# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1897 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1898 --- ## [I am trying to retrieve the "message" field from my logs for level "ERROR"](https://discuss.elastic.co/t/i-am-trying-to-retrieve-the-message-field-from-my-logs-for-level-error/105179)
**Author:** [@Indiresh\_Ds](https://discuss.elastic.co/u/Indiresh_Ds)\ **Replies:** 6\ **Last updated:** [November 7, 2017, 11:29am UTC](https://discuss.elastic.co/t/i-am-trying-to-retrieve-the-message-field-from-my-logs-for-level-error/105179 "2017-11-07T11:29:34Z")
Hi there, I am very new to ELK. My apologies if my doubt seems blunt. I have several different errors in my logs. I am trying to get the "message" alone of each of these errors as an alert to my mailbox. I tried using… --- ## [Get documents matching type 1 and not in type 2](https://discuss.elastic.co/t/get-documents-matching-type-1-and-not-in-type-2/102979)
**Author:** [@jaisharma](https://discuss.elastic.co/u/jaisharma)\ **Replies:** 6\ **Last updated:** [November 7, 2017, 10:39am UTC](https://discuss.elastic.co/t/get-documents-matching-type-1-and-not-in-type-2/102979 "2017-11-07T10:39:36Z")
I've an index structure where types are dates and each type has several documents. I want to get all documents present in type-1 but must be absent in type-2. As an example: Type-1 ---\> id list = \[1,2,3,4,5,6\] Type-2 --… --- ## [ES Cluster : NoNodeAvailableException\[None of the configured nodes are available](https://discuss.elastic.co/t/es-cluster-nonodeavailableexception-none-of-the-configured-nodes-are-available/106663)
**Author:** [@mahesh.maney](https://discuss.elastic.co/u/mahesh.maney)\ **Replies:** 1\ **Last updated:** [November 7, 2017, 10:22am UTC](https://discuss.elastic.co/t/es-cluster-nonodeavailableexception-none-of-the-configured-nodes-are-available/106663 "2017-11-07T10:22:41Z")
Hello All Problem Resolvers, We have 3 nodes for elasticsearch 5.5.1. Lets say N1,N2 and N3. All three nodes have been made master node. Each of this node is running on single VM. Lets say V1, V2 and V3. So; N1 (Elas… --- ## [Error indexing in elasticsearch due to indexing failure, id: 9, error: Limit of total fields \[1000\]](https://discuss.elastic.co/t/error-indexing-in-elasticsearch-due-to-indexing-failure-id-9-error-limit-of-total-fields-1000/106570)
**Author:** [@hugomarcelino](https://discuss.elastic.co/u/hugomarcelino)\ **Replies:** 2\ **Last updated:** [November 7, 2017, 10:18am UTC](https://discuss.elastic.co/t/error-indexing-in-elasticsearch-due-to-indexing-failure-id-9-error-limit-of-total-fields-1000/106570 "2017-11-07T10:18:34Z")
Hi, So I've started having the following error in elasticsearch. "Elasticsearch indexing failure, id: 9, error: Limit of total fields \[1000\] in index \[metrics-2017.11.06\] has been exceeded". My first approach was to ha… --- ## [Help with ESIntegTestCase](https://discuss.elastic.co/t/help-with-esintegtestcase/105245)
**Author:** [@varundbest](https://discuss.elastic.co/u/varundbest)\ **Replies:** 6\ **Last updated:** [November 7, 2017, 9:58am UTC](https://discuss.elastic.co/t/help-with-esintegtestcase/105245 "2017-11-07T09:58:06Z")
So I have Developed a Security plugin and wish to test it using a cluster started via ESIntegTestCase. But whenever I call "getRestClient()" from within my class, I get :- Throwable #1: java.lang.IllegalArgumentExcepti… --- ## [Bulk Import to Elasticsearch](https://discuss.elastic.co/t/bulk-import-to-elasticsearch/106644)
**Author:** [@Biraj\_Dhungel](https://discuss.elastic.co/u/Biraj_Dhungel)\ **Replies:** 5\ **Last updated:** [November 7, 2017, 9:35am UTC](https://discuss.elastic.co/t/bulk-import-to-elasticsearch/106644 "2017-11-07T09:35:14Z")
Hello, I have a JSON file of 1 GB Logdata. The format of the file is { "index" : { "\_index" : "test", "\_type" : "type1" } } { "field1" : "value1" } { "index" : { "\_index" : "test", "\_type" : "type1" } } { "field1" :… --- ## [Memlock check is incorrect in v2.3.1](https://discuss.elastic.co/t/memlock-check-is-incorrect-in-v2-3-1/106652)
**Author:** [@ndtreviv](https://discuss.elastic.co/u/ndtreviv)\ **Replies:** 0\ **Last updated:** [November 7, 2017, 9:03am UTC](https://discuss.elastic.co/t/memlock-check-is-incorrect-in-v2-3-1/106652 "2017-11-07T09:03:56Z")
I'm still getting this in the startup logs: \[2017-11-06 20:47:12,764\]\[WARN \]\[bootstrap \] Unable to lock JVM Memory: error=12,reason=Cannot allocate memory \[2017-11-06 20:47:12,765\]\[WARN \]\[bootstrap … --- ## [How to configure elasticsearch 2.4.0 in rails (gem file and how to cofigure)](https://discuss.elastic.co/t/how-to-configure-elasticsearch-2-4-0-in-rails-gem-file-and-how-to-cofigure/106648)
**Author:** [@anandkanabar](https://discuss.elastic.co/u/anandkanabar)\ **Replies:** 0\ **Last updated:** [November 7, 2017, 8:56am UTC](https://discuss.elastic.co/t/how-to-configure-elasticsearch-2-4-0-in-rails-gem-file-and-how-to-cofigure/106648 "2017-11-07T08:56:04Z")
I am new in ruby on rails need to configure elasticsearch past (previos) vesion of 2.4.0 please help me what to write in gem file and how to configure with rail 4.2.4. I have successfully install elasticsearch 2.4.0 as … --- ## [Watcher: Conditional in Actions block?](https://discuss.elastic.co/t/watcher-conditional-in-actions-block/106569)
**Author:** [@rozling](https://discuss.elastic.co/u/rozling)\ **Replies:** 2\ **Last updated:** [November 7, 2017, 8:54am UTC](https://discuss.elastic.co/t/watcher-conditional-in-actions-block/106569 "2017-11-07T08:54:24Z")
I'm sure I've seen this functionality in an example somewhere recently (maybe X-Pack examples?) but I can't seem to find it: Is it possible to place a simple conditional in the Actions block, something like if(business… --- ## [Elasticsearch give me parsing error : 400](https://discuss.elastic.co/t/elasticsearch-give-me-parsing-error-400/106455)
**Author:** [@anandkanabar](https://discuss.elastic.co/u/anandkanabar)\ **Replies:** 3\ **Last updated:** [November 7, 2017, 8:11am UTC](https://discuss.elastic.co/t/elasticsearch-give-me-parsing-error-400/106455 "2017-11-07T08:11:02Z")
{ "error": "\[400\] {"error":{"root\_cause":\[{"type":"parsing\_exception","reason":"no \[query\] registered for \[filtered\]","line":1,"col":35}\],"type":"parsing\_exception","reason":"no \[query\] registered for \[filtered\]","line"… --- ## [Transform Logs in Elasticsearch](https://discuss.elastic.co/t/transform-logs-in-elasticsearch/106639)
**Author:** [@McElroy](https://discuss.elastic.co/u/McElroy)\ **Replies:** 1\ **Last updated:** [November 7, 2017, 8:04am UTC](https://discuss.elastic.co/t/transform-logs-in-elasticsearch/106639 "2017-11-07T08:04:19Z")
Hi, We have the problem that we changed our filebeat to write directly into elasticsearch and our logs aren't split in specific fields anymore. Do I have to write my logs into elasticsearch with logstash to split them i… --- ## [Bulk index and Aliases creation](https://discuss.elastic.co/t/bulk-index-and-aliases-creation/106615)
**Author:** [@nkdev89](https://discuss.elastic.co/u/nkdev89)\ **Replies:** 3\ **Last updated:** [November 7, 2017, 7:02am UTC](https://discuss.elastic.co/t/bulk-index-and-aliases-creation/106615 "2017-11-07T07:02:38Z")
HI , I have a requirement of creating multiple indices and aliases for the same. Is there any way i can create multiple indices and multiple aliases in one request . I'm new to ES and I'm using NEST. Thanks Naveen --- ## [X-pack Expire](https://discuss.elastic.co/t/x-pack-expire/106616)
**Author:** [@Krunal\_kalaria](https://discuss.elastic.co/u/Krunal_kalaria)\ **Replies:** 2\ **Last updated:** [November 7, 2017, 6:23am UTC](https://discuss.elastic.co/t/x-pack-expire/106616 "2017-11-07T06:23:09Z")
Hello, i have a 3 nodes cluster in this i upgrade the version of ELK 5.5.2 to 5.6.3 and i have licence of x-pack that i was used in ELK 5.5.2 version now i remove the x-pack from the ELK and reinstall it and its giving … --- ## [Elasticsearch Nested Objects with inner array of objects mapping performance?](https://discuss.elastic.co/t/elasticsearch-nested-objects-with-inner-array-of-objects-mapping-performance/106628)
**Author:** [@mstgrlk](https://discuss.elastic.co/u/mstgrlk)\ **Replies:** 0\ **Last updated:** [November 7, 2017, 5:57am UTC](https://discuss.elastic.co/t/elasticsearch-nested-objects-with-inner-array-of-objects-mapping-performance/106628 "2017-11-07T05:57:24Z")
Hi, I am new to elastichsearch and I want to solve my full text search problem with it. I have performance concerns about nested objects. Here is my case: I want to generate a mapping with nested objects which contain… --- ## [Dedicated X-Pack Monitoring Cluster Questions](https://discuss.elastic.co/t/dedicated-x-pack-monitoring-cluster-questions/106606)
**Author:** [@ritchierich](https://discuss.elastic.co/u/ritchierich)\ **Replies:** 3\ **Last updated:** [November 7, 2017, 5:18am UTC](https://discuss.elastic.co/t/dedicated-x-pack-monitoring-cluster-questions/106606 "2017-11-07T05:18:38Z")
What's the compatibility of X-Pack versions? I want to split my X-Pack Basic monitoring from my production ES 5.4.x Cluster. If I spin up a dedicated X-Pack Monitoring Cluster as version ES 5.6. Can the ES 5.4 Cluste… --- ## [Elastic Mapping](https://discuss.elastic.co/t/elastic-mapping/106469)
**Author:** [@Shekhar\_Pandey](https://discuss.elastic.co/u/Shekhar_Pandey)\ **Replies:** 3\ **Last updated:** [November 7, 2017, 4:42am UTC](https://discuss.elastic.co/t/elastic-mapping/106469 "2017-11-07T04:42:51Z")
I saw one article where they are doing mapping directly dynamic after create two mapping which are given below: My question is how elastic automatically predict it will goes to keword\_facet or long\_facet....Means we hav… --- ## [Variation in data read by machine learning module to the actual data present in CSV file](https://discuss.elastic.co/t/variation-in-data-read-by-machine-learning-module-to-the-actual-data-present-in-csv-file/105704)
**Author:** [@anomalyml](https://discuss.elastic.co/u/anomalyml)\ **Replies:** 19\ **Last updated:** [November 7, 2017, 4:08am UTC](https://discuss.elastic.co/t/variation-in-data-read-by-machine-learning-module-to-the-actual-data-present-in-csv-file/105704 "2017-11-07T04:08:13Z")
Hi, I was creating a multi metric job for a sample data with two metrics using the machine learning module. I have inserted anomalies manually for testing purpose by entering values of larger magnitude randomly - For ex… --- ## [How data for 'Overall' field in 'Anomaly Explorer' window is calcualted](https://discuss.elastic.co/t/how-data-for-overall-field-in-anomaly-explorer-window-is-calcualted/106292)
**Author:** [@anomalyml](https://discuss.elastic.co/u/anomalyml)\ **Replies:** 2\ **Last updated:** [November 7, 2017, 4:06am UTC](https://discuss.elastic.co/t/how-data-for-overall-field-in-anomaly-explorer-window-is-calcualted/106292 "2017-11-07T04:06:38Z")
Hi, I have created a 'multi metric job' analysis for a given data. After completing the analysis, I check my results from 'Anomaly Explorer' window. From the documents I understand, the anomaly is calculated independen… --- ## [Migrating Elastic API from 2.4.6 to 5.6.3](https://discuss.elastic.co/t/migrating-elastic-api-from-2-4-6-to-5-6-3/106604)
**Author:** [@surendra18](https://discuss.elastic.co/u/surendra18)\ **Replies:** 0\ **Last updated:** [November 7, 2017, 1:18am UTC](https://discuss.elastic.co/t/migrating-elastic-api-from-2-4-6-to-5-6-3/106604 "2017-11-07T01:18:49Z")
Hi Team, We are planning to migrate elastic search API from 2.4.6 to 5.6.3 in next quarter and we have observed below DFL bool query errors after changing elastic version from 2.4.6 to 5.6.3 in spring POM file. The me… --- ## [Unicode](https://discuss.elastic.co/t/unicode/106477)
**Author:** [@Atul\_Harsha](https://discuss.elastic.co/u/Atul_Harsha)\ **Replies:** 1\ **Last updated:** [November 7, 2017, 12:33am UTC](https://discuss.elastic.co/t/unicode/106477 "2017-11-07T00:33:24Z")
Hi I am still learning elasticsearch referring the official doc and I have a query Under the tittle Living in the world of unicode it says what’s the difference between é and é? According to Elasticsearch, the fi… --- ## [Top\_hits after upgrade to 2.4.6 from 1.3.2](https://discuss.elastic.co/t/top-hits-after-upgrade-to-2-4-6-from-1-3-2/106515)
**Author:** [@juanito](https://discuss.elastic.co/u/juanito)\ **Replies:** 2\ **Last updated:** [November 7, 2017, 12:12am UTC](https://discuss.elastic.co/t/top-hits-after-upgrade-to-2-4-6-from-1-3-2/106515 "2017-11-07T00:12:10Z")
I just upgrade to 2.4.6 from 1.3, And a query that works in in 1.3 not work in 2.4.6, the data is the same. I mean that in 1.3 I getting hits in top\_hits bucket, but not in 2.4.6. I need to know the problem here, is th… --- ## [Could Not Index Event to Elasticsearch Error?](https://discuss.elastic.co/t/could-not-index-event-to-elasticsearch-error/106584)
**Author:** [@magdieldominguez](https://discuss.elastic.co/u/magdieldominguez)\ **Replies:** 7\ **Last updated:** [November 6, 2017, 11:30pm UTC](https://discuss.elastic.co/t/could-not-index-event-to-elasticsearch-error/106584 "2017-11-06T23:30:05Z")
Hi I am sending information from Logstash to Elasticsearch. The Elasticsearch is working fine but when I try to send it information to it from a log file it created the index for it but does not receive any of the inform… --- ## [Where do kiabna stores local users created from GUI](https://discuss.elastic.co/t/where-do-kiabna-stores-local-users-created-from-gui/106077)
**Author:** [@kenny123](https://discuss.elastic.co/u/kenny123)\ **Replies:** 3\ **Last updated:** [November 6, 2017, 11:21pm UTC](https://discuss.elastic.co/t/where-do-kiabna-stores-local-users-created-from-gui/106077 "2017-11-06T23:21:09Z")
Hi , I am new to ELK. I installed x-pack on kibana , elastic search and logstash . I also created few users from kibana GUI but I was wondering in which config file will kibana stores that users created from GUI. Can I … --- ## [Managing ElasticSearch](https://discuss.elastic.co/t/managing-elasticsearch/106581)
**Author:** [@dmossie](https://discuss.elastic.co/u/dmossie)\ **Replies:** 1\ **Last updated:** [November 6, 2017, 10:21pm UTC](https://discuss.elastic.co/t/managing-elasticsearch/106581 "2017-11-06T22:21:28Z")
Hi everyone, I am new to ElasticSearch. I was wondering what is the best way to manage the database. I have new data going into ElasticSearch constantly from logstash. I need to know how much data is being saved and t… --- ## [Exceeded max\_clause\_count with 70 terms](https://discuss.elastic.co/t/exceeded-max-clause-count-with-70-terms/106591)
**Author:** [@cayla](https://discuss.elastic.co/u/cayla)\ **Replies:** 0\ **Last updated:** [November 6, 2017, 9:53pm UTC](https://discuss.elastic.co/t/exceeded-max-clause-count-with-70-terms/106591 "2017-11-06T21:53:01Z")
Hello all, I have been having trouble with max\_clause\_count. I'm not sure what a clause is, as I only have 70 terms in a 'bool must should' query. Is there a way to see what clauses are created for a search? I tried us… --- ## [Percolation Regular Expressions and Hit Locations](https://discuss.elastic.co/t/percolation-regular-expressions-and-hit-locations/106589)
**Author:** [@zortlord](https://discuss.elastic.co/u/zortlord)\ **Replies:** 0\ **Last updated:** [November 6, 2017, 9:48pm UTC](https://discuss.elastic.co/t/percolation-regular-expressions-and-hit-locations/106589 "2017-11-06T21:48:04Z")
I have a need to search extremely large documents using large numbers Regular Expressions. Someone has recommended that I look into Elastic Search percolator to accomplish this. I've searched the documentation here and… --- ## ["query must be rewritten first" error when using terms lookup inside dis\_max query](https://discuss.elastic.co/t/query-must-be-rewritten-first-error-when-using-terms-lookup-inside-dis-max-query/106586)
**Author:** [@David\_Stendardi](https://discuss.elastic.co/u/David_Stendardi)\ **Replies:** 0\ **Last updated:** [November 6, 2017, 8:42pm UTC](https://discuss.elastic.co/t/query-must-be-rewritten-first-error-when-using-terms-lookup-inside-dis-max-query/106586 "2017-11-06T20:42:06Z")
During some experimentation I got this error when trying to use the terms lookup query inside a dis\_max query as follows : { "dis\_max" : { "tie\_breaker" : 0.7, "queries" : \[ { "terms" : { … --- ## [Elasticsearch 1.5 -\> 5.5 performance degradation](https://discuss.elastic.co/t/elasticsearch-1-5-5-5-performance-degradation/105797)
**Author:** [@jesushernandez](https://discuss.elastic.co/u/jesushernandez)\ **Replies:** 5\ **Last updated:** [November 6, 2017, 9:09pm UTC](https://discuss.elastic.co/t/elasticsearch-1-5-5-5-performance-degradation/105797 "2017-11-06T21:09:03Z")
Hello, Elasticsearch has been a core part of the infrastructure where I work for a few years. We use the AWS managed version, which unfortunately has few configuration options and also a few APIs closed. Recently we tr… --- ## [How to tune elasticsearch performance](https://discuss.elastic.co/t/how-to-tune-elasticsearch-performance/106472)
**Author:** [@f26227279](https://discuss.elastic.co/u/f26227279)\ **Replies:** 10\ **Last updated:** [November 6, 2017, 8:49pm UTC](https://discuss.elastic.co/t/how-to-tune-elasticsearch-performance/106472 "2017-11-06T20:49:52Z")
I am using ES to ingest flow data from other application, but I found that the ES speed isn't high enough, so sometimes it would drop flow. How can I change the setting of ES performance ? I have seen the elasticsearch… --- ## [Large Mapping of non-indexed fields vs singe non-indexed field with type object](https://discuss.elastic.co/t/large-mapping-of-non-indexed-fields-vs-singe-non-indexed-field-with-type-object/106585)
**Author:** [@morphers82](https://discuss.elastic.co/u/morphers82)\ **Replies:** 0\ **Last updated:** [November 6, 2017, 8:37pm UTC](https://discuss.elastic.co/t/large-mapping-of-non-indexed-fields-vs-singe-non-indexed-field-with-type-object/106585 "2017-11-06T20:37:43Z")
I am just curious if you think performance would be drastically different for this scenario. Having a mapping with 100's of non-indexed fields within a large multi-dimensional Map Object that stores data that will be us… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1896) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1898)