# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1899 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1900 --- ## [How can I expand query terms in Elasticsearch?](https://discuss.elastic.co/t/how-can-i-expand-query-terms-in-elasticsearch/106451)
**Author:** [@Taek\_Hyung\_Kim](https://discuss.elastic.co/u/Taek_Hyung_Kim)\ **Replies:** 0\ **Last updated:** [November 6, 2017, 1:20am UTC](https://discuss.elastic.co/t/how-can-i-expand-query-terms-in-elasticsearch/106451 "2017-11-06T01:20:37Z")
How can you expand query terms in Elasticsearch? I am a beginner who just started using Elasticsearch. I am studying a little through Googleing and the booklet, but I do not know much about it yet. There are two quest… --- ## [How Can I convert raw query with “aggs” to Nest query?](https://discuss.elastic.co/t/how-can-i-convert-raw-query-with-aggs-to-nest-query/105803)
**Author:** [@Nehad\_Hazem](https://discuss.elastic.co/u/Nehad_Hazem)\ **Replies:** 1\ **Last updated:** [November 5, 2017, 11:11pm UTC](https://discuss.elastic.co/t/how-can-i-convert-raw-query-with-aggs-to-nest-query/105803 "2017-11-05T23:11:26Z")
I have this raw query that is being used in Kibana to get and show some data from ElasticSearch. { "query": { "bool": { "must": \[ { "query\_string": { "query": "", "analyze\_wildcard": true } }, { "match": { "… --- ## [Elasticsearch docker containers - unable to add second node](https://discuss.elastic.co/t/elasticsearch-docker-containers-unable-to-add-second-node/106443)
**Author:** [@jagga13](https://discuss.elastic.co/u/jagga13)\ **Replies:** 3\ **Last updated:** [November 5, 2017, 10:42pm UTC](https://discuss.elastic.co/t/elasticsearch-docker-containers-unable-to-add-second-node/106443 "2017-11-05T22:42:42Z")
Hello, I am trying to deploy a 2 node elasticsearch test cluster in docker and was able to get up the first node as the master without any issues but when I try to startup the second es docker container it sees the mast… --- ## [ES2.4 delete\_by\_query with script](https://discuss.elastic.co/t/es2-4-delete-by-query-with-script/106433)
**Author:** [@dhireng](https://discuss.elastic.co/u/dhireng)\ **Replies:** 1\ **Last updated:** [November 5, 2017, 9:16pm UTC](https://discuss.elastic.co/t/es2-4-delete-by-query-with-script/106433 "2017-11-05T21:16:08Z")
Hi All, will a delete by query with a groovy script in the queryDSL work in ES2.4? My query returns the data I want but a delete returns found:false. any ideas? --- ## [How to set up a cluster locally with multiple VM's?](https://discuss.elastic.co/t/how-to-set-up-a-cluster-locally-with-multiple-vms/106361)
**Author:** [@jamilnyc](https://discuss.elastic.co/u/jamilnyc)\ **Replies:** 14\ **Last updated:** [November 5, 2017, 7:39pm UTC](https://discuss.elastic.co/t/how-to-set-up-a-cluster-locally-with-multiple-vms/106361 "2017-11-05T19:39:05Z")
Note: I'm just doing this to play around with and understand clustering while in development. I have two instances of ES 5.6 running on two separate Ubuntu 16.04 virtual machines (that are on the same Windows host). I'… --- ## [Using client nodes for reducing memory pressure from data nodes](https://discuss.elastic.co/t/using-client-nodes-for-reducing-memory-pressure-from-data-nodes/106441)
**Author:** [@Eli\_Revach](https://discuss.elastic.co/u/Eli_Revach)\ **Replies:** 3\ **Last updated:** [November 5, 2017, 6:35pm UTC](https://discuss.elastic.co/t/using-client-nodes-for-reducing-memory-pressure-from-data-nodes/106441 "2017-11-05T18:35:57Z")
Hi , ES version 1.7.5 . We have high memory pressure in our data nodes mainly by segments memory ( around 65% of the memory ) . This left enough very small memory for queris and we keep getting OLD GC's . We cons… --- ## [Running ELK stack on a server with Websphere and JBoss application servers](https://discuss.elastic.co/t/running-elk-stack-on-a-server-with-websphere-and-jboss-application-servers/106408)
**Author:** [@Ihjaz](https://discuss.elastic.co/u/Ihjaz)\ **Replies:** 4\ **Last updated:** [November 5, 2017, 9:58am UTC](https://discuss.elastic.co/t/running-elk-stack-on-a-server-with-websphere-and-jboss-application-servers/106408 "2017-11-05T09:58:33Z")
Hi, I'm planning to install ELK stack on nodes which also has a Websphere and a JBoss application server running. There will be multiple applications running on Websphere and 40% of the system's RAM is going to be alloc… --- ## [Elastics mapping](https://discuss.elastic.co/t/elastics-mapping/106379)
**Author:** [@Shekhar\_Pandey](https://discuss.elastic.co/u/Shekhar_Pandey)\ **Replies:** 7\ **Last updated:** [November 5, 2017, 2:02am UTC](https://discuss.elastic.co/t/elastics-mapping/106379 "2017-11-05T02:02:12Z")
I want to create mapping but can anyone clear me what is "search\_result\_data" and "search\_data". So it will be best way to define mapping or not. Thank you. --- ## [Out\_of\_memory\_error reason Java heap space](https://discuss.elastic.co/t/out-of-memory-error-reason-java-heap-space/106391)
**Author:** [@niraj\_kumar](https://discuss.elastic.co/u/niraj_kumar)\ **Replies:** 4\ **Last updated:** [November 5, 2017, 12:10am UTC](https://discuss.elastic.co/t/out-of-memory-error-reason-java-heap-space/106391 "2017-11-05T00:10:01Z")
Hi Everyone, I have a multi-core system with 32 GB of RAM and 16GB is assigned to the ES\_HEAP\_SIZE. The problem is that when i am trying to upload a file of 1GB it just fails with out of memory java heap space error. I … --- ## [Unable to reinstall Elasticsearch](https://discuss.elastic.co/t/unable-to-reinstall-elasticsearch/106358)
**Author:** [@rpazhyannur](https://discuss.elastic.co/u/rpazhyannur)\ **Replies:** 2\ **Last updated:** [November 4, 2017, 11:37pm UTC](https://discuss.elastic.co/t/unable-to-reinstall-elasticsearch/106358 "2017-11-04T23:37:47Z")
Hello for various reasons I have to reinstall Elasticsearch. I have deleted the directories but there is something that is preventing a reinstall. I am getting message 'Package elasticsearch-5.6.3-1.noarch already insta… --- ## [Non realtime aspects of ES](https://discuss.elastic.co/t/non-realtime-aspects-of-es/106387)
**Author:** [@iitgrad](https://discuss.elastic.co/u/iitgrad)\ **Replies:** 4\ **Last updated:** [November 4, 2017, 10:58pm UTC](https://discuss.elastic.co/t/non-realtime-aspects-of-es/106387 "2017-11-04T22:58:47Z")
I notice that if I update a document in ES and then immediately query, the change is not reflected. If I query a 2nd time, say 500ms later, the change is reflected. Is this expected behavior? If so, is there a way I can… --- ## [Dynamic mapping - Nested objects](https://discuss.elastic.co/t/dynamic-mapping-nested-objects/106390)
**Author:** [@nmalinip](https://discuss.elastic.co/u/nmalinip)\ **Replies:** 0\ **Last updated:** [November 4, 2017, 9:10pm UTC](https://discuss.elastic.co/t/dynamic-mapping-nested-objects/106390 "2017-11-04T21:10:59Z")
Hi All, We have a requirement to store nested json objects ( depth can be upto 5 levels) in elastic search. I have the current mapping "dynamic\_templates": \[ { "nested\_feature": { "match": "payload", … --- ## [Install elastalert plugin on ELK using windows](https://discuss.elastic.co/t/install-elastalert-plugin-on-elk-using-windows/106389)
**Author:** [@citanionarrei](https://discuss.elastic.co/u/citanionarrei)\ **Replies:** 0\ **Last updated:** [November 4, 2017, 8:18pm UTC](https://discuss.elastic.co/t/install-elastalert-plugin-on-elk-using-windows/106389 "2017-11-04T20:18:19Z")
Hi I have a few of question. It is possible to install elastalert on elk using windows 10? Is There a procedure to follow? And it is possible install elastalert only on kibana or is necessary install it also on elasti… --- ## [Painless Map copies are painful](https://discuss.elastic.co/t/painless-map-copies-are-painful/106258)
**Author:** [@morphers82](https://discuss.elastic.co/u/morphers82)\ **Replies:** 2\ **Last updated:** [November 4, 2017, 4:16pm UTC](https://discuss.elastic.co/t/painless-map-copies-are-painful/106258 "2017-11-04T16:16:06Z")
I'm trying to create a map of maps. so the map is like \['one':map,'two':map,'three':map,...\] all of the maps inside the map are identical. so I want to create an insideMap and just use that to define the mainmap ie: … --- ## [ES 5.2 index size keeps growing with every indexing run](https://discuss.elastic.co/t/es-5-2-index-size-keeps-growing-with-every-indexing-run/105935)
**Author:** [@jigs007](https://discuss.elastic.co/u/jigs007)\ **Replies:** 4\ **Last updated:** [November 4, 2017, 11:54am UTC](https://discuss.elastic.co/t/es-5-2-index-size-keeps-growing-with-every-indexing-run/105935 "2017-11-04T11:54:03Z")
we have an issue with ES 5.2 (3 node cluster) where the index size keeps growing disproportionately. We run some background job everyday which indexes 5million existing cases in 3 hr window. we have refresh interval set… --- ## [Boosting specific documents in every search](https://discuss.elastic.co/t/boosting-specific-documents-in-every-search/106183)
**Author:** [@Kemal\_Can\_Kara](https://discuss.elastic.co/u/Kemal_Can_Kara)\ **Replies:** 1\ **Last updated:** [November 3, 2017, 11:53pm UTC](https://discuss.elastic.co/t/boosting-specific-documents-in-every-search/106183 "2017-11-03T23:53:12Z")
I'm very new to Elasticsearch. I'm using it to filtering and also boosting some fields at query time. This is the code part for boosting and filtering: "query": { "bool": { "must": \[ { "bool": { … --- ## [Log Retention](https://discuss.elastic.co/t/log-retention/106324)
**Author:** [@motts](https://discuss.elastic.co/u/motts)\ **Replies:** 7\ **Last updated:** [November 3, 2017, 9:47pm UTC](https://discuss.elastic.co/t/log-retention/106324 "2017-11-03T21:47:52Z")
Does Elasticsearch have a default log retention period? If so, how do I change that. If not, what is the best way to go about purging old logs? Many thanks in advance. --- ## [Elasticsearch poor indexing performance](https://discuss.elastic.co/t/elasticsearch-poor-indexing-performance/106327)
**Author:** [@apyshchyk](https://discuss.elastic.co/u/apyshchyk)\ **Replies:** 5\ **Last updated:** [November 3, 2017, 8:23pm UTC](https://discuss.elastic.co/t/elasticsearch-poor-indexing-performance/106327 "2017-11-03T20:23:03Z")
Hi everyone, I have issues with ES indexing performance. First of all - current cluster setup 15 data nodes 8CPU, 32RAM 3 Master nodes 4CPU, 16 RAM external monitoring cluster. For current performance testing I'm se… --- ## [Secure access to dashboards](https://discuss.elastic.co/t/secure-access-to-dashboards/105872)
**Author:** [@zeenon](https://discuss.elastic.co/u/zeenon)\ **Replies:** 5\ **Last updated:** [November 3, 2017, 7:40pm UTC](https://discuss.elastic.co/t/secure-access-to-dashboards/105872 "2017-11-03T19:40:37Z")
We want to secure our dashboards and allow some users only to visualize dashboards: no modification, no save, no upgrade. I understand that I have to create a dedicated role but it does not work: { "cluster": \["monit… --- ## [\_score not as I'd expect](https://discuss.elastic.co/t/score-not-as-id-expect/106303)
**Author:** [@bilpor](https://discuss.elastic.co/u/bilpor)\ **Replies:** 2\ **Last updated:** [November 3, 2017, 6:35pm UTC](https://discuss.elastic.co/t/score-not-as-id-expect/106303 "2017-11-03T18:35:56Z")
Hi All, I have created an index in Elasticsearch. Using Kibana, I performed a search of a field for a particular word. Kibana returned me the expected results, but the \_score for each record isn't what I would have expe… --- ## [Is it possible to have elastic search index documents in 2 locations?](https://discuss.elastic.co/t/is-it-possible-to-have-elastic-search-index-documents-in-2-locations/106350)
**Author:** [@nsur1](https://discuss.elastic.co/u/nsur1)\ **Replies:** 1\ **Last updated:** [November 3, 2017, 6:16pm UTC](https://discuss.elastic.co/t/is-it-possible-to-have-elastic-search-index-documents-in-2-locations/106350 "2017-11-03T18:16:37Z")
I want to know if it is possible for elasticsearch to index documents into 2 directories. One for me to use, and then another as a backup. I want to create a mirror of all the indices as a backup. --- ## [Curator time zone](https://discuss.elastic.co/t/curator-time-zone/106002)
**Author:** [@eebee](https://discuss.elastic.co/u/eebee)\ **Replies:** 8\ **Last updated:** [November 3, 2017, 6:04pm UTC](https://discuss.elastic.co/t/curator-time-zone/106002 "2017-11-03T18:04:03Z")
I'm trying to write a Curator script that should remove all indicies older than one hour. This is just a test to see if my cron job is working as it should. However, I'm a little confused of how the time/unit-settings w… --- ## [Terms aggregation with include](https://discuss.elastic.co/t/terms-aggregation-with-include/106345)
**Author:** [@Natalia\_Kuleniuk](https://discuss.elastic.co/u/Natalia_Kuleniuk)\ **Replies:** 1\ **Last updated:** [November 3, 2017, 5:24pm UTC](https://discuss.elastic.co/t/terms-aggregation-with-include/106345 "2017-11-03T17:24:09Z")
Hello. Here is my problem: I have query to get data for specific vendorCode in specific range - lines 3-13. Than I want to get aggregations on videoViews for all data vendor have - lines 14-18 Than I need to create tw… --- ## [Mapping groups to users](https://discuss.elastic.co/t/mapping-groups-to-users/106257)
**Author:** [@jagrutsharma](https://discuss.elastic.co/u/jagrutsharma)\ **Replies:** 2\ **Last updated:** [November 3, 2017, 4:59pm UTC](https://discuss.elastic.co/t/mapping-groups-to-users/106257 "2017-11-03T16:59:05Z")
Hi - Is there a way to define mapping between groups and users, i.e. what users are which groups? Looked at this link (https://www.elastic.co/guide/en/x-pack/5.4/mapping-roles.html), but could not figure out where group-… --- ## [Second ES Instance Unable to Discover Other Nodes](https://discuss.elastic.co/t/second-es-instance-unable-to-discover-other-nodes/103438)
**Author:** [@seth.yes](https://discuss.elastic.co/u/seth.yes)\ **Replies:** 9\ **Last updated:** [November 3, 2017, 4:55pm UTC](https://discuss.elastic.co/t/second-es-instance-unable-to-discover-other-nodes/103438 "2017-11-03T16:55:31Z")
ES/Kibana/Logstash v5.6.2 I have three problematic machines in a 12 node cluster. These machines run two instances of ES, one is pointed to SSDs, and the other is pointed towards HDDs on the same machine. This is setup … --- ## [Date range is not working as expected](https://discuss.elastic.co/t/date-range-is-not-working-as-expected/106243)
**Author:** [@sa\_shashank](https://discuss.elastic.co/u/sa_shashank)\ **Replies:** 3\ **Last updated:** [November 3, 2017, 4:52pm UTC](https://discuss.elastic.co/t/date-range-is-not-working-as-expected/106243 "2017-11-03T16:52:19Z")
I am trying to build a range query on date field. POST /test\_index/test\_record/\_search { "size": 5000, "query": { "bool": { "must": \[\], "filter": \[{ "range": { "insertDate": { "gte": "2017-11… --- ## [Problem with MongoConnector + GridFS + ES + Ingest Mapper](https://discuss.elastic.co/t/problem-with-mongoconnector-gridfs-es-ingest-mapper/106339)
**Author:** [@2ihelp](https://discuss.elastic.co/u/2ihelp)\ **Replies:** 3\ **Last updated:** [November 3, 2017, 4:36pm UTC](https://discuss.elastic.co/t/problem-with-mongoconnector-gridfs-es-ingest-mapper/106339 "2017-11-03T16:36:18Z")
We are trying to map the Ingest Mapper plugin within ES to our MongoDB in order to be able to index binary data contained within the fs.chunks collection created automatically by GridFS. We tried to do the following com… --- ## [Is it ok to have too many tiny shards in a cluster?](https://discuss.elastic.co/t/is-it-ok-to-have-too-many-tiny-shards-in-a-cluster/106120)
**Author:** [@animageofmine](https://discuss.elastic.co/u/animageofmine)\ **Replies:** 10\ **Last updated:** [November 3, 2017, 4:29pm UTC](https://discuss.elastic.co/t/is-it-ok-to-have-too-many-tiny-shards-in-a-cluster/106120 "2017-11-03T16:29:28Z")
Our use case allows customers to create tiny indices, which means there might be too many shards in a cluster (1 shard / index since these are tiny). Each index might have less than 10k records. I was wondering if its o… --- ## [Counting documents that match both buckets at same time](https://discuss.elastic.co/t/counting-documents-that-match-both-buckets-at-same-time/106343)
**Author:** [@ergo](https://discuss.elastic.co/u/ergo)\ **Replies:** 0\ **Last updated:** [November 3, 2017, 4:28pm UTC](https://discuss.elastic.co/t/counting-documents-that-match-both-buckets-at-same-time/106343 "2017-11-03T16:28:59Z")
I have this example list of documents: curl -XPOST 'localhost:9200/test\_data/test\_row/\_bulk?pretty' -H 'Content-Type: application/json' -d' { "index": {}} { "value": 1, "user\_id": 1, "profiler\_id": 1} { "index": {}} {… --- ## [X-Pack on the monitoring cluster](https://discuss.elastic.co/t/x-pack-on-the-monitoring-cluster/105370)
**Author:** [@Zsolt](https://discuss.elastic.co/u/Zsolt)\ **Replies:** 1\ **Last updated:** [November 3, 2017, 4:15pm UTC](https://discuss.elastic.co/t/x-pack-on-the-monitoring-cluster/105370 "2017-11-03T16:15:17Z")
Hi, I have a "prod" cluster, a "monitoring" cluster and a "kibana" cluster. According to the documentation, we don't really need to install x-pack on the monitoring cluster: While installing X-Pack on the monitoring clu… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1898) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1900)