# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1987 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1988 --- ## [Summarized timeseries data creation](https://discuss.elastic.co/t/summarized-timeseries-data-creation/96050)
**Author:** [@ginger](https://discuss.elastic.co/u/ginger)\ **Replies:** 1\ **Last updated:** [August 7, 2017, 2:08pm UTC](https://discuss.elastic.co/t/summarized-timeseries-data-creation/96050 "2017-08-07T14:08:15Z")
Hi, All. I have read the following topic: I wonder If any plan now? Or any workable thought about this? Thanks in advance. --- ## [How to create daily rotation index with python-elasticsearch](https://discuss.elastic.co/t/how-to-create-daily-rotation-index-with-python-elasticsearch/96113)
**Author:** [@JiGe](https://discuss.elastic.co/u/JiGe)\ **Replies:** 1\ **Last updated:** [August 7, 2017, 1:56pm UTC](https://discuss.elastic.co/t/how-to-create-daily-rotation-index-with-python-elasticsearch/96113 "2017-08-07T13:56:37Z")
Just like logstash index, which could be rotated daily automatically. How to achieve this with python-elasticsearch? create daily rotation index and search from the index. --- ## [Problem with multiple match query](https://discuss.elastic.co/t/problem-with-multiple-match-query/95713)
**Author:** [@floBoth](https://discuss.elastic.co/u/floBoth)\ **Replies:** 6\ **Last updated:** [August 7, 2017, 1:40pm UTC](https://discuss.elastic.co/t/problem-with-multiple-match-query/95713 "2017-08-07T13:40:30Z")
Hi everyone ! I think my problem is pretty simple to resolve, I want to do that (in head plugin) : POST /\_all/logs/\_search {“query”:{“match”:{“action”:“reject” OR “action”:“drop” AND “src\_group”:“blacklist”}},“aggreg… --- ## [Syslog with logstash mapping](https://discuss.elastic.co/t/syslog-with-logstash-mapping/95516)
**Author:** [@talial](https://discuss.elastic.co/u/talial)\ **Replies:** 4\ **Last updated:** [August 7, 2017, 12:57pm UTC](https://discuss.elastic.co/t/syslog-with-logstash-mapping/95516 "2017-08-07T12:57:09Z")
Hi I have logstash that get the syslog from other machines. The conf.d file is like: input { tcp { port =\> 514 type =\> syslog } udp { port =\> 514 type =\> syslog } } filter { if \[type\] == "sy… --- ## [Heap space issues](https://discuss.elastic.co/t/heap-space-issues/96047)
**Author:** [@Phani\_Nadiminti](https://discuss.elastic.co/u/Phani_Nadiminti)\ **Replies:** 2\ **Last updated:** [August 7, 2017, 12:06pm UTC](https://discuss.elastic.co/t/heap-space-issues/96047 "2017-08-07T12:06:19Z")
Hi I am using ES 1.5.2 version . Is shard allocation causes heap space issues ? can you please explain me what will happen if shards allocation disabled , es node restart and shards allocation enabled again. in this nod… --- ## ["Failed to compute BIC gain" error from Machine Learning](https://discuss.elastic.co/t/failed-to-compute-bic-gain-error-from-machine-learning/94942)
**Author:** [@Tommy\_Monk](https://discuss.elastic.co/u/Tommy_Monk)\ **Replies:** 3\ **Last updated:** [August 7, 2017, 12:04pm UTC](https://discuss.elastic.co/t/failed-to-compute-bic-gain-error-from-machine-learning/94942 "2017-08-07T12:04:12Z")
Elasticsearch version: 5.5.0 Plugins installed: \[x-pack\] JVM version: 1.8.0\_141 OS version: Ubuntu Server 16.04 We’re trialing the machine learning capabilities of Elasticsearch in Kibana. Our test job json is here. … --- ## [Problems using Boolean expressions with minimum\_should\_match in query\_string query](https://discuss.elastic.co/t/problems-using-boolean-expressions-with-minimum-should-match-in-query-string-query/96095)
**Author:** [@jonben](https://discuss.elastic.co/u/jonben)\ **Replies:** 0\ **Last updated:** [August 7, 2017, 11:53am UTC](https://discuss.elastic.co/t/problems-using-boolean-expressions-with-minimum-should-match-in-query-string-query/96095 "2017-08-07T11:53:16Z")
I get the impression that Boolean operators are ignored/not working properly in a query\_string query when using minimum\_should\_match. Is this a bug, or is Boolean operators not to be used in query\_string queries together… --- ## [Analyzer \[not\_analyzed\] not found for field \[institution\]](https://discuss.elastic.co/t/analyzer-not-analyzed-not-found-for-field-institution/96068)
**Author:** [@virk](https://discuss.elastic.co/u/virk)\ **Replies:** 1\ **Last updated:** [August 7, 2017, 10:34am UTC](https://discuss.elastic.co/t/analyzer-not-analyzed-not-found-for-field-institution/96068 "2017-08-07T10:34:20Z")
I upgraded ES from 1 to 5.\* i am getting this error. Anyone can help me please? {"error":{"root\_cause":\[{"type":"mapper\_parsing\_exception","reason":"analyzer \[not\_analyzed\] not found for field \[institution\]"}\],"type":"… --- ## [Is there a bounding box query for point in geo\_shape? / How to check point and envelop overlap each other?](https://discuss.elastic.co/t/is-there-a-bounding-box-query-for-point-in-geo-shape-how-to-check-point-and-envelop-overlap-each-other/96075)
**Author:** [@Red](https://discuss.elastic.co/u/Red)\ **Replies:** 0\ **Last updated:** [August 7, 2017, 9:36am UTC](https://discuss.elastic.co/t/is-there-a-bounding-box-query-for-point-in-geo-shape-how-to-check-point-and-envelop-overlap-each-other/96075 "2017-08-07T09:36:21Z")
how to check two point overlap? this is the point indexed. "coordinates" : \[106.486, 29.490\] here is my query : "shape": { "type": "envelope", "coordinates" : \[\[106.486… --- ## [Difference between type and \_type](https://discuss.elastic.co/t/difference-between-type-and--type/96058)
**Author:** [@DFrant](https://discuss.elastic.co/u/DFrant)\ **Replies:** 4\ **Last updated:** [August 7, 2017, 9:50am UTC](https://discuss.elastic.co/t/difference-between-type-and--type/96058 "2017-08-07T09:50:31Z")
Hello, I would like to know what’s the difference between type and \_type and how to define it? Thanks. --- ## [Index (ingest attachment) update in elastic search or storing multipe document in same index](https://discuss.elastic.co/t/index-ingest-attachment-update-in-elastic-search-or-storing-multipe-document-in-same-index/95887)
**Author:** [@gauravgarg](https://discuss.elastic.co/u/gauravgarg)\ **Replies:** 13\ **Last updated:** [August 7, 2017, 9:41am UTC](https://discuss.elastic.co/t/index-ingest-attachment-update-in-elastic-search-or-storing-multipe-document-in-same-index/95887 "2017-08-07T09:41:32Z")
Hi Team, I am new to elasticseaarch. I am using ingest attachment for indexing pdf, excel… etc… document. I am doing it with rest client. Is it possible i can update index. I mean to say that when i do first POST requ… --- ## [How to query object array?](https://discuss.elastic.co/t/how-to-query-object-array/95961)
**Author:** [@Red](https://discuss.elastic.co/u/Red)\ **Replies:** 4\ **Last updated:** [August 7, 2017, 9:37am UTC](https://discuss.elastic.co/t/how-to-query-object-array/95961 "2017-08-07T09:37:42Z")
here is the document { "2": { "20170804" :{ "7": \[{"loc":\[1, 2\], "ts":1}\], "5": \[{"loc":\[1, 2\], "ts":1}\] } } } how to query ts field? --- ## [Completion Suggester Foreign Language Accents Greek](https://discuss.elastic.co/t/completion-suggester-foreign-language-accents-greek/96051)
**Author:** [@Bjorn\_Grambow](https://discuss.elastic.co/u/Bjorn_Grambow)\ **Replies:** 1\ **Last updated:** [August 7, 2017, 9:29am UTC](https://discuss.elastic.co/t/completion-suggester-foreign-language-accents-greek/96051 "2017-08-07T09:29:08Z")
Hi, I am trying to use the Completion suggester with Greek language. Unfortunately I have problems with accents like ά. I’ve tried a few ways. One was simply to set the greek analyzer in the mapping the other a lowerca… --- ## [How to change the default amount of shards and replicas of indices?](https://discuss.elastic.co/t/how-to-change-the-default-amount-of-shards-and-replicas-of-indices/95989)
**Author:** [@KeithTt](https://discuss.elastic.co/u/KeithTt)\ **Replies:** 5\ **Last updated:** [August 7, 2017, 9:07am UTC](https://discuss.elastic.co/t/how-to-change-the-default-amount-of-shards-and-replicas-of-indices/95989 "2017-08-07T09:07:06Z")
ELK version: 5.5.1 I referred to this page https://www.elastic.co/guide/en/elasticsearch/reference/5.5/indices-update-settings.html and changed a index’s number of replica, and it worked, but how to add it to the confi… --- ## [Machine learning API Disabled](https://discuss.elastic.co/t/machine-learning-api-disabled/93605)
**Author:** [@sanketshinde](https://discuss.elastic.co/u/sanketshinde)\ **Replies:** 7\ **Last updated:** [August 7, 2017, 8:41am UTC](https://discuss.elastic.co/t/machine-learning-api-disabled/93605 "2017-08-07T08:41:03Z")
hello Team, I installed the x-pack for a trial period of 30 days. Although there is still a week left before the free license expires, the machine learning APIs are reported to be disabled every time I start ElasticSea… --- ## [How to delete 90days old data indices](https://discuss.elastic.co/t/how-to-delete-90days-old-data-indices/96053)
**Author:** [@Jonesthomas](https://discuss.elastic.co/u/Jonesthomas)\ **Replies:** 6\ **Last updated:** [August 7, 2017, 8:34am UTC](https://discuss.elastic.co/t/how-to-delete-90days-old-data-indices/96053 "2017-08-07T08:34:46Z")
ELK is running in Ubuntu 16.04 machine,How to delete 90days old data in elasticsearch automatically . and My ELK version (5.5.0) --- ## [Sorting nested array per match criteria](https://discuss.elastic.co/t/sorting-nested-array-per-match-criteria/96060)
**Author:** [@icebreaker](https://discuss.elastic.co/u/icebreaker)\ **Replies:** 0\ **Last updated:** [August 7, 2017, 8:27am UTC](https://discuss.elastic.co/t/sorting-nested-array-per-match-criteria/96060 "2017-08-07T08:27:55Z")
Hi everyone, Let’s suppose I have the following document: { "name": "Audi", "photos": \[{ "color": "blue ", "url": "www.audi.com/blue.jpg" }, { "url": "www.audi.com/bl… --- ## [One ES node load average is very high, how to troubleshoot](https://discuss.elastic.co/t/one-es-node-load-average-is-very-high-how-to-troubleshoot/96022)
**Author:** [@KeithTt](https://discuss.elastic.co/u/KeithTt)\ **Replies:** 1\ **Last updated:** [August 7, 2017, 8:05am UTC](https://discuss.elastic.co/t/one-es-node-load-average-is-very-high-how-to-troubleshoot/96022 "2017-08-07T08:05:24Z")
ELK version: 5.5.1 There are 5 nodes in my ES cluster, the other 4 nodes are normal, and configurations of the nodes are same... --- ## [Why the JVM heap of ES is always about 50%?](https://discuss.elastic.co/t/why-the-jvm-heap-of-es-is-always-about-50/94755)
**Author:** [@KeithTt](https://discuss.elastic.co/u/KeithTt)\ **Replies:** 16\ **Last updated:** [August 7, 2017, 8:02am UTC](https://discuss.elastic.co/t/why-the-jvm-heap-of-es-is-always-about-50/94755 "2017-08-07T08:02:01Z")
ES version: 5.5.1 Is this a coincidence or something else? --- ## [Search with "or" condition](https://discuss.elastic.co/t/search-with-or-condition/95888)
**Author:** [@denis.peshkov](https://discuss.elastic.co/u/denis.peshkov)\ **Replies:** 2\ **Last updated:** [August 7, 2017, 7:29am UTC](https://discuss.elastic.co/t/search-with-or-condition/95888 "2017-08-07T07:29:53Z")
Hi guys, can’t understood how to do search by few fields, but with or condition: GET /my\_index/my\_type/\_search { "query": { "bool": { "filter": { "bool": { "should": { … --- ## [Elasticsearch.yml settings list](https://discuss.elastic.co/t/elasticsearch-yml-settings-list/95975)
**Author:** [@mruthyu](https://discuss.elastic.co/u/mruthyu)\ **Replies:** 2\ **Last updated:** [August 7, 2017, 6:47am UTC](https://discuss.elastic.co/t/elasticsearch-yml-settings-list/95975 "2017-08-07T06:47:09Z")
Can you please point me to the documentation where I can see all the possible settings which can be entered into the elasticsearch.yml file? --- ## [Different count on different timefields](https://discuss.elastic.co/t/different-count-on-different-timefields/96048)
**Author:** [@sLuvpreet33](https://discuss.elastic.co/u/sLuvpreet33)\ **Replies:** 0\ **Last updated:** [August 7, 2017, 6:20am UTC](https://discuss.elastic.co/t/different-count-on-different-timefields/96048 "2017-08-07T06:20:34Z")
I have data about bookings. The data has been pulled from different tables from postgresql. And I have pushed them all under the same index and type. Now I have 6 timefields in a document. booking\_time booking\_update\_… --- ## [How to get the full metricbeat data from the elasticsearch](https://discuss.elastic.co/t/how-to-get-the-full-metricbeat-data-from-the-elasticsearch/95878)
**Author:** [@Jonesthomas](https://discuss.elastic.co/u/Jonesthomas)\ **Replies:** 8\ **Last updated:** [August 7, 2017, 5:33am UTC](https://discuss.elastic.co/t/how-to-get-the-full-metricbeat-data-from-the-elasticsearch/95878 "2017-08-07T05:33:35Z")
i need to get the data for the metricbeat from the elasticsearch?? For example: System load,CpuUsage etc… i need evrydata that is stored in the elasticsearch. How can i fetch all data of metricbeat using curl command… --- ## [Aggregation using execution\_hit: map automatically filtered empty string key](https://discuss.elastic.co/t/aggregation-using-execution-hit-map-automatically-filtered-empty-string-key/95445)
**Author:** [@wd3790281](https://discuss.elastic.co/u/wd3790281)\ **Replies:** 3\ **Last updated:** [August 7, 2017, 2:50am UTC](https://discuss.elastic.co/t/aggregation-using-execution-hit-map-automatically-filtered-empty-string-key/95445 "2017-08-07T02:50:10Z")
Hi guys, I’m using execution\_hint: map in my aggregation to ensure my aggs run in fast speed. However, I have a key which is "". But the aggregation result doesn’t contain that bucket. I’m using terms aggregation. Do it… --- ## [First acquaintance with X-pack: which users do I have to create (basic)?](https://discuss.elastic.co/t/first-acquaintance-with-x-pack-which-users-do-i-have-to-create-basic/95919)
**Author:** [@dencowboy](https://discuss.elastic.co/u/dencowboy)\ **Replies:** 1\ **Last updated:** [August 7, 2017, 1:39am UTC](https://discuss.elastic.co/t/first-acquaintance-with-x-pack-which-users-do-i-have-to-create-basic/95919 "2017-08-07T01:39:53Z")
Hi, I’m trying some new things with x-path in my ELK stack. I’ve created an internal user for Logstash with my self made logstash\_writer role + I’ve created a Kibana user which has the permission to read etc. What I d… --- ## [How to use"null\_value" in mapping](https://discuss.elastic.co/t/how-to-use-null-value-in-mapping/95307)
**Author:** [@begemot](https://discuss.elastic.co/u/begemot)\ **Replies:** 0\ **Last updated:** [August 1, 2017, 10:02am UTC](https://discuss.elastic.co/t/how-to-use-null-value-in-mapping/95307 "2017-08-01T10:02:57Z")
How to use “null\_value” in mapping for all data types? --- ## [Cluster setup questions and rollover logstash ingestion to elasticsearch](https://discuss.elastic.co/t/cluster-setup-questions-and-rollover-logstash-ingestion-to-elasticsearch/95796)
**Author:** [@Drift](https://discuss.elastic.co/u/Drift)\ **Replies:** 7\ **Last updated:** [August 6, 2017, 8:58pm UTC](https://discuss.elastic.co/t/cluster-setup-questions-and-rollover-logstash-ingestion-to-elasticsearch/95796 "2017-08-06T20:58:21Z")
Hi, I am not sure if its possible to do this, but I am setting up a cluster setup and I wanted to make sure I do everything right. I have 3 nodes, all of them have same configuration (392gb ram, 32 core, 3TB SSD each). … --- ## [Cannot use custom analyzer for keyword](https://discuss.elastic.co/t/cannot-use-custom-analyzer-for-keyword/95813)
**Author:** [@3white](https://discuss.elastic.co/u/3white)\ **Replies:** 3\ **Last updated:** [August 6, 2017, 8:50pm UTC](https://discuss.elastic.co/t/cannot-use-custom-analyzer-for-keyword/95813 "2017-08-06T20:50:05Z")
I am trying to use a simple custom analyzer (a char filter and keyword tokeniser) to build a keyword field. However when I specify the analyzer besides with type : "keyword", ES said not supported analyzer field. If I … --- ## [Search no have any results](https://discuss.elastic.co/t/search-no-have-any-results/95645)
**Author:** [@parsa](https://discuss.elastic.co/u/parsa)\ **Replies:** 6\ **Last updated:** [August 6, 2017, 1:38pm UTC](https://discuss.elastic.co/t/search-no-have-any-results/95645 "2017-08-06T13:38:28Z")
Hi I’m an asp.net developer and I want to implement elastic search in windows. I installed and configured the elasticsearch serivice like as described in this articles: 1- http://caraulean.com/2016/install-and-configur… --- ## [How to avoid decay function from being recomputed at query time](https://discuss.elastic.co/t/how-to-avoid-decay-function-from-being-recomputed-at-query-time/96019)
**Author:** [@vvarma](https://discuss.elastic.co/u/vvarma)\ **Replies:** 0\ **Last updated:** [August 6, 2017, 1:27pm UTC](https://discuss.elastic.co/t/how-to-avoid-decay-function-from-being-recomputed-at-query-time/96019 "2017-08-06T13:27:45Z")
Hi all, Is it possible to have a derived column mapping - a column which is a function of another column and time. A bit more detail - I use the decay (gauss) fns on my scorer . But it feels to me like this value is re… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1986) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1988)