# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1920 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1921 --- ## [How to add a new relation to an existing join field](https://discuss.elastic.co/t/how-to-add-a-new-relation-to-an-existing-join-field/103827)
**Author:** [@pancs\_li](https://discuss.elastic.co/u/pancs_li)\ **Replies:** 10\ **Last updated:** [October 16, 2017, 3:27am UTC](https://discuss.elastic.co/t/how-to-add-a-new-relation-to-an-existing-join-field/103827 "2017-10-16T03:27:25Z")
hi，guys I use Elasticsearch and the version is 6.0 ,I created a parent-child relationship field in accordance with the official document.The document said “It is possible to add a new relation to an existing join field.… --- ## [Acces to datatype range](https://discuss.elastic.co/t/acces-to-datatype-range/104031)
**Author:** [@abkrim](https://discuss.elastic.co/u/abkrim)\ **Replies:** 0\ **Last updated:** [October 15, 2017, 6:00pm UTC](https://discuss.elastic.co/t/acces-to-datatype-range/104031 "2017-10-15T18:00:38Z")
I need access to "gte" and "lte" values on a data mapping with integer\_range of my scoreing scripts (Painless) Try access data with severals methods doc\["trl"\].gte.value doc\["trl"\].gte doc\["trl"\]\["gte"\].value doc\["trl"… --- ## [How to design an architecture which can upgrade es on hot?](https://discuss.elastic.co/t/how-to-design-an-architecture-which-can-upgrade-es-on-hot/104000)
**Author:** [@chenjinyuan87](https://discuss.elastic.co/u/chenjinyuan87)\ **Replies:** 8\ **Last updated:** [October 15, 2017, 5:17pm UTC](https://discuss.elastic.co/t/how-to-design-an-architecture-which-can-upgrade-es-on-hot/104000 "2017-10-15T17:17:45Z")
We have more than 10 services who use es in different ways. So each service connect to the cluster themselves. That is, if i want to upgrade es to 6.0, we need to upgrade and test all the services at the same time, ful… --- ## [Delete\_by\_quey API deleted documents which didn't match search criteria](https://discuss.elastic.co/t/delete-by-quey-api-deleted-documents-which-didnt-match-search-criteria/103916)
**Author:** [@amruth](https://discuss.elastic.co/u/amruth)\ **Replies:** 10\ **Last updated:** [October 15, 2017, 3:53pm UTC](https://discuss.elastic.co/t/delete-by-quey-api-deleted-documents-which-didnt-match-search-criteria/103916 "2017-10-15T15:53:10Z")
Hi, Here is the query I used, POST twitter/\_delete\_by\_query { "query": { "match": { "source\_host": "server02.local" } } } But it deleted all the documents with source\_host:server01.local, source\_ho… --- ## [Machine Learning: Could not open job](https://discuss.elastic.co/t/machine-learning-could-not-open-job/103964)
**Author:** [@spacepacket](https://discuss.elastic.co/u/spacepacket)\ **Replies:** 1\ **Last updated:** [October 15, 2017, 1:08pm UTC](https://discuss.elastic.co/t/machine-learning-could-not-open-job/103964 "2017-10-15T13:08:58Z")
I am using the machine learning feature of X-Pack. I created some jobs, that seem to work fine. The next day, I tried to create and open a job and got the following error. I also get the error if I try and run one of my … --- ## [Pull ES data and generate application logs](https://discuss.elastic.co/t/pull-es-data-and-generate-application-logs/104003)
**Author:** [@santhosh244](https://discuss.elastic.co/u/santhosh244)\ **Replies:** 2\ **Last updated:** [October 15, 2017, 5:56am UTC](https://discuss.elastic.co/t/pull-es-data-and-generate-application-logs/104003 "2017-10-15T05:56:12Z")
Hi Team, My Setup: Have 50+ application servers which generates huge logs and filebeat ships them to multiple LS nodes and then gets shipped into 1 ES node\[Actually 6 node ES cluster - 5 data nodes 1 client node\] In lo… --- ## [Best practice in making data nodes as master nodes](https://discuss.elastic.co/t/best-practice-in-making-data-nodes-as-master-nodes/103461)
**Author:** [@elasticuser1](https://discuss.elastic.co/u/elasticuser1)\ **Replies:** 2\ **Last updated:** [October 15, 2017, 5:01am UTC](https://discuss.elastic.co/t/best-practice-in-making-data-nodes-as-master-nodes/103461 "2017-10-15T05:01:26Z")
Hi gurus, I want to know what is the best practice to make data nodes in cluster1 as master nodes in cluster2. We are shutting down cluster1 and moving the nodes to cluster2. Should I snapshot, delete and restore the d… --- ## [Red health status](https://discuss.elastic.co/t/red-health-status/103989)
**Author:** [@Joozty](https://discuss.elastic.co/u/Joozty)\ **Replies:** 5\ **Last updated:** [October 14, 2017, 7:08pm UTC](https://discuss.elastic.co/t/red-health-status/103989 "2017-10-14T19:08:40Z")
My index has red health status and I don't know why. It cannot be becouse of disk space. I have more than 20TB avalaible. My index settings: { "my\_index": { "settings": { "index"… --- ## [Failed to import dashboard sample for watcher](https://discuss.elastic.co/t/failed-to-import-dashboard-sample-for-watcher/103977)
**Author:** [@RomainXie](https://discuss.elastic.co/u/RomainXie)\ **Replies:** 2\ **Last updated:** [October 14, 2017, 4:11pm UTC](https://discuss.elastic.co/t/failed-to-import-dashboard-sample-for-watcher/103977 "2017-10-14T16:11:08Z")
Hi, I download the dashboard sample from the github samples project. But got a error when I import it in the kibana saved object. We use the Elastic Cloud, version is 5.6.2. I had set the index patterns for the .watch… --- ## [Unsolved. leave this](https://discuss.elastic.co/t/unsolved-leave-this/103971)
**Author:** [@edu\_ever](https://discuss.elastic.co/u/edu_ever)\ **Replies:** 1\ **Last updated:** [October 14, 2017, 2:57am UTC](https://discuss.elastic.co/t/unsolved-leave-this/103971 "2017-10-14T02:57:05Z")
\[34 PM 001\] This instance is configured in AWS EC2 instance elasticsearch stop automatically even after restarting , here i am attaching the elasticsearch.yml file which i changed according to tutorial. --- ## [Elasticsearch inner-hits on child type not in the query](https://discuss.elastic.co/t/elasticsearch-inner-hits-on-child-type-not-in-the-query/103973)
**Author:** [@smndiaye](https://discuss.elastic.co/u/smndiaye)\ **Replies:** 1\ **Last updated:** [October 14, 2017, 10:01am UTC](https://discuss.elastic.co/t/elasticsearch-inner-hits-on-child-type-not-in-the-query/103973 "2017-10-14T10:01:14Z")
Struggling with inner-hits on elasticsearch. Would appreciate any help. I have two child types: childA and childB. I am querying parents of childA like this "query":{ "bool": { "should": { "has… --- ## [Query can't find hit though index and uuid is correctly selected](https://discuss.elastic.co/t/query-cant-find-hit-though-index-and-uuid-is-correctly-selected/103985)
**Author:** [@nottinhill](https://discuss.elastic.co/u/nottinhill)\ **Replies:** 1\ **Last updated:** [October 14, 2017, 11:30am UTC](https://discuss.elastic.co/t/query-cant-find-hit-though-index-and-uuid-is-correctly-selected/103985 "2017-10-14T11:30:55Z")
We run on Elastic Cloud. This is the reply for the query: \[query\_shard\_exception\] failed to create query: { "bool" : { "must" : \[ { "nested" : { "query" : { "exists… --- ## [Is the cache updated when a document is updated?](https://discuss.elastic.co/t/is-the-cache-updated-when-a-document-is-updated/103967)
**Author:** [@dhavalk123](https://discuss.elastic.co/u/dhavalk123)\ **Replies:** 3\ **Last updated:** [October 14, 2017, 10:35am UTC](https://discuss.elastic.co/t/is-the-cache-updated-when-a-document-is-updated/103967 "2017-10-14T10:35:42Z")
A single document update in ES is ACID but is the cache updated when the document is updated? I am doing filter queries and I think that even though I maybe able to update a document safely in a distributed environment, … --- ## [How do i use external versions when using pipelines?](https://discuss.elastic.co/t/how-do-i-use-external-versions-when-using-pipelines/103981)
**Author:** [@Arian\_Dave\_Mabanag](https://discuss.elastic.co/u/Arian_Dave_Mabanag)\ **Replies:** 0\ **Last updated:** [October 14, 2017, 10:29am UTC](https://discuss.elastic.co/t/how-do-i-use-external-versions-when-using-pipelines/103981 "2017-10-14T10:29:45Z")
Im currently working on pushing logs to elasticsearch using filebeat. In order to index these docs to the preferred location, i use an ingester node. {"name":"mydoc","myDocId":"myId1","myDocType":"someType","myIndex":"s… --- ## [Finding results from specific day (NEST)](https://discuss.elastic.co/t/finding-results-from-specific-day-nest/103978)
**Author:** [@Illidan](https://discuss.elastic.co/u/Illidan)\ **Replies:** 1\ **Last updated:** [October 14, 2017, 9:45am UTC](https://discuss.elastic.co/t/finding-results-from-specific-day-nest/103978 "2017-10-14T09:45:30Z")
What is the most correct way to find results from specific day? For example, I would like to get all results from 14/10/17, regardless of time. I was thinking to use combination of: GreaterThanOrEquals (14/10/17 00:0… --- ## [Inline success script move to stored failed in transform watcher](https://discuss.elastic.co/t/inline-success-script-move-to-stored-failed-in-transform-watcher/103940)
**Author:** [@RomainXie](https://discuss.elastic.co/u/RomainXie)\ **Replies:** 2\ **Last updated:** [October 14, 2017, 3:04am UTC](https://discuss.elastic.co/t/inline-success-script-move-to-stored-failed-in-transform-watcher/103940 "2017-10-14T03:04:21Z")
Hi, all The follow is run correct. "transform": { "script": { "source": "return \['error\_count' : ctx.payload.aggregations.whichHost.buckets.length, 'hosts' : ctx.payload.aggregations.whichHost.buckets.strea… --- ## [Breaking Changes in 6.0 - reindex indices from 2.x - Why?](https://discuss.elastic.co/t/breaking-changes-in-6-0-reindex-indices-from-2-x-why/103788)
**Author:** [@YeeP](https://discuss.elastic.co/u/YeeP)\ **Replies:** 7\ **Last updated:** [October 14, 2017, 12:36am UTC](https://discuss.elastic.co/t/breaking-changes-in-6-0-reindex-indices-from-2-x-why/103788 "2017-10-14T00:36:03Z")
So along the lines of why does this need to happen, what needs to happen? I see that the reindex API is the recommended method, but this looks like a utility that just copies one index to another. I could be wrong, but I… --- ## [How null data time is treated in gauss function](https://discuss.elastic.co/t/how-null-data-time-is-treated-in-gauss-function/102044)
**Author:** [@Youxu](https://discuss.elastic.co/u/Youxu)\ **Replies:** 1\ **Last updated:** [October 13, 2017, 11:20pm UTC](https://discuss.elastic.co/t/how-null-data-time-is-treated-in-gauss-function/102044 "2017-10-13T23:20:13Z")
for example, I have following like function: "functions": \[ {"gauss":{"AvailableDate":{"scale":"120d","offset":"30d","decay":0.33}}} \], if the AvailableDate is null in a document, how the ES handl… --- ## [Exception in thread "main" java.lang.NoClassDefFoundError: org/apache/logging/log4j/util/ReflectionUtil](https://discuss.elastic.co/t/exception-in-thread-main-java-lang-noclassdeffounderror-org-apache-logging-log4j-util-reflectionutil/102651)
**Author:** [@kumar1993](https://discuss.elastic.co/u/kumar1993)\ **Replies:** 8\ **Last updated:** [October 13, 2017, 7:06pm UTC](https://discuss.elastic.co/t/exception-in-thread-main-java-lang-noclassdeffounderror-org-apache-logging-log4j-util-reflectionutil/102651 "2017-10-13T19:06:46Z")
Hi I have followed the tutorial on the elastic search website and i am instantiating a High level rest client in java, but when i try to do this i run into the following exception: Exception in thread "main" java.lang.No… --- ## [Elasticsearch missing one record via High level rest api](https://discuss.elastic.co/t/elasticsearch-missing-one-record-via-high-level-rest-api/103943)
**Author:** [@Ashutosh\_Tripathi](https://discuss.elastic.co/u/Ashutosh_Tripathi)\ **Replies:** 0\ **Last updated:** [October 13, 2017, 7:04pm UTC](https://discuss.elastic.co/t/elasticsearch-missing-one-record-via-high-level-rest-api/103943 "2017-10-13T19:04:04Z")
Hi, We are having trouble after moving to elasticsearch 5.6.x version from 5.0.x version. We always get one record less than the total number of records expected. We can verify the missing record since same elastic jso… --- ## [Privileges for built-in roles](https://discuss.elastic.co/t/privileges-for-built-in-roles/103792)
**Author:** [@jagrutsharma](https://discuss.elastic.co/u/jagrutsharma)\ **Replies:** 2\ **Last updated:** [October 13, 2017, 6:36pm UTC](https://discuss.elastic.co/t/privileges-for-built-in-roles/103792 "2017-10-13T18:36:44Z")
The reference for privileges is here: https://www.elastic.co/guide/en/x-pack/5.4/security-privileges.html Built-in roles have privileges that are not in the reference list. For example, here are two built-in roles. The… --- ## [Need Suggestion on Elastic search structure Capacity](https://discuss.elastic.co/t/need-suggestion-on-elastic-search-structure-capacity/103859)
**Author:** [@amitshar04](https://discuss.elastic.co/u/amitshar04)\ **Replies:** 3\ **Last updated:** [October 13, 2017, 6:21pm UTC](https://discuss.elastic.co/t/need-suggestion-on-elastic-search-structure-capacity/103859 "2017-10-13T18:21:09Z")
Hi, What should be the capacity of master node if i am using 2 Server as data node & each node having capacity of 128 Gb / 32 Core. Thanks, Amit --- ## [Delete: xpack.security.audit.index](https://discuss.elastic.co/t/delete-xpack-security-audit-index/103772)
**Author:** [@eramitsinha](https://discuss.elastic.co/u/eramitsinha)\ **Replies:** 2\ **Last updated:** [October 13, 2017, 5:09pm UTC](https://discuss.elastic.co/t/delete-xpack-security-audit-index/103772 "2017-10-13T17:09:50Z")
Hi, I am using Elastic Search 5.2.2, Kibana 5.2.2 and X-Pack 5.2.2 I have enabled auditing on my cluster, so this is working fine as I could see ".security\_audit\_log" index are getting generated. But would like … --- ## [About Elasticsearch Reference \[5.6\] » Document APIs » Index API](https://discuss.elastic.co/t/about-elasticsearch-reference-5-6-document-apis-index-api/103934)
**Author:** [@R00082](https://discuss.elastic.co/u/R00082)\ **Replies:** 0\ **Last updated:** [October 13, 2017, 4:55pm UTC](https://discuss.elastic.co/t/about-elasticsearch-reference-5-6-document-apis-index-api/103934 "2017-10-13T16:55:36Z")
hi in the link https://www.elastic.co/guide/en/elasticsearch/reference/5.6/docs-index\_.html#index-wait-for-active-shards For example, suppose we have a cluster of three nodes, A, B, and C and we create an index index w… --- ## [Comparing text between .raw and .keyword](https://discuss.elastic.co/t/comparing-text-between-raw-and-keyword/103230)
**Author:** [@tarp](https://discuss.elastic.co/u/tarp)\ **Replies:** 1\ **Last updated:** [October 13, 2017, 4:28pm UTC](https://discuss.elastic.co/t/comparing-text-between-raw-and-keyword/103230 "2017-10-13T16:28:30Z")
Hi, I'm working on an aggregation of Queue statistics data. The data that I'm feeding in is from a log file that filebeat sends to and ingestion pipeline. The field queue, is a text field that comes in and gets assign… --- ## [Index.created\_date error](https://discuss.elastic.co/t/index-created-date-error/103897)
**Author:** [@ATS\_Cha](https://discuss.elastic.co/u/ATS_Cha)\ **Replies:** 6\ **Last updated:** [October 13, 2017, 4:13pm UTC](https://discuss.elastic.co/t/index-created-date-error/103897 "2017-10-13T16:13:53Z")
5649{"error":{"root\_cause":\[{"type":"remote\_transport\_exception","reason":"\[2whDrQ3\]\[x.x.x.x:9300\]\[indices:admin/create\]"}\],"type":"illegal\_argument\_exception","reason":"unknown setting \[index.creation\_date\] please check… --- ## [Terms aggregation very slow - but very fast with murmur3](https://discuss.elastic.co/t/terms-aggregation-very-slow-but-very-fast-with-murmur3/103760)
**Author:** [@ebuildy](https://discuss.elastic.co/u/ebuildy)\ **Replies:** 3\ **Last updated:** [October 13, 2017, 4:11pm UTC](https://discuss.elastic.co/t/terms-aggregation-very-slow-but-very-fast-with-murmur3/103760 "2017-10-13T16:11:42Z")
I do a nested aggregation like this: "aggregations": { "query": { "terms": { "field": "query", "size": 1000 }, "aggs": { "url": { "terms": { "field": "… --- ## [What does "No search context found for id ..." mean?](https://discuss.elastic.co/t/what-does-no-search-context-found-for-id-mean/103316)
**Author:** [@TimWard](https://discuss.elastic.co/u/TimWard)\ **Replies:** 10\ **Last updated:** [October 13, 2017, 3:53pm UTC](https://discuss.elastic.co/t/what-does-no-search-context-found-for-id-mean/103316 "2017-10-13T15:53:24Z")
From Python driver. If I search for this message I find various detailed discussions, but they all seem to assume I'm starting from knowing a lot more than I do. So, starting from nothing at all, what does this message … --- ## [Restore a snapshot in ES](https://discuss.elastic.co/t/restore-a-snapshot-in-es/103359)
**Author:** [@arianayay](https://discuss.elastic.co/u/arianayay)\ **Replies:** 1\ **Last updated:** [October 13, 2017, 3:50pm UTC](https://discuss.elastic.co/t/restore-a-snapshot-in-es/103359 "2017-10-13T15:50:40Z")
Hi All, I've tried doing a restore for Elasticsearch and used the \_cat/recovery API to monitor the time the snapshot was restored in the cluster but upon checking, restoring a snapshot is per shard basis. For example in… --- ## [How to recover deleted documents in Elasticsearch?](https://discuss.elastic.co/t/how-to-recover-deleted-documents-in-elasticsearch/103913)
**Author:** [@amruth](https://discuss.elastic.co/u/amruth)\ **Replies:** 2\ **Last updated:** [October 13, 2017, 2:49pm UTC](https://discuss.elastic.co/t/how-to-recover-deleted-documents-in-elasticsearch/103913 "2017-10-13T14:49:01Z")
Hi, Is there anyway to recover deleted documents in ES index? Thanks [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1919) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1921)