# Elasticsearch

**URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1948

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 1949

---

## [ML - Learning patterns](https://discuss.elastic.co/t/ml-learning-patterns/100062)

<div class="topic-metadata">

**Author:** [@P\_Charpentier](https://discuss.elastic.co/u/P_Charpentier)\
**Replies:** 5\
**Last updated:** [September 15, 2017, 2:45pm UTC](https://discuss.elastic.co/t/ml-learning-patterns/100062 "2017-09-15T14:45:18Z")

</div>

Hello, I tried Machine Learning with some metrics. I saw some stranges things. For example, I tried with an average response time metric like this : \[image\] I have a classic pattern during the day and a noisy pattern…

---

## [Stream List Output Formatting in Script (for use in Watcher actions)](https://discuss.elastic.co/t/stream-list-output-formatting-in-script-for-use-in-watcher-actions/100587)

<div class="topic-metadata">

**Author:** [@damunk](https://discuss.elastic.co/u/damunk)\
**Replies:** 1\
**Last updated:** [September 15, 2017, 2:10pm UTC](https://discuss.elastic.co/t/stream-list-output-formatting-in-script-for-use-in-watcher-actions/100587 "2017-09-15T14:10:08Z")

</div>

I've been trying to develop a script that can be used for a number different watcher tasks. I came across this this post and it was quite helpful in showing me how to map the output of two aggregations. However, I don't …

---

## [Curator is not deleting the index?](https://discuss.elastic.co/t/curator-is-not-deleting-the-index/100688)

<div class="topic-metadata">

**Author:** [@vikas\_gopal](https://discuss.elastic.co/u/vikas_gopal)\
**Replies:** 1\
**Last updated:** [September 15, 2017, 1:09pm UTC](https://discuss.elastic.co/t/curator-is-not-deleting-the-index/100688 "2017-09-15T13:09:00Z")

</div>

Hi Experts, I have installed curator and I want to delete 1 day old index so with the help of document I have created action.yml file Action.yml actions: 1: action: delete\_indices description: \>- Dele…

---

## [Memory leak in elasticsearch java rest client version 5.5](https://discuss.elastic.co/t/memory-leak-in-elasticsearch-java-rest-client-version-5-5/99551)

<div class="topic-metadata">

**Author:** [@gauravgarg](https://discuss.elastic.co/u/gauravgarg)\
**Replies:** 4\
**Last updated:** [September 15, 2017, 12:32pm UTC](https://discuss.elastic.co/t/memory-leak-in-elasticsearch-java-rest-client-version-5-5/99551 "2017-09-15T12:32:08Z")

</div>

Hi Team, I am having memory leak in elasticsearch java rest client. since last 5-6 days i am analysing memory leak. i see there is leak in es rest client version 5.5 my client code is following: \*\*public void Ind…

---

## [Elasticsearch 5.6.0, Unknown setting score while updating with ctx script](https://discuss.elastic.co/t/elasticsearch-5-6-0-unknown-setting-score-while-updating-with-ctx-script/100671)

<div class="topic-metadata">

**Author:** [@rinu](https://discuss.elastic.co/u/rinu)\
**Replies:** 1\
**Last updated:** [September 15, 2017, 12:19pm UTC](https://discuss.elastic.co/t/elasticsearch-5-6-0-unknown-setting-score-while-updating-with-ctx-script/100671 "2017-09-15T12:19:55Z")

</div>

On 5.6.0, when updating a field with ctx.\_source.field via inline script using high-level-rest-client, I'm getting unknown source setting error. It should work fine as I'm using "ctx.\_source" as per documentation, not "\_…

---

## [ESRally - data.json.bz2](https://discuss.elastic.co/t/esrally-data-json-bz2/100553)

<div class="topic-metadata">

**Author:** [@sanketshinde](https://discuss.elastic.co/u/sanketshinde)\
**Replies:** 2\
**Last updated:** [September 15, 2017, 11:05am UTC](https://discuss.elastic.co/t/esrally-data-json-bz2/100553 "2017-09-15T11:05:04Z")

</div>

I am writing dummy data file- fakeDate.json using a python script docGen.py as a data file for a custom rally track. On trying to execute the rally I get the following error. \[ERROR\] Cannot race. ('Could not execute ben…

---

## [Strange problem with curator](https://discuss.elastic.co/t/strange-problem-with-curator/100319)

<div class="topic-metadata">

**Author:** [@sbampa](https://discuss.elastic.co/u/sbampa)\
**Replies:** 13\
**Last updated:** [September 15, 2017, 10:36am UTC](https://discuss.elastic.co/t/strange-problem-with-curator/100319 "2017-09-15T10:36:36Z")

</div>

I all, i have a problem with the index deletion in ES made by curator. I'm indexing my AS logs with the timestamp of the logs through logstash: Logstash config: input { beats { port =\> "5043" } } filter { grok …

---

## [Baseline calculation algorithm](https://discuss.elastic.co/t/baseline-calculation-algorithm/100384)

<div class="topic-metadata">

**Author:** [@Kbb](https://discuss.elastic.co/u/Kbb)\
**Replies:** 2\
**Last updated:** [September 15, 2017, 9:37am UTC](https://discuss.elastic.co/t/baseline-calculation-algorithm/100384 "2017-09-15T09:37:24Z")

</div>

Could you please explane me the baseline calculation algorithm. I have a few questions. Is that something like mean value plus and minus standard deviation multiplied by some coefficient (3, for example)? Which ty…

---

## [Need right student name from 1 million indexed queries](https://discuss.elastic.co/t/need-right-student-name-from-1-million-indexed-queries/100665)

<div class="topic-metadata">

**Author:** [@prem\_panther](https://discuss.elastic.co/u/prem_panther)\
**Replies:** 0\
**Last updated:** [September 15, 2017, 9:35am UTC](https://discuss.elastic.co/t/need-right-student-name-from-1-million-indexed-queries/100665 "2017-09-15T09:35:25Z")

</div>

I have indexed 15 years data that has 1 million indexed queries, which has students information like name, date of birth, address. If I tried to parse the report i.e pdf of the student its show duplicates like multiple s…

---

## [IntelliJ IDEA 2017.2.3 x64 run testCase fail](https://discuss.elastic.co/t/intellij-idea-2017-2-3-x64-run-testcase-fail/100625)

<div class="topic-metadata">

**Author:** [@sshling](https://discuss.elastic.co/u/sshling)\
**Replies:** 2\
**Last updated:** [September 15, 2017, 9:23am UTC](https://discuss.elastic.co/t/intellij-idea-2017-2-3-x64-run-testcase-fail/100625 "2017-09-15T09:23:51Z")

</div>

Elasticsearch version (bin/elasticsearch --version): 5.4.3 Plugins installed: none JVM version (java -version): 1.8.144 OS version (uname -a if on a Unix-like system): windows 7 Description of the problem including …

---

## [About user authentication: action \[indices:data/read/search\] is unauthorized for user](https://discuss.elastic.co/t/about-user-authentication-action-indices-data-read-search-is-unauthorized-for-user/100506)

<div class="topic-metadata">

**Author:** [@Chu\_Jun](https://discuss.elastic.co/u/Chu_Jun)\
**Replies:** 3\
**Last updated:** [September 15, 2017, 8:48am UTC](https://discuss.elastic.co/t/about-user-authentication-action-indices-data-read-search-is-unauthorized-for-user/100506 "2017-09-15T08:48:15Z")

</div>

Hi, I used kibana -\> management -\> (security) user to created an user 'test' with role 'kibana\_user', but I won't able to see any index and perform GET indexname/\_search for all the index when I logged in as user test. …

---

## [How to make an index as the destination index to store the data](https://discuss.elastic.co/t/how-to-make-an-index-as-the-destination-index-to-store-the-data/100001)

<div class="topic-metadata">

**Author:** [@fazi347](https://discuss.elastic.co/u/fazi347)\
**Replies:** 1\
**Last updated:** [September 15, 2017, 8:28am UTC](https://discuss.elastic.co/t/how-to-make-an-index-as-the-destination-index-to-store-the-data/100001 "2017-09-15T08:28:09Z")

</div>

I am using elasticsearch and kibana for displaying the logs. When i use logstash-\* index the logs are disapying in kibana but when i am using the index which i created is not displaying any data. Is there any option to …

---

## [Non-prefix-based Completion Suggester](https://discuss.elastic.co/t/non-prefix-based-completion-suggester/100443)

<div class="topic-metadata">

**Author:** [@milenkozahovic](https://discuss.elastic.co/u/milenkozahovic)\
**Replies:** 2\
**Last updated:** [September 15, 2017, 7:55am UTC](https://discuss.elastic.co/t/non-prefix-based-completion-suggester/100443 "2017-09-15T07:55:06Z")

</div>

I have my mapping type as follows: { "mappings": { "book": { "properties": { "title": { "type": "completion" } } } } } and index a data: {"create": {"\_index": "library…

---

## [How to assign \_id field to a document field on create Or fetch the highest document id in a index](https://discuss.elastic.co/t/how-to-assign--id-field-to-a-document-field-on-create-or-fetch-the-highest-document-id-in-a-index/100561)

<div class="topic-metadata">

**Author:** [@Paddy\_Mahadeva](https://discuss.elastic.co/u/Paddy_Mahadeva)\
**Replies:** 3\
**Last updated:** [September 15, 2017, 7:54am UTC](https://discuss.elastic.co/t/how-to-assign--id-field-to-a-document-field-on-create-or-fetch-the-highest-document-id-in-a-index/100561 "2017-09-15T07:54:50Z")

</div>

Hi, Is there a way for me to assign the \_id that is created when I create a document in Elasticsearch directly to a field in my document when its getting created? I am currently trying to find the max \_id of the docume…

---

## [Completion suggester for search terms instead of documents](https://discuss.elastic.co/t/completion-suggester-for-search-terms-instead-of-documents/100250)

<div class="topic-metadata">

**Author:** [@uprise10](https://discuss.elastic.co/u/uprise10)\
**Replies:** 1\
**Last updated:** [September 15, 2017, 7:50am UTC](https://discuss.elastic.co/t/completion-suggester-for-search-terms-instead-of-documents/100250 "2017-09-15T07:50:13Z")

</div>

When using the Completion Suggester, the results you get are regular documents. I get that :slight\_smile: However, we'd like to receive search phrase suggestions instead of direct results (the documents). To achieve thi…

---

## [Don't run curator (curator.exceptions.ConfigurationError: Unable to parse YAML file. Error)](https://discuss.elastic.co/t/dont-run-curator-curator-exceptions-configurationerror-unable-to-parse-yaml-file-error/100487)

<div class="topic-metadata">

**Author:** [@rchumarin](https://discuss.elastic.co/u/rchumarin)\
**Replies:** 1\
**Last updated:** [September 15, 2017, 6:59am UTC](https://discuss.elastic.co/t/dont-run-curator-curator-exceptions-configurationerror-unable-to-parse-yaml-file-error/100487 "2017-09-15T06:59:02Z")

</div>

Hello. action.yml: --- actions: 1: action: delete\_indices description: \>- Delete indices older than {{ elk.elasticsearch.age\_of\_index }} days (based on index name) options: ignore\_empty\_list: True disable\_actio…

---

## [Apt repo throwing 404 errors](https://discuss.elastic.co/t/apt-repo-throwing-404-errors/100552)

<div class="topic-metadata">

**Author:** [@quicksilvercapps](https://discuss.elastic.co/u/quicksilvercapps)\
**Replies:** 3\
**Last updated:** [September 15, 2017, 5:50am UTC](https://discuss.elastic.co/t/apt-repo-throwing-404-errors/100552 "2017-09-15T05:50:36Z")

</div>

Apt is throwing a 404 error on the 5.x repo. My source file contains deb https://artifacts.elastic.co/packages/5.x/apt jessie main stable The log output shows. Hit http://security.debian.org jessie/updates InRelease …

---

## [ES not showing all logs](https://discuss.elastic.co/t/es-not-showing-all-logs/100636)

<div class="topic-metadata">

**Author:** [@amitshar04](https://discuss.elastic.co/u/amitshar04)\
**Replies:** 0\
**Last updated:** [September 15, 2017, 5:37am UTC](https://discuss.elastic.co/t/es-not-showing-all-logs/100636 "2017-09-15T05:37:20Z")

</div>

Hey guys, i am using Graylog 1.3, with Elasticsearch 1.3 version from last 6 months. everything was fine till 3 days back. i can only see last 3 days in Graylog console. it should be six months. Elastic search also sh…

---

## [Question about Token Management API](https://discuss.elastic.co/t/question-about-token-management-api/100438)

<div class="topic-metadata">

**Author:** [@Ong](https://discuss.elastic.co/u/Ong)\
**Replies:** 1\
**Last updated:** [September 15, 2017, 4:40am UTC](https://discuss.elastic.co/t/question-about-token-management-api/100438 "2017-09-15T04:40:55Z")

</div>

I am using X-Pack 5.5.2 and have integrated them into Elasticsearch and Kibana. I am trying out the Security API for a use case, which is to restrict the search results depending on the user's role. The user will first …

---

## [Got response code '401' contacting Elasticsearch at URL](https://discuss.elastic.co/t/got-response-code-401-contacting-elasticsearch-at-url/100548)

<div class="topic-metadata">

**Author:** [@Maekee](https://discuss.elastic.co/u/Maekee)\
**Replies:** 2\
**Last updated:** [September 15, 2017, 4:35am UTC](https://discuss.elastic.co/t/got-response-code-401-contacting-elasticsearch-at-url/100548 "2017-09-15T04:35:43Z")

</div>

Hi, Probably something easy, but i'll try anyway. I had a working ELK-machine running 5.5.2, then i decided to upgrade to 5.6.0 and install X-pack at the same time. I did the following: upgraded ES, installed X-pack …

---

## [Authenticated user inherits anonymous users roles?](https://discuss.elastic.co/t/authenticated-user-inherits-anonymous-users-roles/100613)

<div class="topic-metadata">

**Author:** [@Andy\_Hamilton](https://discuss.elastic.co/u/Andy_Hamilton)\
**Replies:** 1\
**Last updated:** [September 15, 2017, 4:32am UTC](https://discuss.elastic.co/t/authenticated-user-inherits-anonymous-users-roles/100613 "2017-09-15T04:32:51Z")

</div>

We rolled out X-Pack to our Elasticsearch cluster after users were already actively using it. In order to lessen the burden on our end users, we approached the introduction of X-Pack as follows: Enable the anonymous us…

---

## [Node Management APIs](https://discuss.elastic.co/t/node-management-apis/100262)

<div class="topic-metadata">

**Author:** [@rnataraja](https://discuss.elastic.co/u/rnataraja)\
**Replies:** 9\
**Last updated:** [September 15, 2017, 2:27am UTC](https://discuss.elastic.co/t/node-management-apis/100262 "2017-09-15T02:27:58Z")

</div>

Are there APIs to add and remove Nodes from Elastic Search cluster? Or modifying and restarting elasticsearch is the only way?

---

## [Create a new field using two separate fields to produce geo-point](https://discuss.elastic.co/t/create-a-new-field-using-two-separate-fields-to-produce-geo-point/99785)

<div class="topic-metadata">

**Author:** [@layeghy](https://discuss.elastic.co/u/layeghy)\
**Replies:** 3\
**Last updated:** [September 14, 2017, 1:07am UTC](https://discuss.elastic.co/t/create-a-new-field-using-two-separate-fields-to-produce-geo-point/99785 "2017-09-14T01:07:20Z")

</div>

I am using Elasticsearch and Kibana to visualize network traffic which includes Latitude and Longitude coordinates for IP addresses in a separate filed both of type "number" As far as I could find in the documentations …

---

## [No handler found for uri \[/my\_store/products/\] and method \[PUT\]](https://discuss.elastic.co/t/no-handler-found-for-uri-my-store-products-and-method-put/100623)

<div class="topic-metadata">

**Author:** [@saliormoon](https://discuss.elastic.co/u/saliormoon)\
**Replies:** 1\
**Last updated:** [September 15, 2017, 1:45am UTC](https://discuss.elastic.co/t/no-handler-found-for-uri-my-store-products-and-method-put/100623 "2017-09-15T01:45:06Z")

</div>

Elasticsearch version: 5.5.2 OS: Linux When I create a index named my\_store of products type with the command like this: curl -XPUT 'http://10.62.179.32:9200/my\_store/products/' But it throws a error as follow: No …

---

## [Java API - what is the correct way of updating the settings](https://discuss.elastic.co/t/java-api-what-is-the-correct-way-of-updating-the-settings/100455)

<div class="topic-metadata">

**Author:** [@AntonQUT](https://discuss.elastic.co/u/AntonQUT)\
**Replies:** 2\
**Last updated:** [September 15, 2017, 12:01am UTC](https://discuss.elastic.co/t/java-api-what-is-the-correct-way-of-updating-the-settings/100455 "2017-09-15T00:01:42Z")

</div>

I am using the java API version 5.3 and want to know the non-deprecated way of updating the index settings. Currently I use: final UpdateSettingsResponse response = \_myClient.admin().indices().prepareUpdateSettings…

---

## ["sort" on multiple indices with a missing field](https://discuss.elastic.co/t/sort-on-multiple-indices-with-a-missing-field/100400)

<div class="topic-metadata">

**Author:** [@jimyoo](https://discuss.elastic.co/u/jimyoo)\
**Replies:** 2\
**Last updated:** [September 14, 2017, 11:54pm UTC](https://discuss.elastic.co/t/sort-on-multiple-indices-with-a-missing-field/100400 "2017-09-14T23:54:24Z")

</div>

Hi, I see queries on multiple indices with "sort" with a missing field causes an exception (query and exception are attached). And, the same queries on individual index (either with or w/o a missing field) are fine tr…

---

## [Discover: Request to Elasticsearch failed](https://discuss.elastic.co/t/discover-request-to-elasticsearch-failed/100604)

<div class="topic-metadata">

**Author:** [@sudi\_2611](https://discuss.elastic.co/u/sudi_2611)\
**Replies:** 1\
**Last updated:** [September 14, 2017, 9:50pm UTC](https://discuss.elastic.co/t/discover-request-to-elasticsearch-failed/100604 "2017-09-14T21:50:36Z")

</div>

I am using latest version of ELK 5.6.1 and i get the below mentioned error in discover tab in Kibana GUI Discover: Request to Elasticsearch failed: {"error":{"root\_cause":\[\],"type":"search\_phase\_execution\_exception","re…

---

## [Struggling here, grateful for any help](https://discuss.elastic.co/t/struggling-here-grateful-for-any-help/100123)

<div class="topic-metadata">

**Author:** [@lutonmad](https://discuss.elastic.co/u/lutonmad)\
**Replies:** 5\
**Last updated:** [September 14, 2017, 9:03pm UTC](https://discuss.elastic.co/t/struggling-here-grateful-for-any-help/100123 "2017-09-14T21:03:26Z")

</div>

Hi there, So I'm probably confusing myself here but I am trying to import logs from our Cloudflare instance into Elasticsearch, via a file that has many json entries and looks like the following (this is just a single l…

---

## [How to only get exactly partial-matched result?](https://discuss.elastic.co/t/how-to-only-get-exactly-partial-matched-result/100608)

<div class="topic-metadata">

**Author:** [@Bing\_Qiu](https://discuss.elastic.co/u/Bing_Qiu)\
**Replies:** 0\
**Last updated:** [September 14, 2017, 8:59pm UTC](https://discuss.elastic.co/t/how-to-only-get-exactly-partial-matched-result/100608 "2017-09-14T20:59:40Z")

</div>

We are using N-Gram tokenizer for the full\_name, when we search "/\_search?q=full\_name:BIANA", we get the results which not exactly matches the "BIANA", results examples are as below. Is there a way we can only return res…

---

## [6.0.0-beta2 Reindex from remote getProxySelector AccessControlException](https://discuss.elastic.co/t/6-0-0-beta2-reindex-from-remote-getproxyselector-accesscontrolexception/99864)

<div class="topic-metadata">

**Author:** [@loren](https://discuss.elastic.co/u/loren)\
**Replies:** 3\
**Last updated:** [September 14, 2017, 8:56pm UTC](https://discuss.elastic.co/t/6-0-0-beta2-reindex-from-remote-getproxyselector-accesscontrolexception/99864 "2017-09-14T20:56:14Z")

</div>

I'm not sure why the JSM is complaining when I try to reindex to a local 6.0.0-beta2 instance from a remote cluster that I access via an SSH tunnel on another localhost port. I have this in my elasticsearch.yaml file: r…

[Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1947)

[Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1949)
