# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1922 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1923 --- ## [Creating my own QueryBuilder](https://discuss.elastic.co/t/creating-my-own-querybuilder/103302)
**Author:** [@jpmantuano](https://discuss.elastic.co/u/jpmantuano)\ **Replies:** 2\ **Last updated:** [October 13, 2017, 7:17am UTC](https://discuss.elastic.co/t/creating-my-own-querybuilder/103302 "2017-10-13T07:17:24Z")
I'm trying to integrate a 3rd party plugin into Elasticsearch. The query request I made including a 3rd party plugin is working properly via kibana. Then I tried to create my own QueryBuilder using the Elasticsearch's j… --- ## [@timestamp and timestamp value differ](https://discuss.elastic.co/t/timestamp-and-timestamp-value-differ/103838)
**Author:** [@Nishant\_Hurnekar](https://discuss.elastic.co/u/Nishant_Hurnekar)\ **Replies:** 0\ **Last updated:** [October 13, 2017, 7:07am UTC](https://discuss.elastic.co/t/timestamp-and-timestamp-value-differ/103838 "2017-10-13T07:07:43Z")
Hi, Today morning, Our logstash server got crashed due to which around 5 hours logs got missed out in the elastic search. So, for recovery purpose we have consolidated all logs into single file and parsed through fileb… --- ## [Search specific field in elastic search](https://discuss.elastic.co/t/search-specific-field-in-elastic-search/103807)
**Author:** [@Chanpiseth\_Ros](https://discuss.elastic.co/u/Chanpiseth_Ros)\ **Replies:** 1\ **Last updated:** [October 13, 2017, 6:45am UTC](https://discuss.elastic.co/t/search-specific-field-in-elastic-search/103807 "2017-10-13T06:45:54Z")
Hi everyone, i want o search records with specific fields in elastic search like records below: "person": \[ { "id": 1 "name": "jame" }, { "id": 2, "name": "EVP" }, { "id": 3, "name": "GP" }, { "id":… --- ## [Single user can only see own dashboard and only view permission](https://discuss.elastic.co/t/single-user-can-only-see-own-dashboard-and-only-view-permission/103833)
**Author:** [@Shilpi\_Rani](https://discuss.elastic.co/u/Shilpi_Rani)\ **Replies:** 0\ **Last updated:** [October 13, 2017, 6:35am UTC](https://discuss.elastic.co/t/single-user-can-only-see-own-dashboard-and-only-view-permission/103833 "2017-10-13T06:35:40Z")
Single user can only open xyz(example) dashboard not any other dashboard (or other dashboards should not visible to him ).This user will only have read permission not write or delete permission on dashbord and don't see … --- ## [How to know LDAP connection successfully established](https://discuss.elastic.co/t/how-to-know-ldap-connection-successfully-established/103173)
**Author:** [@ajit](https://discuss.elastic.co/u/ajit)\ **Replies:** 1\ **Last updated:** [October 13, 2017, 6:12am UTC](https://discuss.elastic.co/t/how-to-know-ldap-connection-successfully-established/103173 "2017-10-13T06:12:56Z")
I have implemented x pack security. Also I have done some changes in elasticsearch.yml file for LDAP security. How to know LDAP security has enabled or not. I am trying to login with existing user name and password but n… --- ## [Ealstic search plugin installation from in house maven repository](https://discuss.elastic.co/t/ealstic-search-plugin-installation-from-in-house-maven-repository/103706)
**Author:** [@thinkingisall](https://discuss.elastic.co/u/thinkingisall)\ **Replies:** 3\ **Last updated:** [October 13, 2017, 6:04am UTC](https://discuss.elastic.co/t/ealstic-search-plugin-installation-from-in-house-maven-repository/103706 "2017-10-13T06:04:29Z")
I am new here and also to elastic search. We are installing elastic search for one of our vendor product. Our servers don’t have access to internet. When installing the plugin it is going to maven repo public site. Can… --- ## [Help with limited result after terms results](https://discuss.elastic.co/t/help-with-limited-result-after-terms-results/103813)
**Author:** [@truongdqse03303](https://discuss.elastic.co/u/truongdqse03303)\ **Replies:** 0\ **Last updated:** [October 13, 2017, 3:08am UTC](https://discuss.elastic.co/t/help-with-limited-result-after-terms-results/103813 "2017-10-13T03:08:48Z")
Hi experts Here is my query { "size": 0, "query": { "match\_all": {} }, "aggs": { "content\_level": { "terms": { "field": "content\_level" }, … --- ## [Dedup Aggregator](https://discuss.elastic.co/t/dedup-aggregator/103709)
**Author:** [@Deb](https://discuss.elastic.co/u/Deb)\ **Replies:** 1\ **Last updated:** [October 13, 2017, 4:19am UTC](https://discuss.elastic.co/t/dedup-aggregator/103709 "2017-10-13T04:19:38Z")
I have multiple versions of docs. Timestamp is used in \_docIds so that when searched over a time range I get matching docs and I keep just the latests doc from the result set. Now I need to do aggregation so that it can… --- ## [Tailing Elasticsearch changelog](https://discuss.elastic.co/t/tailing-elasticsearch-changelog/103802)
**Author:** [@Vladimir\_Zaytsev](https://discuss.elastic.co/u/Vladimir_Zaytsev)\ **Replies:** 3\ **Last updated:** [October 13, 2017, 4:15am UTC](https://discuss.elastic.co/t/tailing-elasticsearch-changelog/103802 "2017-10-13T04:15:08Z")
Hi, We have Elasticsearch cluster storing documents which contain various counters (for example, number of session in a given hour). These documents are created with some initial counts and later updated using scripted … --- ## [Query vs index](https://discuss.elastic.co/t/query-vs-index/103632)
**Author:** [@cxbarbosa](https://discuss.elastic.co/u/cxbarbosa)\ **Replies:** 3\ **Last updated:** [October 13, 2017, 12:31am UTC](https://discuss.elastic.co/t/query-vs-index/103632 "2017-10-13T00:31:44Z")
This is probably an easy question so I apologize for this post,but there is just one thing I'm not understanding: What does the querying do? It seems all of the mapping and filtering takes place in creating the index. … --- ## [Stack overflow in 5.6.2 after migration from 2.4.1](https://discuss.elastic.co/t/stack-overflow-in-5-6-2-after-migration-from-2-4-1/103797)
**Author:** [@dmdklb](https://discuss.elastic.co/u/dmdklb)\ **Replies:** 0\ **Last updated:** [October 12, 2017, 9:52pm UTC](https://discuss.elastic.co/t/stack-overflow-in-5-6-2-after-migration-from-2-4-1/103797 "2017-10-12T21:52:18Z")
Hello I am migrating an ELK stack from 2.4.1 to 5.6.2 I have installed ES 5.6.2 and restored from a snapshot I have installed Kibana 5.6.2 and did a little bit of clicking around -very quickly, elasticsearch crashed w… --- ## [Native Sort Pugin / Delimited Payload Token Filter throws "Cannot itererate twice"](https://discuss.elastic.co/t/native-sort-pugin-delimited-payload-token-filter-throws-cannot-itererate-twice/102843)
**Author:** [@mrkamel](https://discuss.elastic.co/u/mrkamel)\ **Replies:** 1\ **Last updated:** [October 12, 2017, 9:47pm UTC](https://discuss.elastic.co/t/native-sort-pugin-delimited-payload-token-filter-throws-cannot-itererate-twice/102843 "2017-10-12T21:47:47Z")
Hi, i've written a native (java) sort plugin (extending AbstractDoubleSearchScript) which uses data derived from a delimited payload token filter, such that the plugin uses custom scores indexed via the payload token fi… --- ## [Relevance score in the output of EsTap](https://discuss.elastic.co/t/relevance-score-in-the-output-of-estap/103790)
**Author:** [@RetiredViking](https://discuss.elastic.co/u/RetiredViking)\ **Replies:** 0\ **Last updated:** [October 12, 2017, 8:32pm UTC](https://discuss.elastic.co/t/relevance-score-in-the-output-of-estap/103790 "2017-10-12T20:32:17Z")
I am using EsTap from Cascading to query (read) documents from index. It works fine, but it seems I cannot get a relevance score. Any idea of how can I access it? Is it at all possible? --- ## [Maximum aggregation response limit](https://discuss.elastic.co/t/maximum-aggregation-response-limit/103779)
**Author:** [@kedarsdixit](https://discuss.elastic.co/u/kedarsdixit)\ **Replies:** 4\ **Last updated:** [October 12, 2017, 7:41pm UTC](https://discuss.elastic.co/t/maximum-aggregation-response-limit/103779 "2017-10-12T19:41:53Z")
hi, Do we have any limit on fetching the aggregations limit, like search hits limit which is default set to 10000 ? If so, We use scroll for scrolling over the response, Do we have anything similar to this ? Many Than… --- ## [Multiple grok pattern from ingest pipeline works but can't see the data in kibana](https://discuss.elastic.co/t/multiple-grok-pattern-from-ingest-pipeline-works-but-cant-see-the-data-in-kibana/103582)
**Author:** [@hungl99](https://discuss.elastic.co/u/hungl99)\ **Replies:** 6\ **Last updated:** [October 12, 2017, 7:27pm UTC](https://discuss.elastic.co/t/multiple-grok-pattern-from-ingest-pipeline-works-but-cant-see-the-data-in-kibana/103582 "2017-10-12T19:27:15Z")
Managed to get simulation works with multiple patterns but can't see the data in kibana. I added two new fields (log.controller & log.controllerMessage to index template. index pattern in kibana shows the 2 new fields b… --- ## [(logstash-\*) Unable to fetch mapping. Do you have indices matching the pattern?](https://discuss.elastic.co/t/logstash-unable-to-fetch-mapping-do-you-have-indices-matching-the-pattern/103784)
**Author:** [@poldozer](https://discuss.elastic.co/u/poldozer)\ **Replies:** 0\ **Last updated:** [October 12, 2017, 7:00pm UTC](https://discuss.elastic.co/t/logstash-unable-to-fetch-mapping-do-you-have-indices-matching-the-pattern/103784 "2017-10-12T19:00:47Z")
Hello, i am new in using ELK, i am having problem with logstash i use to get the unable to fetch mapping. however, i successfully installed the filebeat and packetbeat to my kibana. i hope someone can help me to my ELK… --- ## [Swap vs -XX:+AlwaysPreTouch](https://discuss.elastic.co/t/swap-vs-xx-alwayspretouch/103620)
**Author:** [@abhijat](https://discuss.elastic.co/u/abhijat)\ **Replies:** 1\ **Last updated:** [October 12, 2017, 6:14pm UTC](https://discuss.elastic.co/t/swap-vs-xx-alwayspretouch/103620 "2017-10-12T18:14:52Z")
For newer elasticsearch versions... I guess v5.0 and above... I see that we have jvm.options file. In that file we have the JVM flag -XX:+AlwaysPreTouch set by default. As I understand, this flag tells the OS to map the… --- ## [Docker ELK Stack, changed compose, now shards missing](https://discuss.elastic.co/t/docker-elk-stack-changed-compose-now-shards-missing/103429)
**Author:** [@Brandon\_Martin](https://discuss.elastic.co/u/Brandon_Martin)\ **Replies:** 3\ **Last updated:** [October 12, 2017, 5:26pm UTC](https://discuss.elastic.co/t/docker-elk-stack-changed-compose-now-shards-missing/103429 "2017-10-12T17:26:20Z")
I'm using elasticsearch docker containers for my nodes. I began experimenting with Scripts, and needed to add a volume. Here's what my docker-compose now contains elasticsearch: build: elasticsearch/ container\_… --- ## [How to use lambda expression in Painless?](https://discuss.elastic.co/t/how-to-use-lambda-expression-in-painless/103758)
**Author:** [@klahnakoski](https://discuss.elastic.co/u/klahnakoski)\ **Replies:** 1\ **Last updated:** [October 12, 2017, 5:03pm UTC](https://discuss.elastic.co/t/how-to-use-lambda-expression-in-painless/103758 "2017-10-12T17:03:14Z")
I am attempting to define-and-call a lambda function. This technique works in Java, but I have not been able to do this from Painless: { "from": 0, "query": {"bool": {"must": \[{"match\_all": {}}\]}}, "script\_… --- ## [Curator logging weirdness](https://discuss.elastic.co/t/curator-logging-weirdness/103751)
**Author:** [@elasticus](https://discuss.elastic.co/u/elasticus)\ **Replies:** 3\ **Last updated:** [October 12, 2017, 3:22pm UTC](https://discuss.elastic.co/t/curator-logging-weirdness/103751 "2017-10-12T15:22:46Z")
Curator logs 'no actionable items in list' as an ERROR - I don't see this as an 'error' and would like to suppress it? Also - Curator logs the index it will reallocate routing (hot to warm) on a dry-run - useful - but n… --- ## [Modify elastic.yml file in kubernetes pod](https://discuss.elastic.co/t/modify-elastic-yml-file-in-kubernetes-pod/103612)
**Author:** [@akpt](https://discuss.elastic.co/u/akpt)\ **Replies:** 1\ **Last updated:** [October 12, 2017, 3:15pm UTC](https://discuss.elastic.co/t/modify-elastic-yml-file-in-kubernetes-pod/103612 "2017-10-12T15:15:53Z")
Hello! I have an elasticsearch cluster running on minikube. When I ssh into one of the elasticsearch pods, I can see that the elasticsearch.yml file is very empty/has almost no configs set. \[elasticsearch@es-0 config\]$ … --- ## [Formatting of dates returned by query](https://discuss.elastic.co/t/formatting-of-dates-returned-by-query/103746)
**Author:** [@markpavey](https://discuss.elastic.co/u/markpavey)\ **Replies:** 2\ **Last updated:** [October 12, 2017, 3:08pm UTC](https://discuss.elastic.co/t/formatting-of-dates-returned-by-query/103746 "2017-10-12T15:08:54Z")
The Elasticsearch documentation about the date data type says: Multiple formats can be specified by separating them with || as a separator. Each format will be tried in turn until a matching format is found. The first … --- ## [Contacto en español](https://discuss.elastic.co/t/contacto-en-espanol/103739)
**Author:** [@kikarodaima](https://discuss.elastic.co/u/kikarodaima)\ **Replies:** 4\ **Last updated:** [October 12, 2017, 2:51pm UTC](https://discuss.elastic.co/t/contacto-en-espanol/103739 "2017-10-12T14:51:38Z")
Hola. Estoy interesado en analizar si puedo implementar Elastic en la organización para la que trabajo. Tenemos 1 millón de usuarios en 15 países de América. Fui contactado por alguien de Elastic, pero esta persona no … --- ## [Question about ElasticSearch Fielddata configuration](https://discuss.elastic.co/t/question-about-elasticsearch-fielddata-configuration/103745)
**Author:** [@steelwings](https://discuss.elastic.co/u/steelwings)\ **Replies:** 0\ **Last updated:** [October 12, 2017, 2:17pm UTC](https://discuss.elastic.co/t/question-about-elasticsearch-fielddata-configuration/103745 "2017-10-12T14:17:46Z")
I'm tuning the fielddata cache of an Elasticsearch cluster by following the wiki Limiting Memory Usage. I found that the fielddata circuit breaker (indices.breaker.fielddata.limit) was not working as explained. I was exp… --- ## [Hardware - Recommendations](https://discuss.elastic.co/t/hardware-recommendations/103386)
**Author:** [@Yann](https://discuss.elastic.co/u/Yann)\ **Replies:** 4\ **Last updated:** [October 12, 2017, 2:12pm UTC](https://discuss.elastic.co/t/hardware-recommendations/103386 "2017-10-12T14:12:59Z")
Hello, I want to migrate ELK on a VM to a more powerful physical machine and I would need recommendations. Currently, the VM includes 8 vCPU 2.3 GHz and 32 GB RAM. We process about 6 GB of data per day and we wish to … --- ## [Prefix with multi\_match](https://discuss.elastic.co/t/prefix-with-multi-match/103606)
**Author:** [@Paddy\_Mahadeva](https://discuss.elastic.co/u/Paddy_Mahadeva)\ **Replies:** 1\ **Last updated:** [October 12, 2017, 1:28pm UTC](https://discuss.elastic.co/t/prefix-with-multi-match/103606 "2017-10-12T13:28:57Z")
Hi, I am running the below search query on my index { "\_source": "false", "query": { "bool": { "must": \[ { "multi\_match": { "fields": \["email","name", "company", "phone"\],… --- ## [Watcher sub-aggregation count alert](https://discuss.elastic.co/t/watcher-sub-aggregation-count-alert/103619)
**Author:** [@theflakes](https://discuss.elastic.co/u/theflakes)\ **Replies:** 2\ **Last updated:** [October 12, 2017, 1:21pm UTC](https://discuss.elastic.co/t/watcher-sub-aggregation-count-alert/103619 "2017-10-12T13:21:06Z")
I can create Watcher alerts on aggregations but what I'm struggling with is how do I create a Watcher alert on sub-aggs where the number of sub-aggs in the one top level agg bucket is greater than, say, 5? Thanks --- ## [Watcher - show high-bytes by IP](https://discuss.elastic.co/t/watcher-show-high-bytes-by-ip/103413)
**Author:** [@Cryo21](https://discuss.elastic.co/u/Cryo21)\ **Replies:** 4\ **Last updated:** [October 12, 2017, 1:19pm UTC](https://discuss.elastic.co/t/watcher-show-high-bytes-by-ip/103413 "2017-10-12T13:19:01Z")
I was wondering if anyone may be able to lead me in the right direction... I am setting up a Watcher alert that will compare a numeric field to see if it is greater than 10000 (example used in sample). And if it is then… --- ## [Nest BulkAll indexing duplicates](https://discuss.elastic.co/t/nest-bulkall-indexing-duplicates/103729)
**Author:** [@mapaux](https://discuss.elastic.co/u/mapaux)\ **Replies:** 0\ **Last updated:** [October 12, 2017, 1:16pm UTC](https://discuss.elastic.co/t/nest-bulkall-indexing-duplicates/103729 "2017-10-12T13:16:33Z")
Hi all, I'm indexing a bunch of documents using Nest and the BulkAll method like that: var waitHandle = new CountdownEvent(1); var bulkAll = \_client.BulkAll(elementList, b =\> b .Index(indexName) .BackOffRetries(15) … --- ## [Date field Sorting in ElasticSearch](https://discuss.elastic.co/t/date-field-sorting-in-elasticsearch/103604)
**Author:** [@Paddy\_Mahadeva](https://discuss.elastic.co/u/Paddy_Mahadeva)\ **Replies:** 1\ **Last updated:** [October 12, 2017, 1:11pm UTC](https://discuss.elastic.co/t/date-field-sorting-in-elasticsearch/103604 "2017-10-12T13:11:30Z")
Hi, I have an index & type in elasticsearch which has a field mapping , "data\_received\_on": { "type": "date", "format": "YYYY-MM-DD" }, I need to get the newest 10 records and i have about 5000 records that is sp… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1921) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1923)