# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1997 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1998 --- ## [Alternative to \_explain API for searching in a specific document, given a query](https://discuss.elastic.co/t/alternative-to--explain-api-for-searching-in-a-specific-document-given-a-query/94966)
**Author:** [@guilherme\_maranhao](https://discuss.elastic.co/u/guilherme_maranhao)\ **Replies:** 0\ **Last updated:** [July 28, 2017, 2:11pm UTC](https://discuss.elastic.co/t/alternative-to--explain-api-for-searching-in-a-specific-document-given-a-query/94966 "2017-07-28T14:11:56Z")
HI everybody, I have a document and I would like to know if a specific query matches or not to it. The \_explain API returns a : :matched property which would be sufficient for me, but it also returns the :explanation ob… --- ## [Store fields with the same name and type](https://discuss.elastic.co/t/store-fields-with-the-same-name-and-type/94963)
**Author:** [@tolmach](https://discuss.elastic.co/u/tolmach)\ **Replies:** 0\ **Last updated:** [July 28, 2017, 2:03pm UTC](https://discuss.elastic.co/t/store-fields-with-the-same-name-and-type/94963 "2017-07-28T14:03:18Z")
I want to search some data by tags. Can i store 2 or more fields with the same name and type in document? Can i use this mapping for that? { “properties”: { “tag”: { “type”: “keyword” }, “origin”: { “type”: “key… --- ## [Snapshots are uncompressed](https://discuss.elastic.co/t/snapshots-are-uncompressed/94961)
**Author:** [@eirc](https://discuss.elastic.co/u/eirc)\ **Replies:** 0\ **Last updated:** [July 28, 2017, 1:52pm UTC](https://discuss.elastic.co/t/snapshots-are-uncompressed/94961 "2017-07-28T13:52:41Z")
This is not a bug but more targeted at initiating some kind of discussion around the space used up by snapshots. My issue is that snapshots take so much space that snapshot space has become the most expensive part of th… --- ## [Watch condition not met even though it should be](https://discuss.elastic.co/t/watch-condition-not-met-even-though-it-should-be/93826)
**Author:** [@David\_Tomasheski](https://discuss.elastic.co/u/David_Tomasheski)\ **Replies:** 3\ **Last updated:** [July 28, 2017, 1:47pm UTC](https://discuss.elastic.co/t/watch-condition-not-met-even-though-it-should-be/93826 "2017-07-28T13:47:13Z")
So i have an alert that as best as I can tell isn't completing the actions even though it should. Here are the pertinant parts of my watch and results: watch: "aggs": { "avg\_cst": { "avg":… --- ## [Upgrading from ES 1.7 to 5.4; default mapping analyzer](https://discuss.elastic.co/t/upgrading-from-es-1-7-to-5-4-default-mapping-analyzer/94948)
**Author:** [@Karolinebryn](https://discuss.elastic.co/u/Karolinebryn)\ **Replies:** 4\ **Last updated:** [July 28, 2017, 1:29pm UTC](https://discuss.elastic.co/t/upgrading-from-es-1-7-to-5-4-default-mapping-analyzer/94948 "2017-07-28T13:29:31Z")
I am in the process of moving our indexes from ES 1.7 to ES 5.4, and I am encountering a problem that I am not sure how to solve. In my old index I have this mapping on a type: { "myType1": { "search\_analyzer": "… --- ## [How to get a count by index id](https://discuss.elastic.co/t/how-to-get-a-count-by-index-id/94958)
**Author:** [@spraveenjd](https://discuss.elastic.co/u/spraveenjd)\ **Replies:** 1\ **Last updated:** [July 28, 2017, 1:23pm UTC](https://discuss.elastic.co/t/how-to-get-a-count-by-index-id/94958 "2017-07-28T13:23:38Z")
Help with the query how to get count of each index on a specified time frame --- ## [Hourly Time based indices reducing shard segments](https://discuss.elastic.co/t/hourly-time-based-indices-reducing-shard-segments/92909)
**Author:** [@pfremm](https://discuss.elastic.co/u/pfremm)\ **Replies:** 8\ **Last updated:** [July 28, 2017, 1:20pm UTC](https://discuss.elastic.co/t/hourly-time-based-indices-reducing-shard-segments/92909 "2017-07-28T13:20:26Z")
We are using fluentd, elastic, and kibana for logging aggregation. The amount we log has steadily grown so we've switched to hourly time based indices to try and keep our indice size under 50GB as when we did daily indi… --- ## [Reindex and status 409](https://discuss.elastic.co/t/reindex-and-status-409/94843)
**Author:** [@MarkTierney](https://discuss.elastic.co/u/MarkTierney)\ **Replies:** 1\ **Last updated:** [July 28, 2017, 1:07pm UTC](https://discuss.elastic.co/t/reindex-and-status-409/94843 "2017-07-28T13:07:02Z")
Hi Folks, When we do a reindex on our indexes we are doing the following: create the destination index run reindex with version\_type internal run reindex with version\_type external switch our index alias to point to… --- ## [Monitoring indices not showing metrics details](https://discuss.elastic.co/t/monitoring-indices-not-showing-metrics-details/94956)
**Author:** [@mbritton](https://discuss.elastic.co/u/mbritton)\ **Replies:** 1\ **Last updated:** [July 28, 2017, 12:58pm UTC](https://discuss.elastic.co/t/monitoring-indices-not-showing-metrics-details/94956 "2017-07-28T12:58:45Z")
Hello, For information, if you can see number of indices but not metric details for each indice in monitoring section, i’ ve the solution :wink: After 3 days of research, i found that’s because your servers are not ntp… --- ## [Pipeline aggregation python](https://discuss.elastic.co/t/pipeline-aggregation-python/94955)
**Author:** [@carlosvega](https://discuss.elastic.co/u/carlosvega)\ **Replies:** 0\ **Last updated:** [July 28, 2017, 12:46pm UTC](https://discuss.elastic.co/t/pipeline-aggregation-python/94955 "2017-07-28T12:46:15Z")
I would like to know how can I use this feature with the python API I would like to concatenate two aggregations. For example: I want to sum a metric from my documents, which is a quantity, with a date\_histogram aggreg… --- ## [Elasticsearch indexing wrong value for double fields](https://discuss.elastic.co/t/elasticsearch-indexing-wrong-value-for-double-fields/94866)
**Author:** [@luizgpsantos](https://discuss.elastic.co/u/luizgpsantos)\ **Replies:** 3\ **Last updated:** [July 28, 2017, 12:38pm UTC](https://discuss.elastic.co/t/elasticsearch-indexing-wrong-value-for-double-fields/94866 "2017-07-28T12:38:06Z")
Hello, I’m facing some issues indexing double fields without quotation marks. PUT test { "mappings" : { "type1" : { "properties" : { "field1" : { "type" : "double" } … --- ## [Too many Jar dependencies while using ES Transport client](https://discuss.elastic.co/t/too-many-jar-dependencies-while-using-es-transport-client/94761)
**Author:** [@kedarsdixit](https://discuss.elastic.co/u/kedarsdixit)\ **Replies:** 3\ **Last updated:** [July 28, 2017, 12:19pm UTC](https://discuss.elastic.co/t/too-many-jar-dependencies-while-using-es-transport-client/94761 "2017-07-28T12:19:14Z")
Hi, I have been using ES Transport client in our product to fetch data from ES Server. When I use below maven dependency and build the project: \ \org.elasticsearch.client\ \ **Author:** [@vivek.pr.mi](https://discuss.elastic.co/u/vivek.pr.mi)\ **Replies:** 0\ **Last updated:** [July 28, 2017, 12:16pm UTC](https://discuss.elastic.co/t/anything-similar-to-pipe-rex-to-create-custom-fields/94952 "2017-07-28T12:16:57Z") Hi Team, First I want to thank you all for such an awesome product. I wanted to evaluate Elasticsearch and Splunk features. I had few queries in this regard and this is my first post to the Forum: I was wondering wh… --- ## [Is it inefficient to index PDF files in Elasticsearch](https://discuss.elastic.co/t/is-it-inefficient-to-index-pdf-files-in-elasticsearch/94833)
**Author:** [@aniketkk](https://discuss.elastic.co/u/aniketkk)\ **Replies:** 7\ **Last updated:** [July 28, 2017, 11:02am UTC](https://discuss.elastic.co/t/is-it-inefficient-to-index-pdf-files-in-elasticsearch/94833 "2017-07-28T11:02:50Z")
I want to index PDF file into elastic search. I saw that there is a plugin available to do that task. https://www.elastic.co/guide/en/elasticsearch/plugins/master/ingest-attachment.html But I want to know is indexing… --- ## [The discover showed newest log was delayed 30 minutes](https://discuss.elastic.co/t/the-discover-showed-newest-log-was-delayed-30-minutes/94939)
**Author:** [@John\_ax](https://discuss.elastic.co/u/John_ax)\ **Replies:** 0\ **Last updated:** [July 28, 2017, 10:55am UTC](https://discuss.elastic.co/t/the-discover-showed-newest-log-was-delayed-30-minutes/94939 "2017-07-28T10:55:35Z")
Kibana Version: 5.5 Elasticsearch Version: 5.5 Plugins installed: \[X-PACK\] java version "1.8.0\_74" the setting: the overview: something went wrong, How can I figure it out？ --- ## [No Result Found After X Pack Install](https://discuss.elastic.co/t/no-result-found-after-x-pack-install/93689)
**Author:** [@Vinay\_Gowda](https://discuss.elastic.co/u/Vinay_Gowda)\ **Replies:** 6\ **Last updated:** [July 28, 2017, 10:48am UTC](https://discuss.elastic.co/t/no-result-found-after-x-pack-install/93689 "2017-07-28T10:48:45Z")
Hi Here is my Configuration , OS - Ubuntu 16.04 Elastic Search - 5.5.0 kibana - 5.5.0 logstash - 5.5.0 and I have installed metric and winlog beats on windows machine. I can able to see metric and winlog indices. … --- ## [Need help for Energy Monitoring System Alerts](https://discuss.elastic.co/t/need-help-for-energy-monitoring-system-alerts/89415)
**Author:** [@jodhias](https://discuss.elastic.co/u/jodhias)\ **Replies:** 12\ **Last updated:** [July 28, 2017, 10:46am UTC](https://discuss.elastic.co/t/need-help-for-energy-monitoring-system-alerts/89415 "2017-07-28T10:46:21Z")
Hello I'm a student and I really need your help to sort this out. So, I want to create a real time monitoring data for voltage consumption. The outcome will be: there will be an alert if the voltage value exceeds the 'Up… --- ## [How To classify and follow logs from different log files and machines](https://discuss.elastic.co/t/how-to-classify-and-follow-logs-from-different-log-files-and-machines/94836)
**Author:** [@Julien\_Hac](https://discuss.elastic.co/u/Julien_Hac)\ **Replies:** 2\ **Last updated:** [July 28, 2017, 10:05am UTC](https://discuss.elastic.co/t/how-to-classify-and-follow-logs-from-different-log-files-and-machines/94836 "2017-07-28T10:05:52Z")
Hi everyone, I need to treat different source log file and see then in Kibana : Type log file - as batch log, server application log, apache server log Log from different machines Here is my installation : Fir… --- ## [Security Analytics Recipes](https://discuss.elastic.co/t/security-analytics-recipes/93591)
**Author:** [@senthil\_blue](https://discuss.elastic.co/u/senthil_blue)\ **Replies:** 5\ **Last updated:** [July 28, 2017, 9:50am UTC](https://discuss.elastic.co/t/security-analytics-recipes/93591 "2017-07-28T09:50:40Z")
Hi, I am trying to explore the example https://github.com/elastic/examples/blob/master/Machine%20Learning/Security%20Analytics%20Recipes/dns\_data\_exfiltration/EXAMPLE.md for Anomaly detection. However, I can't seem to … --- ## [Elastic search (Spring data elastic search)- Date filter(range) not working as expected](https://discuss.elastic.co/t/elastic-search-spring-data-elastic-search-date-filter-range-not-working-as-expected/94055)
**Author:** [@kkvblr](https://discuss.elastic.co/u/kkvblr)\ **Replies:** 1\ **Last updated:** [July 28, 2017, 9:10am UTC](https://discuss.elastic.co/t/elastic-search-spring-data-elastic-search-date-filter-range-not-working-as-expected/94055 "2017-07-28T09:10:04Z")
I tried to search/filter on field(“timestamp”), but data are not filtered or returned as expected. I wanted to search/filter data’s based on (startDate and endDate) filter. I tried for a single field("timestamp) range … --- ## [Timeout when registering license](https://discuss.elastic.co/t/timeout-when-registering-license/94426)
**Author:** [@yangliping](https://discuss.elastic.co/u/yangliping)\ **Replies:** 3\ **Last updated:** [July 28, 2017, 8:47am UTC](https://discuss.elastic.co/t/timeout-when-registering-license/94426 "2017-07-28T08:47:31Z")
The one month xpack trial expired. So I register a basic license and try to update the license in the server. I got the following error. What should I do? $ curl -XPUT -u elastic 'http://localhost:9200/\_xpack/license?a… --- ## [Elasticsearch.yml missing from windows install](https://discuss.elastic.co/t/elasticsearch-yml-missing-from-windows-install/93936)
**Author:** [@jacobot](https://discuss.elastic.co/u/jacobot)\ **Replies:** 1\ **Last updated:** [July 28, 2017, 8:38am UTC](https://discuss.elastic.co/t/elasticsearch-yml-missing-from-windows-install/93936 "2017-07-28T08:38:02Z")
Hi, I install on windows 10 the msi install, but I dont see the elasticsearch.yml anywhere, where shoul dit me Cheers, jacobot --- ## [Elasticsearch shutdown after some times](https://discuss.elastic.co/t/elasticsearch-shutdown-after-some-times/93912)
**Author:** [@arafath](https://discuss.elastic.co/u/arafath)\ **Replies:** 1\ **Last updated:** [July 28, 2017, 8:35am UTC](https://discuss.elastic.co/t/elasticsearch-shutdown-after-some-times/93912 "2017-07-28T08:35:32Z")
We have Elasticsearch installed and configured on Digitalocean . and ES getting shut down after some times. ES log : sudo journalctl --unit elasticsearch --since "2017-07-20" Jul 20 06:19:11 ubuntu-2gb-sgp1-01 syste… --- ## [Two different data sets, Do I need to create two different node or clusters](https://discuss.elastic.co/t/two-different-data-sets-do-i-need-to-create-two-different-node-or-clusters/93885)
**Author:** [@kkotari](https://discuss.elastic.co/u/kkotari)\ **Replies:** 1\ **Last updated:** [July 28, 2017, 8:34am UTC](https://discuss.elastic.co/t/two-different-data-sets-do-i-need-to-create-two-different-node-or-clusters/93885 "2017-07-28T08:34:27Z")
Hi, I am new to Elasticsearch. I am having two different data sets (belongs to two different projects). Now how do I need to maintain them. Do I need to create two different clusters or nodes. Today the data is sma… --- ## [High read I/O and Load Average after upgrading to Elasticsearch 5.3.2](https://discuss.elastic.co/t/high-read-i-o-and-load-average-after-upgrading-to-elasticsearch-5-3-2/93984)
**Author:** [@Amitm](https://discuss.elastic.co/u/Amitm)\ **Replies:** 1\ **Last updated:** [July 28, 2017, 8:20am UTC](https://discuss.elastic.co/t/high-read-i-o-and-load-average-after-upgrading-to-elasticsearch-5-3-2/93984 "2017-07-28T08:20:58Z")
Hello, We upgraded our Elasticsearch to 5.3.2 from 1.7.4 after a long process of migration. A few hours after the upgrade, we started to have performance issues in our app. We saw that 1 or 2 nodes (out of 12 data nod… --- ## [X-Pack role cannot be created or modified](https://discuss.elastic.co/t/x-pack-role-cannot-be-created-or-modified/93670)
**Author:** [@mc2000](https://discuss.elastic.co/u/mc2000)\ **Replies:** 7\ **Last updated:** [July 28, 2017, 7:51am UTC](https://discuss.elastic.co/t/x-pack-role-cannot-be-created-or-modified/93670 "2017-07-28T07:51:27Z")
Hi, I'm experiencing issue when creating a new role which results in the following error message: {"error":{"root\_cause":\[{"type":"illegal\_state\_exception","reason":"role cannot be created or modified as service canno… --- ## [Watcher advice](https://discuss.elastic.co/t/watcher-advice/94627)
**Author:** [@pjanzen](https://discuss.elastic.co/u/pjanzen)\ **Replies:** 1\ **Last updated:** [July 28, 2017, 7:41am UTC](https://discuss.elastic.co/t/watcher-advice/94627 "2017-07-28T07:41:15Z")
Hi All, I created below watcher and although I do get results I am wondering if the condition is working as I would expect it to be. I get the top 5 hdr\_subjects trough a aggregate. Currently I think that if one of t… --- ## [Convert DSL Query to NEST.net](https://discuss.elastic.co/t/convert-dsl-query-to-nest-net/93527)
**Author:** [@takcy1980](https://discuss.elastic.co/u/takcy1980)\ **Replies:** 3\ **Last updated:** [July 28, 2017, 7:25am UTC](https://discuss.elastic.co/t/convert-dsl-query-to-nest-net/93527 "2017-07-28T07:25:05Z")
How can I translate the below query, so it is matching Nest.net GET /consolidated-capacity/\_search { "query": { "constant\_score" : { "filter" : { "bool" : { … --- ## [How to stop alert with another solution?](https://discuss.elastic.co/t/how-to-stop-alert-with-another-solution/93896)
**Author:** [@Thanadol\_Thadasade](https://discuss.elastic.co/u/Thanadol_Thadasade)\ **Replies:** 3\ **Last updated:** [July 28, 2017, 7:20am UTC](https://discuss.elastic.co/t/how-to-stop-alert-with-another-solution/93896 "2017-07-28T07:20:59Z")
HI, I having a question about stop alert. Example Alerting PUT \_xpack/watcher/watch/mem\_\_warning And how to stop it without using code ? thanks. --- ## [ES 5.5.0 java version error on Windows 7](https://discuss.elastic.co/t/es-5-5-0-java-version-error-on-windows-7/94379)
**Author:** [@Ramon\_Zaro](https://discuss.elastic.co/u/Ramon_Zaro)\ **Replies:** 1\ **Last updated:** [July 28, 2017, 6:47am UTC](https://discuss.elastic.co/t/es-5-5-0-java-version-error-on-windows-7/94379 "2017-07-28T06:47:42Z")
Hi, I tried to test-run ES on a win7 machine which threw up an error re: javaversionchecker, that my java was not version 8 or higher. (it is) I tried again immediately and it was up and running; I could ingest files t… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1996) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1998)