# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1921 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1922 --- ## [Using "terms" on a nested field](https://discuss.elastic.co/t/using-terms-on-a-nested-field/103383)
**Author:** [@Marcelo-Theodoro](https://discuss.elastic.co/u/Marcelo-Theodoro)\ **Replies:** 2\ **Last updated:** [October 13, 2017, 2:23pm UTC](https://discuss.elastic.co/t/using-terms-on-a-nested-field/103383 "2017-10-13T14:23:53Z")
Hello. I'm using a "term" filter on a nested field, it's working fine. But I'm getting an error when I try to do the same query with "terms" on ES 2.4. Any tips here? # Working: {'query': {'filtered': {'filter': {'bool'… --- ## [Can I use previous aggregation key in a script?](https://discuss.elastic.co/t/can-i-use-previous-aggregation-key-in-a-script/103908)
**Author:** [@cristinalazin](https://discuss.elastic.co/u/cristinalazin)\ **Replies:** 0\ **Last updated:** [October 13, 2017, 1:51pm UTC](https://discuss.elastic.co/t/can-i-use-previous-aggregation-key-in-a-script/103908 "2017-10-13T13:51:32Z")
I have a chain of Bucketing Aggregations. Inside I want to apply a Filter Aggregation having the must bool condition defined by a script. The filter condition should depend on the value of one bucket key from the chain. … --- ## [Extract fields from log line](https://discuss.elastic.co/t/extract-fields-from-log-line/103902)
**Author:** [@Taoufiq\_BOUKHCHA](https://discuss.elastic.co/u/Taoufiq_BOUKHCHA)\ **Replies:** 2\ **Last updated:** [October 13, 2017, 1:55pm UTC](https://discuss.elastic.co/t/extract-fields-from-log-line/103902 "2017-10-13T13:55:40Z")
Hello, I need to extract KV fields from a java rest service log, the KV processor expect to have only key values, but this is what I have : Oct 12 14:08:34 HOST\_NAME SERVICE\_NAME: 20171012T140834,059 INFO thread=thread… --- ## [Set the global log level to ERROR](https://discuss.elastic.co/t/set-the-global-log-level-to-error/103655)
**Author:** [@1222kkk](https://discuss.elastic.co/u/1222kkk)\ **Replies:** 3\ **Last updated:** [October 13, 2017, 1:49pm UTC](https://discuss.elastic.co/t/set-the-global-log-level-to-error/103655 "2017-10-13T13:49:13Z")
hi all, I just wonder how to set the global log level of elastisearch. I found the configure file of log via ${es\_home}/conf/log4j2.properties. As the showing below: status = error # log action execution errors for e… --- ## [Cluster configuration for log storage. 140Gb/day](https://discuss.elastic.co/t/cluster-configuration-for-log-storage-140gb-day/103886)
**Author:** [@Vlad\_Nashekin](https://discuss.elastic.co/u/Vlad_Nashekin)\ **Replies:** 4\ **Last updated:** [October 13, 2017, 1:40pm UTC](https://discuss.elastic.co/t/cluster-configuration-for-log-storage-140gb-day/103886 "2017-10-13T13:40:28Z")
Good day, everyone! First time user here. Im trying to configure ELK stack for indexing website logs. In developer environment all works great, but I have problems with production. Our system: 140 Gb of logs/day 50… --- ## [Updating data fields](https://discuss.elastic.co/t/updating-data-fields/103769)
**Author:** [@afonso.ribeiro](https://discuss.elastic.co/u/afonso.ribeiro)\ **Replies:** 5\ **Last updated:** [October 13, 2017, 1:36pm UTC](https://discuss.elastic.co/t/updating-data-fields/103769 "2017-10-13T13:36:26Z")
Hello guys, I want to update a field in elasticsearch but with a condition. In sql it would like something like this: UPDATE table\_name SET column1 = value1 WHERE column1="blabla" and column1="bleble"; Can I do thi… --- ## [About the curator setting about curator.yml and action\_file](https://discuss.elastic.co/t/about-the-curator-setting-about-curator-yml-and-action-file/103811)
**Author:** [@zqc0512](https://discuss.elastic.co/u/zqc0512)\ **Replies:** 7\ **Last updated:** [October 13, 2017, 1:14pm UTC](https://discuss.elastic.co/t/about-the-curator-setting-about-curator-yml-and-action-file/103811 "2017-10-13T13:14:43Z")
about the curator can give me a example how setting the "curator.yml" and the "action\_file" thanks so much. --- ## [Ingest pipeline processor split](https://discuss.elastic.co/t/ingest-pipeline-processor-split/103890)
**Author:** [@Taoufiq\_BOUKHCHA](https://discuss.elastic.co/u/Taoufiq_BOUKHCHA)\ **Replies:** 2\ **Last updated:** [October 13, 2017, 1:09pm UTC](https://discuss.elastic.co/t/ingest-pipeline-processor-split/103890 "2017-10-13T13:09:05Z")
Hi, when I specify the target\_field in the split processor I get the following error: { "error": { "root\_cause": \[ { "type": "parse\_exception", "reason": "processor \[split\] does… --- ## [Mapper parsing exception for dynamic field mapping](https://discuss.elastic.co/t/mapper-parsing-exception-for-dynamic-field-mapping/103899)
**Author:** [@Gabriel\_Tincu](https://discuss.elastic.co/u/Gabriel_Tincu)\ **Replies:** 0\ **Last updated:** [October 13, 2017, 1:08pm UTC](https://discuss.elastic.co/t/mapper-parsing-exception-for-dynamic-field-mapping/103899 "2017-10-13T13:08:22Z")
Hey guys, I'm trying to setup my index and i'm running into an issue concerning empty field values I have a default dynamic template defined for fields starting with en that looks like so: { "english… --- ## [What does the color bar in "Shard Activity" on "Monitoring" page indicate?](https://discuss.elastic.co/t/what-does-the-color-bar-in-shard-activity-on-monitoring-page-indicate/92928)
**Author:** [@yosnoop](https://discuss.elastic.co/u/yosnoop)\ **Replies:** 3\ **Last updated:** [October 13, 2017, 1:03pm UTC](https://discuss.elastic.co/t/what-does-the-color-bar-in-shard-activity-on-monitoring-page-indicate/92928 "2017-10-13T13:03:31Z")
Hi, We are using elasticsearch 5.4 with x-pack (basic subscription). I see there are narrow color bars (yellow and red) in each row of "Shard Activity" section on the "Monitoring" page but can't figure out what that me… --- ## [Issue migrating watchers to latest](https://discuss.elastic.co/t/issue-migrating-watchers-to-latest/103866)
**Author:** [@varun\_kumar2](https://discuss.elastic.co/u/varun_kumar2)\ **Replies:** 3\ **Last updated:** [October 13, 2017, 12:57pm UTC](https://discuss.elastic.co/t/issue-migrating-watchers-to-latest/103866 "2017-10-13T12:57:12Z")
I am trying to migrate my watcher to the latest elastic search Xpack Here is my condition script "condition": { "script": { "inline": "def sf = new SimpleDateFormat('yyyy-MM-dd');ctx.vars.from = sf.parse(new Date())… --- ## [Unable to update X-pack licensing (Elastic version 5.0)](https://discuss.elastic.co/t/unable-to-update-x-pack-licensing-elastic-version-5-0/103804)
**Author:** [@rboorugu](https://discuss.elastic.co/u/rboorugu)\ **Replies:** 2\ **Last updated:** [October 13, 2017, 12:11pm UTC](https://discuss.elastic.co/t/unable-to-update-x-pack-licensing-elastic-version-5-0/103804 "2017-10-13T12:11:29Z")
I issue a command below to update xpack license (security, graph, watcher are disabled - i am just using monitoring) curl -XPUT 'http://localhost:9200/\_xpack/license?acknowledge=true' -H 'Content-Type: application/json'… --- ## [Using Pattern Replace to update field](https://discuss.elastic.co/t/using-pattern-replace-to-update-field/103607)
**Author:** [@Matthew\_Bullock](https://discuss.elastic.co/u/Matthew_Bullock)\ **Replies:** 1\ **Last updated:** [October 13, 2017, 11:45am UTC](https://discuss.elastic.co/t/using-pattern-replace-to-update-field/103607 "2017-10-13T11:45:29Z")
I am trying to use pattern replace to change a number reference to a domain: url -XPUT "http://localhost:9200/timeordered?pretty" -H 'Content-Type: application/json' -d' { "settings": { "index.mapping.ignore\_malfo… --- ## [Performance Monitoring query](https://discuss.elastic.co/t/performance-monitoring-query/103858)
**Author:** [@moriol](https://discuss.elastic.co/u/moriol)\ **Replies:** 3\ **Last updated:** [October 13, 2017, 11:03am UTC](https://discuss.elastic.co/t/performance-monitoring-query/103858 "2017-10-13T11:03:31Z")
I am running a 3 node cluster and basically I want to see how many writes per second I have to my index in ES. I know X-pack is good for this to give me monitoring functionality, but before I install it on my 3 node clus… --- ## [Indexing document using specified index alias](https://discuss.elastic.co/t/indexing-document-using-specified-index-alias/103875)
**Author:** [@Illidan](https://discuss.elastic.co/u/Illidan)\ **Replies:** 1\ **Last updated:** [October 13, 2017, 10:57am UTC](https://discuss.elastic.co/t/indexing-document-using-specified-index-alias/103875 "2017-10-13T10:57:35Z")
Declaimer: I'm a noob in Elasticsearch, so sorry if my question is dumb. As I understand from documentation, initially I should declare alias for my index, and from that point and so on use alias everywhere (both while … --- ## [ES6 RC1 experience](https://discuss.elastic.co/t/es6-rc1-experience/102999)
**Author:** [@frankshad](https://discuss.elastic.co/u/frankshad)\ **Replies:** 1\ **Last updated:** [October 13, 2017, 10:47am UTC](https://discuss.elastic.co/t/es6-rc1-experience/102999 "2017-10-13T10:47:05Z")
So, I took the plunge and installed ES6 RC1 yesterday. Having prepared thoroughly since my rant here 6 months ago, the transition was straightforward. Whatever the merits or otherwise of the update, non-upward-compatible… --- ## [Scripting query](https://discuss.elastic.co/t/scripting-query/103473)
**Author:** [@Noel\_George](https://discuss.elastic.co/u/Noel_George)\ **Replies:** 1\ **Last updated:** [October 13, 2017, 10:33am UTC](https://discuss.elastic.co/t/scripting-query/103473 "2017-10-13T10:33:47Z")
Can someone please explain the purpose of each line match": { "event\_data.SubjectUserName": "LOCAL SERVICE" } --- ## [How to query a nested object with combined AND and OR logic?](https://discuss.elastic.co/t/how-to-query-a-nested-object-with-combined-and-and-or-logic/102805)
**Author:** [@mpskovvang](https://discuss.elastic.co/u/mpskovvang)\ **Replies:** 5\ **Last updated:** [October 13, 2017, 10:24am UTC](https://discuss.elastic.co/t/how-to-query-a-nested-object-with-combined-and-and-or-logic/102805 "2017-10-13T10:24:45Z")
Hi, How should this expression be written as a query: (attributes.id = 14 OR attributes.id = 15) AND (attributes.id = 4843 OR attributes.id = 4859) The nested object looks like this: { "attributes":\[ { … --- ## [How to merge documents in an index while omitting the duplicates](https://discuss.elastic.co/t/how-to-merge-documents-in-an-index-while-omitting-the-duplicates/103000)
**Author:** [@happy0088](https://discuss.elastic.co/u/happy0088)\ **Replies:** 1\ **Last updated:** [October 13, 2017, 10:16am UTC](https://discuss.elastic.co/t/how-to-merge-documents-in-an-index-while-omitting-the-duplicates/103000 "2017-10-13T10:16:41Z")
I need to merge data from one index to another but the duplicate documents should not be overridden in the target index . --- ## [Running multiple nodes in development mode](https://discuss.elastic.co/t/running-multiple-nodes-in-development-mode/103396)
**Author:** [@bamboomy](https://discuss.elastic.co/u/bamboomy)\ **Replies:** 3\ **Last updated:** [October 13, 2017, 9:22am UTC](https://discuss.elastic.co/t/running-multiple-nodes-in-development-mode/103396 "2017-10-13T09:22:58Z")
Dear all, we use elastic for very few users (2 people that understand that the environment can be down), so the setup doesn't require to meet production demands. But we do have some limitations, Our first node, that … --- ## [Painless terms script aggregations](https://discuss.elastic.co/t/painless-terms-script-aggregations/103686)
**Author:** [@knights](https://discuss.elastic.co/u/knights)\ **Replies:** 2\ **Last updated:** [October 13, 2017, 9:11am UTC](https://discuss.elastic.co/t/painless-terms-script-aggregations/103686 "2017-10-13T09:11:52Z")
Hello, everyone. I have a problem regarding a scripted terms aggregation that no longer works since ES 5.X. I need a terms aggregation on two multivalued fields. In groovy, I used to do this : doc\['field1'\].values +… --- ## [X-Pack Reporting: Dashboard with id 'xxx' not found](https://discuss.elastic.co/t/x-pack-reporting-dashboard-with-id-xxx-not-found/102544)
**Author:** [@sidhant](https://discuss.elastic.co/u/sidhant)\ **Replies:** 5\ **Last updated:** [October 13, 2017, 9:01am UTC](https://discuss.elastic.co/t/x-pack-reporting-dashboard-with-id-xxx-not-found/102544 "2017-10-13T09:01:08Z")
Hi, We've recently moved to the ELK stack for logs processing, and are now trying to incorporate the reporting functionality. I have created visualizations and added them to dashboards. But when I try to generate a repo… --- ## [Updating ClusterState](https://discuss.elastic.co/t/updating-clusterstate/103462)
**Author:** [@Utkarsh\_Pyne](https://discuss.elastic.co/u/Utkarsh_Pyne)\ **Replies:** 1\ **Last updated:** [October 13, 2017, 8:33am UTC](https://discuss.elastic.co/t/updating-clusterstate/103462 "2017-10-13T08:33:29Z")
As per this page https://www.elastic.co/guide/en/elasticsearch/reference/current/modules-node.html "elected master node must await acknowledgement of cluster state updates from every node!", which makes me wonder if I ha… --- ## [elasticsearch-Ansible](https://discuss.elastic.co/t/elasticsearch-ansible/103852)
**Author:** [@tulasiram](https://discuss.elastic.co/u/tulasiram)\ **Replies:** 2\ **Last updated:** [October 13, 2017, 8:24am UTC](https://discuss.elastic.co/t/elasticsearch-ansible/103852 "2017-10-13T08:24:54Z")
elasticsearch not started and shows the error which is in SS always. it has automated by Ansible. please provide the solution that where the issue has occured and how to resolve?!. \[ansible@ip-172-31-21-60 ~\]$ sudo serv… --- ## [Snapshot deletion leaves behind empty directories](https://discuss.elastic.co/t/snapshot-deletion-leaves-behind-empty-directories/102943)
**Author:** [@arunachala](https://discuss.elastic.co/u/arunachala)\ **Replies:** 1\ **Last updated:** [October 13, 2017, 8:24am UTC](https://discuss.elastic.co/t/snapshot-deletion-leaves-behind-empty-directories/102943 "2017-10-13T08:24:02Z")
Hi, We are using ES 2.4.1. On deletion of a snapshot, ES leaves behind empty directories under the 'indices' directory within the ES repository, which earlier used to hold the indices data for that snapshot. Is this a … --- ## [Memory consumption in io.netty.buffer.PoolThreadCache](https://discuss.elastic.co/t/memory-consumption-in-io-netty-buffer-poolthreadcache/103254)
**Author:** [@tberne](https://discuss.elastic.co/u/tberne)\ **Replies:** 1\ **Last updated:** [October 13, 2017, 8:21am UTC](https://discuss.elastic.co/t/memory-consumption-in-io-netty-buffer-poolthreadcache/103254 "2017-10-13T08:21:26Z")
Hi guys, I'm facing a large memory consumption in io.netty.buffer.PoolThreadCache. This is happening in our CI environment, where lots of tests are executed, and lots of index / search / delete are performed in ES. I … --- ## [Completion suggester - input as mapping](https://discuss.elastic.co/t/completion-suggester-input-as-mapping/103855)
**Author:** [@jacktuck](https://discuss.elastic.co/u/jacktuck)\ **Replies:** 0\ **Last updated:** [October 13, 2017, 8:19am UTC](https://discuss.elastic.co/t/completion-suggester-input-as-mapping/103855 "2017-10-13T08:19:08Z")
In the docs, there is an example: PUT music { "mappings": { "song" : { "properties" : { "suggest" : { "type" : "completion" }, … --- ## [Watcher index action with dynamic doc\_id value](https://discuss.elastic.co/t/watcher-index-action-with-dynamic-doc-id-value/103787)
**Author:** [@acastellano](https://discuss.elastic.co/u/acastellano)\ **Replies:** 1\ **Last updated:** [October 13, 2017, 8:05am UTC](https://discuss.elastic.co/t/watcher-index-action-with-dynamic-doc-id-value/103787 "2017-10-13T08:05:02Z")
I'm doing an index action in my watch's Actions block for docs from a \_doc payload (see code below). Index action works fine, however, I have duplicate docs and haven't figured out how to evaluate the "doc\_id" value in … --- ## [Get some doubt about x-pack](https://discuss.elastic.co/t/get-some-doubt-about-x-pack/103849)
**Author:** [@liangyi](https://discuss.elastic.co/u/liangyi)\ **Replies:** 0\ **Last updated:** [October 13, 2017, 7:50am UTC](https://discuss.elastic.co/t/get-some-doubt-about-x-pack/103849 "2017-10-13T07:50:36Z")
Currently how i can secure my follow two steps first: startup elasticsearch(username: elastic, password: changeme), logstash(username:elastic, password: 12345), kibana(usename:elastic, password:12345) second: change th… --- ## [Elastic Stack 6 Beta: Docker-Images + User/PW](https://discuss.elastic.co/t/elastic-stack-6-beta-docker-images-user-pw/103844)
**Author:** [@la3mmchen](https://discuss.elastic.co/u/la3mmchen)\ **Replies:** 0\ **Last updated:** [October 13, 2017, 7:25am UTC](https://discuss.elastic.co/t/elastic-stack-6-beta-docker-images-user-pw/103844 "2017-10-13T07:25:44Z")
Hi, according to the docu (1) there should be still the user elastic:changeme for the docker image. Obviously, it isn't there any more: \[elasticsearch@3b31c58a02db ~\]$ curl elastic:changeme@localhost:9200/\_cluster/hea… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1920) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1922)