# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1912 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1913 --- ## [Nodes not finding each other when ES installed as a windows service](https://discuss.elastic.co/t/nodes-not-finding-each-other-when-es-installed-as-a-windows-service/105047)
**Author:** [@rob1727](https://discuss.elastic.co/u/rob1727)\ **Replies:** 1\ **Last updated:** [October 24, 2017, 1:48pm UTC](https://discuss.elastic.co/t/nodes-not-finding-each-other-when-es-installed-as-a-windows-service/105047 "2017-10-24T13:48:53Z")
Hi all, new to ElasticSearch and slowly putting the pieces together... Have 2 nodes on different desktops which find each other when I launch ES with the elasticsearch.bat file. However, when I install them as a window… --- ## [ML calculates wrong averages on pre-aggregated data](https://discuss.elastic.co/t/ml-calculates-wrong-averages-on-pre-aggregated-data/104916)
**Author:** [@guysmoilov](https://discuss.elastic.co/u/guysmoilov)\ **Replies:** 7\ **Last updated:** [October 24, 2017, 12:17pm UTC](https://discuss.elastic.co/t/ml-calculates-wrong-averages-on-pre-aggregated-data/104916 "2017-10-24T12:17:52Z")
Hi everyone, I would like some help or an explanation regarding how to work using pre-aggregated data for ML. Scenario: We’re indexing pre-aggregated data to Elasticsearch. Each document has the following (relevant) fie… --- ## [Need to reindex everytime synonym change?](https://discuss.elastic.co/t/need-to-reindex-everytime-synonym-change/104482)
**Author:** [@zidane28](https://discuss.elastic.co/u/zidane28)\ **Replies:** 3\ **Last updated:** [October 24, 2017, 11:51am UTC](https://discuss.elastic.co/t/need-to-reindex-everytime-synonym-change/104482 "2017-10-24T11:51:00Z")
All this while my knowledge on synonym is, whenever there is a change in synonym file, I will need to reindex for the changes to kicks in... But is that still true? Is that possible to not need to reindex whenever ther… --- ## [After copying template from ES\_1 to ES\_2, Map is not similar](https://discuss.elastic.co/t/after-copying-template-from-es-1-to-es-2-map-is-not-similar/105029)
**Author:** [@tomer](https://discuss.elastic.co/u/tomer)\ **Replies:** 0\ **Last updated:** [October 24, 2017, 10:07am UTC](https://discuss.elastic.co/t/after-copying-template-from-es-1-to-es-2-map-is-not-similar/105029 "2017-10-24T10:07:10Z")
Hi, I copied a template from ES\_1 to ES\_2. In ES\_1 there are no ".keyword"'s in them while in ES\_2 there are. I saw in ES\_2: "transactionId": { "type": "text", "fields": { "keywor… --- ## [Range Filter on array with different range](https://discuss.elastic.co/t/range-filter-on-array-with-different-range/104988)
**Author:** [@Canappeco](https://discuss.elastic.co/u/Canappeco)\ **Replies:** 1\ **Last updated:** [October 24, 2017, 11:04am UTC](https://discuss.elastic.co/t/range-filter-on-array-with-different-range/104988 "2017-10-24T11:04:02Z")
Hi all. I have an index named 2000 on my Elasticsearch cluster, here is the map: curl -XGET "192.168.1.140:9200/2000/\_mapping?pretty" { "2000" : { "mappings" : { "testData" : { "properties" : { … --- ## [In one machine Keyword appears, while in the other there is no keyword](https://discuss.elastic.co/t/in-one-machine-keyword-appears-while-in-the-other-there-is-no-keyword/104504)
**Author:** [@tomer](https://discuss.elastic.co/u/tomer)\ **Replies:** 1\ **Last updated:** [October 19, 2017, 7:28am UTC](https://discuss.elastic.co/t/in-one-machine-keyword-appears-while-in-the-other-there-is-no-keyword/104504 "2017-10-19T07:28:37Z")
Hi, In our lab for every String there is an ending ".keyword", but in the production, we don't have the ".keyword" ending, the mapping in both are supposed to be the same. Therefore I can't understand why one is differ… --- ## [Phrase suggester with trigrams - Did you mean](https://discuss.elastic.co/t/phrase-suggester-with-trigrams-did-you-mean/105044)
**Author:** [@xserrat](https://discuss.elastic.co/u/xserrat)\ **Replies:** 0\ **Last updated:** [October 24, 2017, 10:53am UTC](https://discuss.elastic.co/t/phrase-suggester-with-trigrams-did-you-mean/105044 "2017-10-24T10:53:18Z")
Hi everyone! I'm trying to make suggests using a Phrase suggest to obtain a Did you mean feature. I would like to use a combination of "tokenizer+token filters" to get the properly results. I have for example the word… --- ## [How can we achieve below query in elastic?](https://discuss.elastic.co/t/how-can-we-achieve-below-query-in-elastic/104923)
**Author:** [@manikesh](https://discuss.elastic.co/u/manikesh)\ **Replies:** 4\ **Last updated:** [October 24, 2017, 10:31am UTC](https://discuss.elastic.co/t/how-can-we-achieve-below-query-in-elastic/104923 "2017-10-24T10:31:39Z")
where name='manikesh' and age=35 and company='elastic'? I know we did not have and operation supported in elastic but do we have it now? what other ways to achieve this? --- ## [Update all documents that were matched against the query in the watcher as part of the watcher action](https://discuss.elastic.co/t/update-all-documents-that-were-matched-against-the-query-in-the-watcher-as-part-of-the-watcher-action/104621)
**Author:** [@naziyakhan](https://discuss.elastic.co/u/naziyakhan)\ **Replies:** 4\ **Last updated:** [October 24, 2017, 10:12am UTC](https://discuss.elastic.co/t/update-all-documents-that-were-matched-against-the-query-in-the-watcher-as-part-of-the-watcher-action/104621 "2017-10-24T10:12:01Z")
We have a use case where the watcher should skip sifting through all the documents that it has already used for matching the watcher query. The next time the watcher runs, only new documents should be used for matching. … --- ## [Help With Elasticsearch DSL MultiMatch Not Working with Searching Through Text and Integer Doc Types? Transport Error 400](https://discuss.elastic.co/t/help-with-elasticsearch-dsl-multimatch-not-working-with-searching-through-text-and-integer-doc-types-transport-error-400/104857)
**Author:** [@thejeffchen](https://discuss.elastic.co/u/thejeffchen)\ **Replies:** 4\ **Last updated:** [October 24, 2017, 10:10am UTC](https://discuss.elastic.co/t/help-with-elasticsearch-dsl-multimatch-not-working-with-searching-through-text-and-integer-doc-types-transport-error-400/104857 "2017-10-24T10:10:45Z")
Hey everyone, I'm having trouble getting the elasticsearch DSL to search through text and integer doc types. If I only do the fields with text() or integer(), there is no problem, but when I try to get elasticsearch to … --- ## [Math in watcher condition part](https://discuss.elastic.co/t/math-in-watcher-condition-part/104663)
**Author:** [@Izek](https://discuss.elastic.co/u/Izek)\ **Replies:** 5\ **Last updated:** [October 24, 2017, 9:04am UTC](https://discuss.elastic.co/t/math-in-watcher-condition-part/104663 "2017-10-24T09:04:48Z")
I am try to do the calculate of the condition part in watcher. But I have no idea how to do it . For logstash monitoring index, there have a doc.logstash\_stats.events.in and doc.logstash\_stats.events.out. How could I … --- ## [Unable to restore elasticsearch snapshot when using searchGuard](https://discuss.elastic.co/t/unable-to-restore-elasticsearch-snapshot-when-using-searchguard/104116)
**Author:** [@Milan](https://discuss.elastic.co/u/Milan)\ **Replies:** 3\ **Last updated:** [October 24, 2017, 9:00am UTC](https://discuss.elastic.co/t/unable-to-restore-elasticsearch-snapshot-when-using-searchguard/104116 "2017-10-24T09:00:43Z")
Hello, I'm having a problem when trying to restore a snapshot. Elasticsearch communications are secured using SearchGuard plugin. I've successfully been able to snapshot indexes to FS repository (shared samba repo). … --- ## [Not able to import data into index after applying custom analyzer and proper mapping \[Re-Posting-it\]](https://discuss.elastic.co/t/not-able-to-import-data-into-index-after-applying-custom-analyzer-and-proper-mapping-re-posting-it/104656)
**Author:** [@sidra\_89](https://discuss.elastic.co/u/sidra_89)\ **Replies:** 2\ **Last updated:** [October 24, 2017, 8:50am UTC](https://discuss.elastic.co/t/not-able-to-import-data-into-index-after-applying-custom-analyzer-and-proper-mapping-re-posting-it/104656 "2017-10-24T08:50:16Z")
i want to use ngram tokenizer for searching any substring in a word this is custom analyzer code is "analysis" =\> \[ "analyzer" =\> \[ "ngram\_analyzer" =\> \[ "ty… --- ## [Security API available through Java transport client?](https://discuss.elastic.co/t/security-api-available-through-java-transport-client/104934)
**Author:** [@adesouza](https://discuss.elastic.co/u/adesouza)\ **Replies:** 2\ **Last updated:** [October 24, 2017, 8:20am UTC](https://discuss.elastic.co/t/security-api-available-through-java-transport-client/104934 "2017-10-24T08:20:31Z")
Hi, Is there a way to manage native users and roles using the Java transport client API? I'm using version 5.5.0. Thanks, Aaron --- ## [X-pack watcher: Compare alerts from yesterday](https://discuss.elastic.co/t/x-pack-watcher-compare-alerts-from-yesterday/103406)
**Author:** [@xixo](https://discuss.elastic.co/u/xixo)\ **Replies:** 7\ **Last updated:** [October 24, 2017, 8:14am UTC](https://discuss.elastic.co/t/x-pack-watcher-compare-alerts-from-yesterday/103406 "2017-10-24T08:14:04Z")
Hi, I want to generate a notification if the current events have decreased a 20% since yesterday. Example: Sunday: 100 Events Monday: 60 Events -\> Notification is it possible to define this query? --- ## [Jvm heap size - garbage collection](https://discuss.elastic.co/t/jvm-heap-size-garbage-collection/103840)
**Author:** [@Patrik\_Soderstrom](https://discuss.elastic.co/u/Patrik_Soderstrom)\ **Replies:** 5\ **Last updated:** [October 24, 2017, 6:34am UTC](https://discuss.elastic.co/t/jvm-heap-size-garbage-collection/103840 "2017-10-24T06:34:45Z")
Hi, I´m trying to optimize the jvm heap size for nodes in my cluster. Sadly or good now :slight\_smile: First picture is heap size 4GB and second picture is 5GB. Which one looks best for garbage collection? \[Capture\]\[Ca… --- ## [How long do we have to retain the old data in X-Pack?](https://discuss.elastic.co/t/how-long-do-we-have-to-retain-the-old-data-in-x-pack/104832)
**Author:** [@Arun\_Raj](https://discuss.elastic.co/u/Arun_Raj)\ **Replies:** 5\ **Last updated:** [October 24, 2017, 5:51am UTC](https://discuss.elastic.co/t/how-long-do-we-have-to-retain-the-old-data-in-x-pack/104832 "2017-10-24T05:51:45Z")
Hi Everyone I 'm new to X-pack ML while experimenting I came across a doubt - I ve feed one month data into X-pack for ML and the system would identified the pattern and calculated the probability, and it would able to … --- ## [Data corruption in a few elasticsearch indices](https://discuss.elastic.co/t/data-corruption-in-a-few-elasticsearch-indices/104824)
**Author:** [@amiexc](https://discuss.elastic.co/u/amiexc)\ **Replies:** 2\ **Last updated:** [October 24, 2017, 1:37am UTC](https://discuss.elastic.co/t/data-corruption-in-a-few-elasticsearch-indices/104824 "2017-10-24T01:37:12Z")
Hi all, We've encountered a data corruption in our main production elasticsearch instance. We started getting the following response when querying the corrupted index: {"error":{"root\_cause":\[{"type":"no\_shard\_availabl… --- ## [Re: Disabling jarHell for plugins](https://discuss.elastic.co/t/re-disabling-jarhell-for-plugins/104972)
**Author:** [@Ivan](https://discuss.elastic.co/u/Ivan)\ **Replies:** 2\ **Last updated:** [October 24, 2017, 12:55am UTC](https://discuss.elastic.co/t/re-disabling-jarhell-for-plugins/104972 "2017-10-24T00:55:11Z")
This mailing list does not send out an email to the original poster, so hopefully I can reply to my own sent email. Shading jars will not work due to the way the plugin distribution is built. You cannot create an uber… --- ## [Merge two results ISearchResponse\ into one Or Union of ISearchResponse\ ElasticSearch .net](https://discuss.elastic.co/t/merge-two-results-isearchresponse-t-into-one-or-union-of-isearchresponse-t-elasticsearch-net/104978)
**Author:** [@timragon](https://discuss.elastic.co/u/timragon)\ **Replies:** 0\ **Last updated:** [October 23, 2017, 11:23pm UTC](https://discuss.elastic.co/t/merge-two-results-isearchresponse-t-into-one-or-union-of-isearchresponse-t-elasticsearch-net/104978 "2017-10-23T23:23:48Z")
Hi, I am getting responses ISearchResponse from multiple queries which I need to merge into one object of (ISearchResponse). Does anyone has any idea if it is possible? Thanks, Tim --- ## [Custom realm and roles provider that uses PKI](https://discuss.elastic.co/t/custom-realm-and-roles-provider-that-uses-pki/104939)
**Author:** [@asanderson](https://discuss.elastic.co/u/asanderson)\ **Replies:** 2\ **Last updated:** [October 23, 2017, 10:18pm UTC](https://discuss.elastic.co/t/custom-realm-and-roles-provider-that-uses-pki/104939 "2017-10-23T22:18:03Z")
I'm trying to develop a x-pack plugin that implements a custom realm and custom roles provider which uses the DN of a user certificate to authenticate and create custom roles based upon a RESTful request to an external l… --- ## [Using min\_score in a bucket selector pipeline aggregation](https://discuss.elastic.co/t/using-min-score-in-a-bucket-selector-pipeline-aggregation/104960)
**Author:** [@crickes](https://discuss.elastic.co/u/crickes)\ **Replies:** 0\ **Last updated:** [October 23, 2017, 7:54pm UTC](https://discuss.elastic.co/t/using-min-score-in-a-bucket-selector-pipeline-aggregation/104960 "2017-10-23T19:54:08Z")
I have an aggregation which produces an output like this using a significant terms aggregation: { "took": 88, "timed\_out": false, "num\_reduce\_phases": 3, "\_shards": { "total": 1430, "successful": 1430, … --- ## [Syntax error when saving a template contain tojson](https://discuss.elastic.co/t/syntax-error-when-saving-a-template-contain-tojson/104950)
**Author:** [@RomainXie](https://discuss.elastic.co/u/RomainXie)\ **Replies:** 0\ **Last updated:** [October 23, 2017, 6:22pm UTC](https://discuss.elastic.co/t/syntax-error-when-saving-a-template-contain-tojson/104950 "2017-10-23T18:22:25Z")
Hi, I attempt save a search template with a term query. POST \_scripts/test-json { "script": { "lang": "mustache", "source": {"query": {"filter": {"bool": {"must": \[{"terms": {"beat.hostname": {{#tojson}}hostn… --- ## [Distinct field values for a search condition](https://discuss.elastic.co/t/distinct-field-values-for-a-search-condition/104947)
**Author:** [@swaplogstash](https://discuss.elastic.co/u/swaplogstash)\ **Replies:** 0\ **Last updated:** [October 23, 2017, 6:04pm UTC](https://discuss.elastic.co/t/distinct-field-values-for-a-search-condition/104947 "2017-10-23T18:04:36Z")
elastic search query , I need to get unqiue results. I have documents with below mapping. "appId": { "type": "text" }, "date": { "type": "d… --- ## [How to convert update method to insert-array method (Java)](https://discuss.elastic.co/t/how-to-convert-update-method-to-insert-array-method-java/104949)
**Author:** [@arturcortereal](https://discuss.elastic.co/u/arturcortereal)\ **Replies:** 0\ **Last updated:** [October 23, 2017, 6:06pm UTC](https://discuss.elastic.co/t/how-to-convert-update-method-to-insert-array-method-java/104949 "2017-10-23T18:06:38Z")
Hello guys. Looks like I'm having some issues while updating an array. I think that my code is suffering from delay after the update. This is my code. I'm running it several times. If I put a sleep after the update, it … --- ## [Disabling jarHell for plugins](https://discuss.elastic.co/t/disabling-jarhell-for-plugins/104946)
**Author:** [@Ivan](https://discuss.elastic.co/u/Ivan)\ **Replies:** 0\ **Last updated:** [October 23, 2017, 6:04pm UTC](https://discuss.elastic.co/t/disabling-jarhell-for-plugins/104946 "2017-10-23T18:04:20Z")
I have a plugin which provides database access to initialize token filter terms and I am finally adding better testing. Due to the fact that each database system provides different java client drivers, the build proce… --- ## [Plugin to filter search resuls](https://discuss.elastic.co/t/plugin-to-filter-search-resuls/104925)
**Author:** [@Dan\_Markhasin](https://discuss.elastic.co/u/Dan_Markhasin)\ **Replies:** 2\ **Last updated:** [October 23, 2017, 5:57pm UTC](https://discuss.elastic.co/t/plugin-to-filter-search-resuls/104925 "2017-10-23T17:57:30Z")
Hi, I'm looking into ways of deduplicating data in our ES cluster (same document may appear in multiple indices under the same alias) and one of the potential methods seems to be writing a custom plugin that could filte… --- ## [ES FileSystemException (out of disk space)](https://discuss.elastic.co/t/es-filesystemexception-out-of-disk-space/104935)
**Author:** [@shines2](https://discuss.elastic.co/u/shines2)\ **Replies:** 2\ **Last updated:** [October 23, 2017, 5:05pm UTC](https://discuss.elastic.co/t/es-filesystemexception-out-of-disk-space/104935 "2017-10-23T17:05:20Z")
My entire cluster that back-ends my graylog deployment stop working over the weekend. It complaining that /proj/graylog (The directory where I store ES data) is full. A df shows that it's only 50% full: Type Size Use… --- ## [ElasticSearch 2.3.4 not updating after a client update (java API)](https://discuss.elastic.co/t/elasticsearch-2-3-4-not-updating-after-a-client-update-java-api/104924)
**Author:** [@arturcortereal](https://discuss.elastic.co/u/arturcortereal)\ **Replies:** 0\ **Last updated:** [October 23, 2017, 3:42pm UTC](https://discuss.elastic.co/t/elasticsearch-2-3-4-not-updating-after-a-client-update-java-api/104924 "2017-10-23T15:42:05Z")
Hey guys. I'm having an issue and I would like to understand what is going on. I have a Dao class that executes the following code: listOne.add(peanut); UpdateRequest updateRequest = new UpdateRe… --- ## [Too\_many\_requests (429)](https://discuss.elastic.co/t/too-many-requests-429/104724)
**Author:** [@hungl99](https://discuss.elastic.co/u/hungl99)\ **Replies:** 3\ **Last updated:** [October 23, 2017, 3:06pm UTC](https://discuss.elastic.co/t/too-many-requests-429/104724 "2017-10-23T15:06:29Z")
I observed these errors from the filebeat log. 2017-10-20T10:50:59-04:00 INFO Template already exists and will not be overwritten. 2017-10-20T10:50:59-04:00 ERR Failed to perform any bulk index operations: 429 Too Many… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1911) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1913)