# Elasticsearch

**URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1941

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 1942

---

## [Curator: delay deleting shrunk indices](https://discuss.elastic.co/t/curator-delay-deleting-shrunk-indices/101437)

<div class="topic-metadata">

**Author:** [@dandrestor](https://discuss.elastic.co/u/dandrestor)\
**Replies:** 3\
**Last updated:** [September 23, 2017, 4:32pm UTC](https://discuss.elastic.co/t/curator-delay-deleting-shrunk-indices/101437 "2017-09-23T16:32:51Z")

</div>

Hello, I am trying to implement the rollover pattern, as described in this excellent blog post, using curator, and I'm having some trouble with the shrinking part. I would like to: Shrink the index, and create the sh…

---

## [Cannot aggregate long string](https://discuss.elastic.co/t/cannot-aggregate-long-string/101552)

<div class="topic-metadata">

**Author:** [@thlai15](https://discuss.elastic.co/u/thlai15)\
**Replies:** 1\
**Last updated:** [September 23, 2017, 4:21pm UTC](https://discuss.elastic.co/t/cannot-aggregate-long-string/101552 "2017-09-23T16:21:07Z")

</div>

I have an implementation where I need to aggregate strings of potentially long length. It appears not working in Elasticsearch. I ran the following example in Elasticsearch 5.5.1 Create the following two indexes: { "n…

---

## [I have a lot of index, but the show does not come out](https://discuss.elastic.co/t/i-have-a-lot-of-index-but-the-show-does-not-come-out/101452)

<div class="topic-metadata">

**Author:** [@xuhaibo](https://discuss.elastic.co/u/xuhaibo)\
**Replies:** 4\
**Last updated:** [September 23, 2017, 3:22pm UTC](https://discuss.elastic.co/t/i-have-a-lot-of-index-but-the-show-does-not-come-out/101452 "2017-09-23T15:22:10Z")

</div>

In the kibana monitoring module The show has 230 index, but there is no one in the list\[QQ图片20170922165807\]

---

## [Elasticsearch aggregation issue with "Filter"](https://discuss.elastic.co/t/elasticsearch-aggregation-issue-with-filter/101568)

<div class="topic-metadata">

**Author:** [@yesu](https://discuss.elastic.co/u/yesu)\
**Replies:** 1\
**Last updated:** [September 23, 2017, 2:08pm UTC](https://discuss.elastic.co/t/elasticsearch-aggregation-issue-with-filter/101568 "2017-09-23T14:08:33Z")

</div>

Elasticsearch aggregation issue with "Filter", With "Filter" missing field and alphabetical sorting with lower and uppercase not working Below is the sol for sorting. PUT my\_index1 { "settings": { "analysis": …

---

## [Installation does not bind to 9200](https://discuss.elastic.co/t/installation-does-not-bind-to-9200/101225)

<div class="topic-metadata">

**Author:** [@rhalbheer](https://discuss.elastic.co/u/rhalbheer)\
**Replies:** 10\
**Last updated:** [September 23, 2017, 11:56am UTC](https://discuss.elastic.co/t/installation-does-not-bind-to-9200/101225 "2017-09-23T11:56:21Z")

</div>

I am really sorry but I am completely lost. I spent more than a day now to get Elastiscsearch running on an RPI but failed miserably. Goal is to have the whole ELK stack there at the end. List item I installed a plain…

---

## [Multiple Shards Stuck in INIT State](https://discuss.elastic.co/t/multiple-shards-stuck-in-init-state/101557)

<div class="topic-metadata">

**Author:** [@crickes](https://discuss.elastic.co/u/crickes)\
**Replies:** 4\
**Last updated:** [September 23, 2017, 10:14am UTC](https://discuss.elastic.co/t/multiple-shards-stuck-in-init-state/101557 "2017-09-23T10:14:45Z")

</div>

I have been battling with one of my clusters for a couple of days now. I had multiple shards stuck in INIT for several hours, and if I'd let it it would have been days. ES saw these shards as being in progress, but they …

---

## [Conflicts of OS versions](https://discuss.elastic.co/t/conflicts-of-os-versions/101556)

<div class="topic-metadata">

**Author:** [@Balamurali](https://discuss.elastic.co/u/Balamurali)\
**Replies:** 1\
**Last updated:** [September 23, 2017, 8:26am UTC](https://discuss.elastic.co/t/conflicts-of-os-versions/101556 "2017-09-23T08:26:10Z")

</div>

HI all, We are using elasticsearch 1.3.7 cluster , we are working hardly on upgrading es version. We are need to add more nodes to cluster for some high performance urgently. now all ES nodes are running in centos6.7…

---

## [Load not evenly distributed](https://discuss.elastic.co/t/load-not-evenly-distributed/101343)

<div class="topic-metadata">

**Author:** [@jannesvh](https://discuss.elastic.co/u/jannesvh)\
**Replies:** 19\
**Last updated:** [September 23, 2017, 7:52am UTC](https://discuss.elastic.co/t/load-not-evenly-distributed/101343 "2017-09-23T07:52:04Z")

</div>

Hi, I have a 3+ node setup, with all nodes having all roles. 1 node gets up to 90% cpu and frequent garbage collection 2nd node is a bit less but reasonable and then nodes 3+ are doing nearly nothing. If I stop and sta…

---

## [Elasticsearch-rest-client-5.6.1.jar org.apache.http.ContentTooLongException: entity content is too long \[217056451\] for the configured buffer limit \[104857600\]](https://discuss.elastic.co/t/elasticsearch-rest-client-5-6-1-jar-org-apache-http-contenttoolongexception-entity-content-is-too-long-217056451-for-the-configured-buffer-limit-104857600/101387)

<div class="topic-metadata">

**Author:** [@iti](https://discuss.elastic.co/u/iti)\
**Replies:** 6\
**Last updated:** [September 22, 2017, 8:25pm UTC](https://discuss.elastic.co/t/elasticsearch-rest-client-5-6-1-jar-org-apache-http-contenttoolongexception-entity-content-is-too-long-217056451-for-the-configured-buffer-limit-104857600/101387 "2017-09-22T20:25:55Z")

</div>

I am using REST low level api to query the ES 5.4.0 or 5.5.2 server. and got the following exceptions: Anyway to change the bufferLimitBytes? 12:34:50,453 INFO \[stdout\] (default task-2) org.apache.http.ContentTooLongE…

---

## [Dots in field names on Elasticsearch 5.5](https://discuss.elastic.co/t/dots-in-field-names-on-elasticsearch-5-5/101530)

<div class="topic-metadata">

**Author:** [@dvaldivia](https://discuss.elastic.co/u/dvaldivia)\
**Replies:** 1\
**Last updated:** [September 22, 2017, 7:02pm UTC](https://discuss.elastic.co/t/dots-in-field-names-on-elasticsearch-5-5/101530 "2017-09-22T19:02:32Z")

</div>

Hi, I'm getting the "dot not allowed in field name" exception, on a 5.5 cluster on AWS (elasticsearch service), the odd thing is that this doesn't happen on my local ES running on a docker container, I'd assume this is …

---

## [\_score of and "OR" query is invalid?](https://discuss.elastic.co/t/-score-of-and-or-query-is-invalid/98732)

<div class="topic-metadata">

**Author:** [@chrisribe](https://discuss.elastic.co/u/chrisribe)\
**Replies:** 4\
**Last updated:** [September 22, 2017, 6:53pm UTC](https://discuss.elastic.co/t/-score-of-and-or-query-is-invalid/98732 "2017-09-22T18:53:41Z")

</div>

Hi, Pulling my hair out here. I created a query on a string field and want to get documents that have the most matches by order desc. Query: exists:ids AND (ids:5 || 17 || 21 || 27 || 38 || 41 || 43 || 46 || 47 || 77…

---

## [Slow performance compare to v1.7 when using 5.x](https://discuss.elastic.co/t/slow-performance-compare-to-v1-7-when-using-5-x/101506)

<div class="topic-metadata">

**Author:** [@itplayer](https://discuss.elastic.co/u/itplayer)\
**Replies:** 2\
**Last updated:** [September 22, 2017, 3:08pm UTC](https://discuss.elastic.co/t/slow-performance-compare-to-v1-7-when-using-5-x/101506 "2017-09-22T15:08:02Z")

</div>

I found an issue that might be the root cause Slow performance on HDD #16676 Can anyone help to explain what is the reason behind the index.translog.durability was added since v2.x? Does v1.7 default behavior equals…

---

## [NEST - Empty ReverseNested](https://discuss.elastic.co/t/nest-empty-reversenested/101503)

<div class="topic-metadata">

**Author:** [@Ben\_G](https://discuss.elastic.co/u/Ben_G)\
**Replies:** 1\
**Last updated:** [September 22, 2017, 2:35pm UTC](https://discuss.elastic.co/t/nest-empty-reversenested/101503 "2017-09-22T14:35:03Z")

</div>

im trying to create the following reversenested aggregate:- "attributetotal": { "reverse\_nested": {} } which works fine in cerebro, with the following:- .ReverseNested("attributecount", r =\> r) but it ge…

---

## [ElasticSearch doesn't start due to insufficient space](https://discuss.elastic.co/t/elasticsearch-doesnt-start-due-to-insufficient-space/101473)

<div class="topic-metadata">

**Author:** [@Lahari](https://discuss.elastic.co/u/Lahari)\
**Replies:** 3\
**Last updated:** [September 22, 2017, 2:34pm UTC](https://discuss.elastic.co/t/elasticsearch-doesnt-start-due-to-insufficient-space/101473 "2017-09-22T14:34:49Z")

</div>

We are using ElasticSearch to store logs from around 15 servers in AWS environment. The disk space in ElasticSearch is running out and ElasticSearch isn't starting due to insufficient space. We are using X-pack on Kibana…

---

## [Query\_string with punctuation and wildcard does not work](https://discuss.elastic.co/t/query-string-with-punctuation-and-wildcard-does-not-work/101504)

<div class="topic-metadata">

**Author:** [@telebh](https://discuss.elastic.co/u/telebh)\
**Replies:** 0\
**Last updated:** [September 22, 2017, 2:24pm UTC](https://discuss.elastic.co/t/query-string-with-punctuation-and-wildcard-does-not-work/101504 "2017-09-22T14:24:59Z")

</div>

Hi there, I have a custom analyzer on field "authlast" that replaces punctuation with space. so when search for name "saint-" i am able to get results, but when search for "saint-\*" i get no results? any idea? how quer…

---

## [Reindexing Elasticsearch index with parent and child relationship](https://discuss.elastic.co/t/reindexing-elasticsearch-index-with-parent-and-child-relationship/101331)

<div class="topic-metadata">

**Author:** [@benjes](https://discuss.elastic.co/u/benjes)\
**Replies:** 2\
**Last updated:** [September 22, 2017, 1:55pm UTC](https://discuss.elastic.co/t/reindexing-elasticsearch-index-with-parent-and-child-relationship/101331 "2017-09-22T13:55:34Z")

</div>

Hi we currently have a 'message' that can have a link to a 'parent' message. E.g. a reply would have the original message as the parent\_id. PUT { "mappings": { "message": { "properties": { "subj…

---

## [Unable to redirect to dashboard , visualize or discover when using nginx as reverse proxy for custom realm protected Elasticsearch](https://discuss.elastic.co/t/unable-to-redirect-to-dashboard-visualize-or-discover-when-using-nginx-as-reverse-proxy-for-custom-realm-protected-elasticsearch/101492)

<div class="topic-metadata">

**Author:** [@sumit\_monga](https://discuss.elastic.co/u/sumit_monga)\
**Replies:** 0\
**Last updated:** [September 22, 2017, 1:41pm UTC](https://discuss.elastic.co/t/unable-to-redirect-to-dashboard-visualize-or-discover-when-using-nginx-as-reverse-proxy-for-custom-realm-protected-elasticsearch/101492 "2017-09-22T13:41:37Z")

</div>

Hi All, I have a usecase where there is custom realm in X-Pack that is used to authenticate and authorize users based on their configuration in third party application. This requires sending request headers Tenant and A…

---

## [Connecting Elasticsearch with Dynatrace](https://discuss.elastic.co/t/connecting-elasticsearch-with-dynatrace/101497)

<div class="topic-metadata">

**Author:** [@vits23](https://discuss.elastic.co/u/vits23)\
**Replies:** 0\
**Last updated:** [September 22, 2017, 1:50pm UTC](https://discuss.elastic.co/t/connecting-elasticsearch-with-dynatrace/101497 "2017-09-22T13:50:45Z")

</div>

I am trying to index the Dynatrace data in Elasticsearch. I have configured PureLytics in Dynatrace and I have added dynamic template in Kibana. How to push data in Elasticsearch from Dynatrace? How to pull data from D…

---

## [Term query with special character](https://discuss.elastic.co/t/term-query-with-special-character/101485)

<div class="topic-metadata">

**Author:** [@Moumita\_Mandal](https://discuss.elastic.co/u/Moumita_Mandal)\
**Replies:** 0\
**Last updated:** [September 22, 2017, 12:45pm UTC](https://discuss.elastic.co/t/term-query-with-special-character/101485 "2017-09-22T12:45:50Z")

</div>

Hello, I am using Elasticsearch version "5.3.2". I am trying to write a query that will match exact text/string. The query looks like this: { query: { bool: { must: { match: { userEmail: "abc@xyz.com" } }, fi…

---

## [Integrate MongoDB with elasticsearch mongo-connector](https://discuss.elastic.co/t/integrate-mongodb-with-elasticsearch-mongo-connector/101471)

<div class="topic-metadata">

**Author:** [@vaibhav2903](https://discuss.elastic.co/u/vaibhav2903)\
**Replies:** 0\
**Last updated:** [September 22, 2017, 10:31am UTC](https://discuss.elastic.co/t/integrate-mongodb-with-elasticsearch-mongo-connector/101471 "2017-09-22T10:31:03Z")

</div>

I am trying to integrate MongoDB with elasticsearch using mongo-connector. I type the following command. I am using elastic2\_doc\_manager sudo mongo-connector -m localhost:27017 -t localhost:9200 -d elastic2\_doc\_manager …

---

## [How many ES nodes will be needed to handle 400GB/Day Data](https://discuss.elastic.co/t/how-many-es-nodes-will-be-needed-to-handle-400gb-day-data/101458)

<div class="topic-metadata">

**Author:** [@vikas\_gopal](https://discuss.elastic.co/u/vikas_gopal)\
**Replies:** 3\
**Last updated:** [September 22, 2017, 11:44am UTC](https://discuss.elastic.co/t/how-many-es-nodes-will-be-needed-to-handle-400gb-day-data/101458 "2017-09-22T11:44:30Z")

</div>

Hi Experts, I know this is not an easy question to answer but still any idea can help here . Curious to know how many ES nodes will be sufficient to handle 400 GB/day data volume . I have gone through this blog(https:/…

---

## [Unable to send slack notification through x-pack on ELK 5.5 - Need Help](https://discuss.elastic.co/t/unable-to-send-slack-notification-through-x-pack-on-elk-5-5-need-help/99670)

<div class="topic-metadata">

**Author:** [@sandy007](https://discuss.elastic.co/u/sandy007)\
**Replies:** 2\
**Last updated:** [September 22, 2017, 11:07am UTC](https://discuss.elastic.co/t/unable-to-send-slack-notification-through-x-pack-on-elk-5-5-need-help/99670 "2017-09-22T11:07:12Z")

</div>

Hello, I have been trying to send x-pack slack notification but keep failing - i amnot sure what wrong I am doing here … below is my x-pack slack configuration in elasticsearch.yml file. Kindly Help me to troubleshoot a…

---

## [Terms Aggregation with include filter](https://discuss.elastic.co/t/terms-aggregation-with-include-filter/50976)

<div class="topic-metadata">

**Author:** [@ayushsangani](https://discuss.elastic.co/u/ayushsangani)\
**Replies:** 9\
**Last updated:** [September 22, 2017, 10:27am UTC](https://discuss.elastic.co/t/terms-aggregation-with-include-filter/50976 "2017-09-22T10:27:31Z")

</div>

Hey all, ES version: 2.3.2 (recently upgraded) I'm doing terms aggregations on not\_analyzed string field using include filter. https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-bucke…

---

## [Is there any regex can create index alias based on weekly/monthly/yearly?](https://discuss.elastic.co/t/is-there-any-regex-can-create-index-alias-based-on-weekly-monthly-yearly/101466)

<div class="topic-metadata">

**Author:** [@Robin\_Guo](https://discuss.elastic.co/u/Robin_Guo)\
**Replies:** 1\
**Last updated:** [September 22, 2017, 9:56am UTC](https://discuss.elastic.co/t/is-there-any-regex-can-create-index-alias-based-on-weekly-monthly-yearly/101466 "2017-09-22T09:56:05Z")

</div>

I want to create different date index alias. Is there any regex can create index alias based on weekly/monthly/yearly? but the below restful API doesn't work. could anyone help on this? POST /\_aliases { "actions": …

---

## [Sync Data from ES to MySQL](https://discuss.elastic.co/t/sync-data-from-es-to-mysql/101370)

<div class="topic-metadata">

**Author:** [@faoc](https://discuss.elastic.co/u/faoc)\
**Replies:** 6\
**Last updated:** [September 22, 2017, 9:55am UTC](https://discuss.elastic.co/t/sync-data-from-es-to-mysql/101370 "2017-09-22T09:55:10Z")

</div>

i'm using elasticsearch to record a lot of messages. I want to create a ETL process with this ES data and create a DW in MySQL. How can i get data from ES, create a ETL process and insert it into MySQL DB? Any tool for t…

---

## [Sorting by 2 fields failing](https://discuss.elastic.co/t/sorting-by-2-fields-failing/101464)

<div class="topic-metadata">

**Author:** [@Declan\_Mungovan](https://discuss.elastic.co/u/Declan_Mungovan)\
**Replies:** 0\
**Last updated:** [September 22, 2017, 9:51am UTC](https://discuss.elastic.co/t/sorting-by-2-fields-failing/101464 "2017-09-22T09:51:49Z")

</div>

I'm using a Nest SearchDescriptor to retrieve different document types from an index. The documents are: contact and invoice. Currently the search descriptor sorts on two different fields. I've simplified the search desc…

---

## [X-pack installation warning](https://discuss.elastic.co/t/x-pack-installation-warning/101454)

<div class="topic-metadata">

**Author:** [@abhisek](https://discuss.elastic.co/u/abhisek)\
**Replies:** 2\
**Last updated:** [September 22, 2017, 9:06am UTC](https://discuss.elastic.co/t/x-pack-installation-warning/101454 "2017-09-22T09:06:20Z")

</div>

Hi, I'm using elasticsearch and kibana (V-5.4.3) and while installing X-Pack (V-5.4.3) on elasticsearch, i'm getting warning : \[2017-09-22T07:13:26,151\]\[WARN \]\[o.e.b.ElasticsearchUncaughtExceptionHandler\] \[\] uncaught…

---

## [\[URGENT\] Handling min\_doc\_count with adjacency matrix?](https://discuss.elastic.co/t/urgent-handling-min-doc-count-with-adjacency-matrix/101377)

<div class="topic-metadata">

**Author:** [@gbatra17](https://discuss.elastic.co/u/gbatra17)\
**Replies:** 1\
**Last updated:** [September 22, 2017, 8:57am UTC](https://discuss.elastic.co/t/urgent-handling-min-doc-count-with-adjacency-matrix/101377 "2017-09-22T08:57:46Z")

</div>

Hi all - We're a group of college students doing a project on visualizing Twitter data using Elastic Search service (we're ingesting tweets from Twitter Streaming API, cleaning them and sending it to Elastic Search). We…

---

## [High CPU Utilzation in ES Cluster 5.6](https://discuss.elastic.co/t/high-cpu-utilzation-in-es-cluster-5-6/101449)

<div class="topic-metadata">

**Author:** [@Aswin\_Sathish](https://discuss.elastic.co/u/Aswin_Sathish)\
**Replies:** 0\
**Last updated:** [September 22, 2017, 8:48am UTC](https://discuss.elastic.co/t/high-cpu-utilzation-in-es-cluster-5-6/101449 "2017-09-22T08:48:47Z")

</div>

Hi We have a 3 node master-data ES cluster . We face random high cpu utilization in random nodes though there is no much of activity happening in ES. This high cpu utilization and Load stays forever until the node is r…

---

## [Ideal Shard number of Single node](https://discuss.elastic.co/t/ideal-shard-number-of-single-node/101435)

<div class="topic-metadata">

**Author:** [@AAanton](https://discuss.elastic.co/u/AAanton)\
**Replies:** 5\
**Last updated:** [September 22, 2017, 8:17am UTC](https://discuss.elastic.co/t/ideal-shard-number-of-single-node/101435 "2017-09-22T08:17:27Z")

</div>

Hello... I want to use a single node for my indexes what is the difference of multiple shards and only one shard given single node. and is it better to use multiple shards than one shard? Any comments will be helpful…

[Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1940)

[Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1942)
