasticsearch-reindex-using-script/107098)

<div class="topic-metadata">

**Author:** [@sreejithps303](https://discuss.elastic.co/u/sreejithps303)\
**Replies:** 1\
**Last updated:** [November 10, 2017, 9:47am UTC](https://discuss.elastic.co/t/elasticsearch-reindex-using-script/107098 "2017-11-10T09:47:25Z")

</div>

Hi , I want to reindex my old index by adding two new fields depends on a existing field . I have a csv like below. exisitingfeild,newfeild1,newfiled2 Can we use the reindex API's script field to parse this csv and r…

---

## [Hits dont seem to return my expected results](https://discuss.elastic.co/t/hits-dont-seem-to-return-my-expected-results/107160)

<div class="topic-metadata">

**Author:** [@bilpor](https://discuss.elastic.co/u/bilpor)\
**Replies:** 1\
**Last updated:** [November 10, 2017, 9:43am UTC](https://discuss.elastic.co/t/hits-dont-seem-to-return-my-expected-results/107160 "2017-11-10T09:43:12Z")

</div>

Hi All, Using Kibana, when I perform a search, at the start of the output window I receive the following details: "took": 70, "timed\_out": false, "\_shards": { "total": 3, "successful": 3, "skipped": 0…

---

## [ES query is a little bit slow, can anyone help have a look?](https://discuss.elastic.co/t/es-query-is-a-little-bit-slow-can-anyone-help-have-a-look/107127)

<div class="topic-metadata">

**Author:** [@493607120](https://discuss.elastic.co/u/493607120)\
**Replies:** 1\
**Last updated:** [November 10, 2017, 9:31am UTC](https://discuss.elastic.co/t/es-query-is-a-little-bit-slow-can-anyone-help-have-a-look/107127 "2017-11-10T09:31:07Z")

</div>

The messages from "get \_nodes/hot\_threads" via kibana dev tools. ::: {testdata07.tls.ad}{xWqVDOy9SpWhs9QrxWygaA}{Lj7vbnrnRHaW-MSqc62PVA}{192.168.0.127}{192.168.0.127:9300} Hot threads at 2017-11-10T04:10:45.706Z, in…

---

## [Elasticsearch shards not able to set 1](https://discuss.elastic.co/t/elasticsearch-shards-not-able-to-set-1/106979)

<div class="topic-metadata">

**Author:** [@Shekhar\_Pandey](https://discuss.elastic.co/u/Shekhar_Pandey)\
**Replies:** 5\
**Last updated:** [November 10, 2017, 9:27am UTC](https://discuss.elastic.co/t/elasticsearch-shards-not-able-to-set-1/106979 "2017-11-10T09:27:31Z")

</div>

I try to change the shards by default from 5 to 1 using settings options like this.. { "index":{ "number\_of\_shards": 1, "number\_of\_replicas": 0 }, "settings": { "analysis": { "filter": { "nG..... its' showing …

---

## [Field Collapsing](https://discuss.elastic.co/t/field-collapsing/107119)

<div class="topic-metadata">

**Author:** [@Atul\_Harsha](https://discuss.elastic.co/u/Atul_Harsha)\
**Replies:** 1\
**Last updated:** [November 10, 2017, 9:24am UTC](https://discuss.elastic.co/t/field-collapsing/107119 "2017-11-10T09:24:53Z")

</div>

Mapping: PUT /my\_index/\_mapping/blogpost { "properties": { "user": { "properties": { "name": { "type": "string", "fields": { "raw": { "type": "string"…

---

## [HighLevelRestClient vs Sniffer](https://discuss.elastic.co/t/highlevelrestclient-vs-sniffer/106215)

<div class="topic-metadata">

**Author:** [@Derrick](https://discuss.elastic.co/u/Derrick)\
**Replies:** 1\
**Last updated:** [November 10, 2017, 9:12am UTC](https://discuss.elastic.co/t/highlevelrestclient-vs-sniffer/106215 "2017-11-10T09:12:07Z")

</div>

HI Support, whether HighLevelRestClient needs to be set sniffer? like other client?

---

## [Watcher: Invalid JSON](https://discuss.elastic.co/t/watcher-invalid-json/106855)

<div class="topic-metadata">

**Author:** [@mruthyu](https://discuss.elastic.co/u/mruthyu)\
**Replies:** 4\
**Last updated:** [November 10, 2017, 9:11am UTC](https://discuss.elastic.co/t/watcher-invalid-json/106855 "2017-11-10T09:11:02Z")

</div>

I am trying to create the following watcher and seeing Invalid JSON error message and not able to create the watcher. { "trigger": { "schedule": { "interval": "200m" } }, "input": { "search": { …

---

## [Indexing children before parents - should I be worried?](https://discuss.elastic.co/t/indexing-children-before-parents-should-i-be-worried/106937)

<div class="topic-metadata">

**Author:** [@Joshua\_Stromme](https://discuss.elastic.co/u/Joshua_Stromme)\
**Replies:** 2\
**Last updated:** [November 10, 2017, 6:06am UTC](https://discuss.elastic.co/t/indexing-children-before-parents-should-i-be-worried/106937 "2017-11-10T06:06:47Z")

</div>

I'm using Elasticsearch 5.3 Will it cause any issues if a child document is indexed before its parent? I've come against a situation where its messy to guarantee that the parent already exists. If the parent doesn't ex…

---

## [WaterMark settings on Graylog Cluster](https://discuss.elastic.co/t/watermark-settings-on-graylog-cluster/107134)

<div class="topic-metadata">

**Author:** [@Saurabh\_Jaiswal](https://discuss.elastic.co/u/Saurabh_Jaiswal)\
**Replies:** 0\
**Last updated:** [November 10, 2017, 5:44am UTC](https://discuss.elastic.co/t/watermark-settings-on-graylog-cluster/107134 "2017-11-10T05:44:10Z")

</div>

Hi I tried to put in elasticsearch.yml below settings in elasticsearch node of my cluster cluster.routing.allocation.disk.threshold\_enabled: true cluster.routing.allocation.disk.watermark.low: 30gb cluster.routing.all…

---

## [Hunspell](https://discuss.elastic.co/t/hunspell/106807)

<div class="topic-metadata">

**Author:** [@Atul\_Harsha](https://discuss.elastic.co/u/Atul_Harsha)\
**Replies:** 10\
**Last updated:** [November 10, 2017, 5:26am UTC](https://discuss.elastic.co/t/hunspell/106807 "2017-11-10T05:26:36Z")

</div>

INPUT: PUT /my\_index { "settings": { "analysis": { "filter": { "en\_US": { "type": "hunspell", "language": "en\_US" } }, "analyzer": { "en\_US": { …

---

## [Attempted to send a bulk request to elasticsearch' but Elasticsearch appears to be unreachable or down!](https://discuss.elastic.co/t/attempted-to-send-a-bulk-request-to-elasticsearch-but-elasticsearch-appears-to-be-unreachable-or-down/106726)

<div class="topic-metadata">

**Author:** [@theo.ptz](https://discuss.elastic.co/u/theo.ptz)\
**Replies:** 1\
**Last updated:** [November 10, 2017, 4:01am UTC](https://discuss.elastic.co/t/attempted-to-send-a-bulk-request-to-elasticsearch-but-elasticsearch-appears-to-be-unreachable-or-down/106726 "2017-11-10T04:01:06Z")

</div>

Hi guys. I've got this error today: "Attempted to send a bulk request to elasticsearch' but Elasticsearch appears to be unreachable or down!" And i can't figure out what's wrong with my ELK cluster. ELK cluster is gr…

---

## [Lmenezes/elasticsearch-kopf plugin not recognizable with elasticsearch 5.6.4](https://discuss.elastic.co/t/lmenezes-elasticsearch-kopf-plugin-not-recognizable-with-elasticsearch-5-6-4/106953)

<div class="topic-metadata">

**Author:** [@ShivaramMysore](https://discuss.elastic.co/u/ShivaramMysore)\
**Replies:** 4\
**Last updated:** [November 10, 2017, 1:44am UTC](https://discuss.elastic.co/t/lmenezes-elasticsearch-kopf-plugin-not-recognizable-with-elasticsearch-5-6-4/106953 "2017-11-10T01:44:01Z")

</div>

Is lmenezes/elasticsearch-kopf/ plugin supported with 5.6.4 ? If not, any recommendation for alternatives? # curl -X GET 'http://localhost:9200' { "name" : "WAVImbK", "cluster\_name" : "elasticsearch…

---

## [Binary fields do not support searching es 6.0.0-rc1](https://discuss.elastic.co/t/binary-fields-do-not-support-searching-es-6-0-0-rc1/103690)

<div class="topic-metadata">

**Author:** [@Junon\_Lim](https://discuss.elastic.co/u/Junon_Lim)\
**Replies:** 6\
**Last updated:** [November 10, 2017, 12:42am UTC](https://discuss.elastic.co/t/binary-fields-do-not-support-searching-es-6-0-0-rc1/103690 "2017-11-10T00:42:53Z")

</div>

I've followed the instructions given by rjernst at the below link but I'm getting "Binary fields do not support searching" error. Index Mapping: { "testindex" : { "mappings" : { "testtype" : { "da…

---

## [Kibana blank page](https://discuss.elastic.co/t/kibana-blank-page/13580)

<div class="topic-metadata">

**Author:** [@David\_Kincaid](https://discuss.elastic.co/u/David_Kincaid)\
**Replies:** 1\
**Last updated:** [November 10, 2017, 12:14am UTC](https://discuss.elastic.co/t/kibana-blank-page/13580 "2017-11-10T00:14:23Z")

</div>

Was there a recent update to the Kibana3 Github repo that broke the pages? I'm getting a blank dashboard page (dark gray with "Your Basic Dashboard" strip on top) that I can't do anything with. -- You received…

---

## [Blank page - Kibana](https://discuss.elastic.co/t/blank-page-kibana/16858)

<div class="topic-metadata">

**Author:** [@Mohit\_Anchlia](https://discuss.elastic.co/u/Mohit_Anchlia)\
**Replies:** 1\
**Last updated:** [November 10, 2017, 12:13am UTC](https://discuss.elastic.co/t/blank-page-kibana/16858 "2017-11-10T00:13:35Z")

</div>

After installing Kibana 3 I see only a blank page with black border with heading that says "{{dashboard.current.title}}". I followed the install instructions from here https://github.com/elasticsearch/kibana Did I m…

---

## [Adding a normalizer for case-insensitive search on keyword field to an active index](https://discuss.elastic.co/t/adding-a-normalizer-for-case-insensitive-search-on-keyword-field-to-an-active-index/106725)

<div class="topic-metadata">

**Author:** [@gansvv](https://discuss.elastic.co/u/gansvv)\
**Replies:** 3\
**Last updated:** [November 9, 2017, 11:07pm UTC](https://discuss.elastic.co/t/adding-a-normalizer-for-case-insensitive-search-on-keyword-field-to-an-active-index/106725 "2017-11-09T23:07:16Z")

</div>

I have an active ES index and would like to make searches on it case-insensitive. The indexes are being created dynamically and are actively used. The fields are of "keyword" type. I saw that normalizer is the way to low…

---

## [Return \_source fields within aggregation](https://discuss.elastic.co/t/return-source-fields-within-aggregation/106697)

<div class="topic-metadata">

**Author:** [@Kornelia\_Watson](https://discuss.elastic.co/u/Kornelia_Watson)\
**Replies:** 3\
**Last updated:** [November 9, 2017, 10:47pm UTC](https://discuss.elastic.co/t/return-source-fields-within-aggregation/106697 "2017-11-09T22:47:44Z")

</div>

Hi all, In my ES indices I have an order type, which as you can guess stores various data about orders. What I need to do is create a query such that: it splits data using scripted field, and then sums up order values …

---

## [External versioning (external or external\_gte)](https://discuss.elastic.co/t/external-versioning-external-or-external-gte/106289)

<div class="topic-metadata">

**Author:** [@piotr.dela](https://discuss.elastic.co/u/piotr.dela)\
**Replies:** 1\
**Last updated:** [November 9, 2017, 9:23pm UTC](https://discuss.elastic.co/t/external-versioning-external-or-external-gte/106289 "2017-11-09T21:23:42Z")

</div>

Hi folks, I'm currently working on a project which has a "projection" storage implemented using Elasticsearch. I have a few questions about external versioning. First of all in general, in documentation it is said Bl…

---

## [How to move existing volume to ES Cloud](https://discuss.elastic.co/t/how-to-move-existing-volume-to-es-cloud/107075)

<div class="topic-metadata">

**Author:** [@suchitgupta](https://discuss.elastic.co/u/suchitgupta)\
**Replies:** 1\
**Last updated:** [November 9, 2017, 8:04pm UTC](https://discuss.elastic.co/t/how-to-move-existing-volume-to-es-cloud/107075 "2017-11-09T20:04:18Z")

</div>

We are thinking about moving from self hosted Docker ELK stack to ES cloud and have a question that how we can move our existing docker volume to ES Cloud

---

## [General Workflow to Sync Data to ElasticSearch from PostGres](https://discuss.elastic.co/t/general-workflow-to-sync-data-to-elasticsearch-from-postgres/107095)

<div class="topic-metadata">

**Author:** [@Akshay\_Deep\_Lamba](https://discuss.elastic.co/u/Akshay_Deep_Lamba)\
**Replies:** 1\
**Last updated:** [November 9, 2017, 7:37pm UTC](https://discuss.elastic.co/t/general-workflow-to-sync-data-to-elasticsearch-from-postgres/107095 "2017-11-09T19:37:43Z")

</div>

Hello I wanted to Real time or Near Real time sync Data from postgres to elastic Search... Below Are some Option I Tried Implementing :- Followed https://www.elastic.co/blog/logstash-jdbc-input-plugin Tutorial and th…

---

## [Hardware Guidelines for Coordinating Node](https://discuss.elastic.co/t/hardware-guidelines-for-coordinating-node/106760)

<div class="topic-metadata">

**Author:** [@grantcurell](https://discuss.elastic.co/u/grantcurell)\
**Replies:** 3\
**Last updated:** [November 9, 2017, 7:27pm UTC](https://discuss.elastic.co/t/hardware-guidelines-for-coordinating-node/106760 "2017-11-09T19:27:36Z")

</div>

With regards to coordinating nodes as described here: How to use a load balancer with Elasticsearch? What is the recommended resource allocation? Obviously that varies a lot dependent on a huge number of factors, but th…

---

## [Using cardinality on a field after bucketing](https://discuss.elastic.co/t/using-cardinality-on-a-field-after-bucketing/107066)

<div class="topic-metadata">

**Author:** [@jtalmi](https://discuss.elastic.co/u/jtalmi)\
**Replies:** 0\
**Last updated:** [November 9, 2017, 4:21pm UTC](https://discuss.elastic.co/t/using-cardinality-on-a-field-after-bucketing/107066 "2017-11-09T16:21:58Z")

</div>

Hi, I have an index of user events and I want to calculate the number of active users. Counting the number of users with at least 1 event in the last 30 days is easy, but I would like to count users with events on multi…

---

## [Alternative to terms lookup?](https://discuss.elastic.co/t/alternative-to-terms-lookup/107083)

<div class="topic-metadata">

**Author:** [@Olivier-L](https://discuss.elastic.co/u/Olivier-L)\
**Replies:** 0\
**Last updated:** [November 9, 2017, 6:10pm UTC](https://discuss.elastic.co/t/alternative-to-terms-lookup/107083 "2017-11-09T18:10:27Z")

</div>

Hello, We use elasticsearch 2.4.6. We have an index that contains around 33,000,000 documents. Users (customers) can search in this common/shared set of document, but some (many) of these documents are forbidden for e…

---

## [Conflict of interest between open source Elasticsearch and closed source Swifttype?](https://discuss.elastic.co/t/conflict-of-interest-between-open-source-elasticsearch-and-closed-source-swifttype/107063)

<div class="topic-metadata">

**Author:** [@softwaredoug](https://discuss.elastic.co/u/softwaredoug)\
**Replies:** 1\
**Last updated:** [November 9, 2017, 5:29pm UTC](https://discuss.elastic.co/t/conflict-of-interest-between-open-source-elasticsearch-and-closed-source-swifttype/107063 "2017-11-09T17:29:12Z")

</div>

First congrats on the acquisition! Second, I wonder how this will work in practice? Are there conflicts of interest? Could such conflicts of interest threaten the health of the Elasticsearch project? Imagine a search f…

---

## [Allow multivalued/array for all fields?](https://discuss.elastic.co/t/allow-multivalued-array-for-all-fields/107060)

<div class="topic-metadata">

**Author:** [@ghukill](https://discuss.elastic.co/u/ghukill)\
**Replies:** 1\
**Last updated:** [November 9, 2017, 4:06pm UTC](https://discuss.elastic.co/t/allow-multivalued-array-for-all-fields/107060 "2017-11-09T16:06:59Z")

</div>

I'm attempting to write a Hadoop RDD to ElasticSearch, without the luxury of seeing the fields before they are created. So far, dynamic mapping has been working well when the values for fields are singular. But, when I…

---

## [Reindex fails on array formatted geo\_point](https://discuss.elastic.co/t/reindex-fails-on-array-formatted-geo-point/107054)

<div class="topic-metadata">

**Author:** [@andrewgstreet](https://discuss.elastic.co/u/andrewgstreet)\
**Replies:** 0\
**Last updated:** [November 9, 2017, 2:26pm UTC](https://discuss.elastic.co/t/reindex-fails-on-array-formatted-geo-point/107054 "2017-11-09T14:26:11Z")

</div>

I'm trying to perform a reindex with only subtle mapping changes. One those changes doesn't apply to a field with the type of geo\_point. In the existing index, the mapping is {MapCoordinate : {"type":"geo\_point"}} In …

---

## [WebSite up down status](https://discuss.elastic.co/t/website-up-down-status/104758)

<div class="topic-metadata">

**Author:** [@RSundareswaran](https://discuss.elastic.co/u/RSundareswaran)\
**Replies:** 3\
**Last updated:** [November 9, 2017, 1:42pm UTC](https://discuss.elastic.co/t/website-up-down-status/104758 "2017-11-09T13:42:12Z")

</div>

Hi, We tried using heartbeat in polling some webservices endpoint and successful in ingesting the data to ELK. Also we got alerts when any WS goes down. We wanted to get one more alert when the WS is back and running. …

---

## [Elasticsearch index size is less than it takes on disk](https://discuss.elastic.co/t/elasticsearch-index-size-is-less-than-it-takes-on-disk/106023)

<div class="topic-metadata">

**Author:** [@Tobymaro](https://discuss.elastic.co/u/Tobymaro)\
**Replies:** 3\
**Last updated:** [November 9, 2017, 1:09pm UTC](https://discuss.elastic.co/t/elasticsearch-index-size-is-less-than-it-takes-on-disk/106023 "2017-11-09T13:09:48Z")

</div>

Hello, I noticed strange issue with disk space consumption. I checked how much space my indexes take: GET \_cat/indices/\*?v&s=store.size Than I calculated total size (ofcoure store.size) it's about 1250 GB. Then I che…

---

## [Aggregating results of an aggregation together](https://discuss.elastic.co/t/aggregating-results-of-an-aggregation-together/105810)

<div class="topic-metadata">

**Author:** [@seanziee](https://discuss.elastic.co/u/seanziee)\
**Replies:** 1\
**Last updated:** [November 9, 2017, 12:52pm UTC](https://discuss.elastic.co/t/aggregating-results-of-an-aggregation-together/105810 "2017-11-09T12:52:51Z")

</div>

I'm not sure if this is possible, but I'm currently trying to correlate errors that shoot off at the same time together. I sort by the highest amount of errorcodes that occurred together in one timestamp. GET logstash\*…

[Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1892)

[Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1894)
