# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1905 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1906 --- ## [Changing aggregation size effects doc\_count](https://discuss.elastic.co/t/changing-aggregation-size-effects-doc-count/105734)
**Author:** [@ryac](https://discuss.elastic.co/u/ryac)\ **Replies:** 2\ **Last updated:** [October 31, 2017, 2:54am UTC](https://discuss.elastic.co/t/changing-aggregation-size-effects-doc-count/105734 "2017-10-31T02:54:45Z")
Hi all, I have a strange issue when changing the aggregation size and doc\_counts returned. It's a straight-forward wildcard query using query\_string with some filters applied, and one aggregation. Setting the size to 10… --- ## [Self Monitoring using x-pack](https://discuss.elastic.co/t/self-monitoring-using-x-pack/105807)
**Author:** [@mouryayi](https://discuss.elastic.co/u/mouryayi)\ **Replies:** 1\ **Last updated:** [October 30, 2017, 10:48pm UTC](https://discuss.elastic.co/t/self-monitoring-using-x-pack/105807 "2017-10-30T22:48:15Z")
Hello All, Is it possible to create a self alert such as if a cluster state is red I have to get via email saying your cluster is red. Is that be possible using x-pack --- ## [License price for X-pack](https://discuss.elastic.co/t/license-price-for-x-pack/105814)
**Author:** [@danielz](https://discuss.elastic.co/u/danielz)\ **Replies:** 1\ **Last updated:** [October 30, 2017, 10:46pm UTC](https://discuss.elastic.co/t/license-price-for-x-pack/105814 "2017-10-30T22:46:57Z")
Hi, can anyone let me know, the price for X-pack? thank you in advance --- ## [Bypassing failing bootstrap checks](https://discuss.elastic.co/t/bypassing-failing-bootstrap-checks/105777)
**Author:** [@akpt](https://discuss.elastic.co/u/akpt)\ **Replies:** 12\ **Last updated:** [October 30, 2017, 8:52pm UTC](https://discuss.elastic.co/t/bypassing-failing-bootstrap-checks/105777 "2017-10-30T20:52:44Z")
I am trying to run 3 elasticsearch masters on a single node cluster but am having issues regarding the virtual memory setting. Everything seems to be running fine locally if I create the cluster/masters after first using… --- ## [High number of processes by elastic user](https://discuss.elastic.co/t/high-number-of-processes-by-elastic-user/105805)
**Author:** [@Manikanth\_Reddy](https://discuss.elastic.co/u/Manikanth_Reddy)\ **Replies:** 0\ **Last updated:** [October 30, 2017, 8:11pm UTC](https://discuss.elastic.co/t/high-number-of-processes-by-elastic-user/105805 "2017-10-30T20:11:26Z")
Hi, In my ES cluster, I can see number of processes(threads) for elastic user are getting increased. When I ran ps -o nlwp , it is showing as 7263 on client node and its keep on increasing. For data node, its around 180… --- ## [Aggregate filter for nested data types](https://discuss.elastic.co/t/aggregate-filter-for-nested-data-types/105802)
**Author:** [@rohinirajaram](https://discuss.elastic.co/u/rohinirajaram)\ **Replies:** 0\ **Last updated:** [October 30, 2017, 7:47pm UTC](https://discuss.elastic.co/t/aggregate-filter-for-nested-data-types/105802 "2017-10-30T19:47:19Z")
I have an INDEX test with the below mappings. Employees are nested arrays within departments which are themselves nested arrays within the organization document. When dealing with the below, how can an aggregate filter b… --- ## [Grok processor is not applied for indexed records in elastic search](https://discuss.elastic.co/t/grok-processor-is-not-applied-for-indexed-records-in-elastic-search/105760)
**Author:** [@vivekthangathurai](https://discuss.elastic.co/u/vivekthangathurai)\ **Replies:** 1\ **Last updated:** [October 30, 2017, 6:20pm UTC](https://discuss.elastic.co/t/grok-processor-is-not-applied-for-indexed-records-in-elastic-search/105760 "2017-10-30T18:20:38Z")
I am using the filebeat for indexing the records in elastic search. and I wanted to modify the index field so I added a pattern using ingest pipeline and gork. The records are getting indexed but the processing of pipel… --- ## [A very general question about Elastic-Search Syntaxes and Formats](https://discuss.elastic.co/t/a-very-general-question-about-elastic-search-syntaxes-and-formats/105791)
**Author:** [@Schizo](https://discuss.elastic.co/u/Schizo)\ **Replies:** 0\ **Last updated:** [October 30, 2017, 6:06pm UTC](https://discuss.elastic.co/t/a-very-general-question-about-elastic-search-syntaxes-and-formats/105791 "2017-10-30T18:06:38Z")
I first fall in love with es, as it looked like it made things easier than using SQL QUERIES. So i wanted to do more and more and started using Kibana etc an realized that I've dived into a world with a lot of new idioms… --- ## [Nesting the Aggregation Filter in Logstash](https://discuss.elastic.co/t/nesting-the-aggregation-filter-in-logstash/105784)
**Author:** [@rohinirajaram](https://discuss.elastic.co/u/rohinirajaram)\ **Replies:** 0\ **Last updated:** [October 30, 2017, 4:56pm UTC](https://discuss.elastic.co/t/nesting-the-aggregation-filter-in-logstash/105784 "2017-10-30T16:56:50Z")
I am looking at nesting aggregations for a document which contains a list for a column type which in turn contains a list. Consider the scenario provided on the aggregate filter page https://www.elastic.co/guide/en/logs… --- ## [Sort based on cosine similarity of float arrays](https://discuss.elastic.co/t/sort-based-on-cosine-similarity-of-float-arrays/105789)
**Author:** [@zachdb86](https://discuss.elastic.co/u/zachdb86)\ **Replies:** 0\ **Last updated:** [October 30, 2017, 5:33pm UTC](https://discuss.elastic.co/t/sort-based-on-cosine-similarity-of-float-arrays/105789 "2017-10-30T17:33:23Z")
Is it possible to sort based on the Cosine similarity of two different float arrays? Similar to how you can sort by geo distance by passing a coordinate to sort? --- ## [Federated Elasticsearch Setup between Linux server and AWS](https://discuss.elastic.co/t/federated-elasticsearch-setup-between-linux-server-and-aws/105600)
**Author:** [@rajkamalkool6](https://discuss.elastic.co/u/rajkamalkool6)\ **Replies:** 2\ **Last updated:** [October 30, 2017, 5:31pm UTC](https://discuss.elastic.co/t/federated-elasticsearch-setup-between-linux-server-and-aws/105600 "2017-10-30T17:31:27Z")
Hi, I have 5 node elasticsearch cluster version 5.2.0 with tribe node setup and it's running on Linux machine . I have another set of 3 node Elasticsearch cluster running on AWS ECS of same version 5.2.0. I want to make… --- ## [Better to have 1 daily metricbeat index with many filter index aliases or many daily metricbeat indices with no filtered aliases?](https://discuss.elastic.co/t/better-to-have-1-daily-metricbeat-index-with-many-filter-index-aliases-or-many-daily-metricbeat-indices-with-no-filtered-aliases/105765)
**Author:** [@tsullivan93](https://discuss.elastic.co/u/tsullivan93)\ **Replies:** 4\ **Last updated:** [October 30, 2017, 5:21pm UTC](https://discuss.elastic.co/t/better-to-have-1-daily-metricbeat-index-with-many-filter-index-aliases-or-many-daily-metricbeat-indices-with-no-filtered-aliases/105765 "2017-10-30T17:21:42Z")
Essentially what the topic says. Is it better to have 1 daily metricbeat index with many filter index aliases or many daily metricbeat indices with no filtered aliases in terms of optimizing cluster performance and healt… --- ## [Can't save multiple documents with same nested property into the same index: error says " object mapping can't be changed from nested to non-nested"](https://discuss.elastic.co/t/cant-save-multiple-documents-with-same-nested-property-into-the-same-index-error-says-object-mapping-cant-be-changed-from-nested-to-non-nested/105780)
**Author:** [@mwolfhoffman](https://discuss.elastic.co/u/mwolfhoffman)\ **Replies:** 5\ **Last updated:** [October 30, 2017, 5:10pm UTC](https://discuss.elastic.co/t/cant-save-multiple-documents-with-same-nested-property-into-the-same-index-error-says-object-mapping-cant-be-changed-from-nested-to-non-nested/105780 "2017-10-30T17:10:16Z")
I'm having an issue that I haven't seen on here yet. I am using the .net NEST client. I have multiple classes (ProductError and BatchError) with the same nested property (Error). When I save these documents individually… --- ## [Replacing values of fields by regex](https://discuss.elastic.co/t/replacing-values-of-fields-by-regex/105434)
**Author:** [@srv](https://discuss.elastic.co/u/srv)\ **Replies:** 2\ **Last updated:** [October 30, 2017, 5:04pm UTC](https://discuss.elastic.co/t/replacing-values-of-fields-by-regex/105434 "2017-10-30T17:04:20Z")
Hi there, I'm fairly new to whole ES world and currently evaluating an ELK Setup. I parsed several Logmessages via Logstash into Elasticsearch. So far so good. However some of theses logmessages contain a field with use… --- ## [Elastic Parse Rule not Working](https://discuss.elastic.co/t/elastic-parse-rule-not-working/105785)
**Author:** [@hec89](https://discuss.elastic.co/u/hec89)\ **Replies:** 0\ **Last updated:** [October 30, 2017, 4:59pm UTC](https://discuss.elastic.co/t/elastic-parse-rule-not-working/105785 "2017-10-30T16:59:12Z")
I have below message "2017-10-30T06:13:03.208000 0 0 0 0 0 0 0 0 0 0 GOSB\_2" corresponding Parse rule is match =\> {"message" =\> "%{TIMESTAMP\_ISO8601:samplingTimestamp} %{NUMBER:receiveVideoJitter:int} %{NUMBER:receive… --- ## [Unknown key for a START\_OBJECT in \[filter\]](https://discuss.elastic.co/t/unknown-key-for-a-start-object-in-filter/105775)
**Author:** [@aish](https://discuss.elastic.co/u/aish)\ **Replies:** 4\ **Last updated:** [October 30, 2017, 4:20pm UTC](https://discuss.elastic.co/t/unknown-key-for-a-start-object-in-filter/105775 "2017-10-30T16:20:16Z")
I'm new to elasticsearch and I'm trying to find logs with the event id 4625 every minute but getting this error. I can't figure out where I am going wrong. GET /\_search { "query": { "match": { "event\_id": "4… --- ## [Fscrawler doesn't seem to index against Includes](https://discuss.elastic.co/t/fscrawler-doesnt-seem-to-index-against-includes/105587)
**Author:** [@bilpor](https://discuss.elastic.co/u/bilpor)\ **Replies:** 9\ **Last updated:** [October 30, 2017, 3:57pm UTC](https://discuss.elastic.co/t/fscrawler-doesnt-seem-to-index-against-includes/105587 "2017-10-30T15:57:57Z")
here is my \_settings file. Basically I'm trying to create an index that includes only files of the types on the includes line. After it finishes, if I go to Kibana and query the index nothing is returned: { "name" : … --- ## [Or operator in expression](https://discuss.elastic.co/t/or-operator-in-expression/105591)
**Author:** [@afonso.ribeiro](https://discuss.elastic.co/u/afonso.ribeiro)\ **Replies:** 2\ **Last updated:** [October 30, 2017, 3:47pm UTC](https://discuss.elastic.co/t/or-operator-in-expression/105591 "2017-10-30T15:47:15Z")
Hi guys, I'm trying to convert the following expression to a elasticseach query. Field 1 != X or Field 2 != Y Can you help me translate this to elasticsearch? Thank you very much --- ## [What is equivalent query as SQL LIKE clause with Prefix and suffix?](https://discuss.elastic.co/t/what-is-equivalent-query-as-sql-like-clause-with-prefix-and-suffix/105774)
**Author:** [@Rahul\_Saxena](https://discuss.elastic.co/u/Rahul_Saxena)\ **Replies:** 0\ **Last updated:** [October 30, 2017, 3:06pm UTC](https://discuss.elastic.co/t/what-is-equivalent-query-as-sql-like-clause-with-prefix-and-suffix/105774 "2017-10-30T15:06:16Z")
I want to search from Elastic Search with search box text value having Prefix and Suffix in .net C# using NEST. Suppose I search "apple" it give me output only "apple" and I want output like "apple", "apple mobile", "app… --- ## [How to aggregate buckets from top\_hits?](https://discuss.elastic.co/t/how-to-aggregate-buckets-from-top-hits/105484)
**Author:** [@stoth](https://discuss.elastic.co/u/stoth)\ **Replies:** 0\ **Last updated:** [October 26, 2017, 9:49pm UTC](https://discuss.elastic.co/t/how-to-aggregate-buckets-from-top-hits/105484 "2017-10-26T21:49:23Z")
I have a document per app instance per cloud. For example: cloud: 1, appInstanceId: 123, timeReceived: 1509371566235291000 (timestamp stored as long), numWidgets: 99 cloud: 1, appInstanceId: 802, timeReceived: 15093… --- ## [Seperate Indices for different type of Tag or @Type](https://discuss.elastic.co/t/seperate-indices-for-different-type-of-tag-or-type/105768)
**Author:** [@ginu](https://discuss.elastic.co/u/ginu)\ **Replies:** 0\ **Last updated:** [October 30, 2017, 2:16pm UTC](https://discuss.elastic.co/t/seperate-indices-for-different-type-of-tag-or-type/105768 "2017-10-30T14:16:11Z")
Hi all, I have logs which are pushed into the Elasticsearch from multiple sources, say Source A and B... In Log Source A ...config.d/110-system-sources.conf ... ... tag system.messages ... ... or /config.d/… --- ## [Using synonym filter in es 6.0.0-rc1](https://discuss.elastic.co/t/using-synonym-filter-in-es-6-0-0-rc1/104241)
**Author:** [@mumpi](https://discuss.elastic.co/u/mumpi)\ **Replies:** 3\ **Last updated:** [October 30, 2017, 1:49pm UTC](https://discuss.elastic.co/t/using-synonym-filter-in-es-6-0-0-rc1/104241 "2017-10-30T13:49:47Z")
Instead of migrating es 5.6 indices to es 6 I wanted to recreate them. But somehow the behaviour of synonym filter has changed. The symptom is a message like "Invalid synonym rule at line 3" when creating the index and … --- ## [How to know if search query contains numbers](https://discuss.elastic.co/t/how-to-know-if-search-query-contains-numbers/105403)
**Author:** [@Karolinebryn](https://discuss.elastic.co/u/Karolinebryn)\ **Replies:** 2\ **Last updated:** [October 30, 2017, 1:36pm UTC](https://discuss.elastic.co/t/how-to-know-if-search-query-contains-numbers/105403 "2017-10-30T13:36:38Z")
I posted a question earlier, but nobody seems to be able to answer it so I am trying a gain with a different explanation. Is there a way to know if a search query contains numbers (or not words)? Take the following exa… --- ## [Aggregation query 5x faster when timezone is removed from query](https://discuss.elastic.co/t/aggregation-query-5x-faster-when-timezone-is-removed-from-query/104668)
**Author:** [@JohanRask](https://discuss.elastic.co/u/JohanRask)\ **Replies:** 2\ **Last updated:** [October 30, 2017, 12:21pm UTC](https://discuss.elastic.co/t/aggregation-query-5x-faster-when-timezone-is-removed-from-query/104668 "2017-10-30T12:21:55Z")
It takes kibana 25 seconds to display the histogram at the top of the discover pane in our 320 million, single shard index. If I copy the request json into "Dev Tools" and remove the timezone part from the aggs query it … --- ## [Field\_stats\_api deprecated?](https://discuss.elastic.co/t/field-stats-api-deprecated/85225)
**Author:** [@crickes](https://discuss.elastic.co/u/crickes)\ **Replies:** 3\ **Last updated:** [October 30, 2017, 12:14pm UTC](https://discuss.elastic.co/t/field-stats-api-deprecated/85225 "2017-10-30T12:14:13Z")
Hi, About a year ago, lots of people from Elastic were singing the praises of the field\_stats\_api, specifically how it can be used to figure out which indices to target a search on. Kibana still uses this mechanism in… --- ## [Unable to use curator 5.2.0 with ELK 5.6.2](https://discuss.elastic.co/t/unable-to-use-curator-5-2-0-with-elk-5-6-2/104873)
**Author:** [@mkain](https://discuss.elastic.co/u/mkain)\ **Replies:** 9\ **Last updated:** [October 30, 2017, 12:03pm UTC](https://discuss.elastic.co/t/unable-to-use-curator-5-2-0-with-elk-5-6-2/104873 "2017-10-30T12:03:58Z")
Hi, I have ELK 5.6.0 installed and I want to delete data older than 10 days. I have installed curator using pip and it got ver 5.2.0 of it by default. When I execute curator I get following error \[root@elk0 elasticsea… --- ## [Merging and indices.store.throttle.max\_bytes\_per\_sec](https://discuss.elastic.co/t/merging-and-indices-store-throttle-max-bytes-per-sec/105741)
**Author:** [@Deb](https://discuss.elastic.co/u/Deb)\ **Replies:** 0\ **Last updated:** [October 30, 2017, 10:31am UTC](https://discuss.elastic.co/t/merging-and-indices-store-throttle-max-bytes-per-sec/105741 "2017-10-30T10:31:02Z")
Cross posting from stackoverflow I have gone through this link It is not clear to me what does indices.store.throttle.max\_bytes\_per\_sec actually do? Is it like in one second if segments that are getting merged are havi… --- ## [How to get count of total records without size in elastic search](https://discuss.elastic.co/t/how-to-get-count-of-total-records-without-size-in-elastic-search/105713)
**Author:** [@sanjay25](https://discuss.elastic.co/u/sanjay25)\ **Replies:** 7\ **Last updated:** [October 30, 2017, 10:20am UTC](https://discuss.elastic.co/t/how-to-get-count-of-total-records-without-size-in-elastic-search/105713 "2017-10-30T10:20:48Z")
I want to get count of total records from elastic search. Executing manual query is giving 400 records whereas elastic search giving 10 records. How do I get total records regardless of size.? --- ## [SQL like GROUP BY AND HAVING](https://discuss.elastic.co/t/sql-like-group-by-and-having/104705)
**Author:** [@danishamjad30](https://discuss.elastic.co/u/danishamjad30)\ **Replies:** 1\ **Last updated:** [October 30, 2017, 9:29am UTC](https://discuss.elastic.co/t/sql-like-group-by-and-having/104705 "2017-10-30T09:29:23Z")
Hi, I want to achieve some functionality which is available in SQL data stores. I have tried a lot but having a hard time achieving that functionality with elasticsearch. I am successful in creating the queries but the … --- ## [Snapshot and restore module (concurrency)](https://discuss.elastic.co/t/snapshot-and-restore-module-concurrency/105668)
**Author:** [@Itay\_Bittan](https://discuss.elastic.co/u/Itay_Bittan)\ **Replies:** 10\ **Last updated:** [October 30, 2017, 9:19am UTC](https://discuss.elastic.co/t/snapshot-and-restore-module-concurrency/105668 "2017-10-30T09:19:48Z")
As part of the workflow I am creating snapshot for each index (periodically) and backup it in AWS S3 repository (with Elasticsearch plugin). Those snapshots (one per index) are later on restored in a different cluster t… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1904) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1906)