# Elasticsearch

**URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=2000

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 2001

---

## [Elasticsearch for Apache Hadoop 5.5.1 released](https://discuss.elastic.co/t/elasticsearch-for-apache-hadoop-5-5-1-released/94685)

<div class="topic-metadata">

**Author:** [@james.baiera](https://discuss.elastic.co/u/james.baiera)\
**Replies:** 0\
**Last updated:** [July 26, 2017, 6:29pm UTC](https://discuss.elastic.co/t/elasticsearch-for-apache-hadoop-5-5-1-released/94685 "2017-07-26T18:29:44Z")

</div>

I am proud to announce that both ES-Hadoop 5.5.1 has been released! ES-Hadoop 5.5.1 is primarily a compatibility release, tested specifically against the newest Elasticsearch 5.5.1.

---

## [How to execute BULK UpdateByQuery using java api - Elasticsearch 5.x](https://discuss.elastic.co/t/how-to-execute-bulk-updatebyquery-using-java-api-elasticsearch-5-x/94673)

<div class="topic-metadata">

**Author:** [@aarnaout](https://discuss.elastic.co/u/aarnaout)\
**Replies:** 0\
**Last updated:** [July 26, 2017, 5:18pm UTC](https://discuss.elastic.co/t/how-to-execute-bulk-updatebyquery-using-java-api-elasticsearch-5-x/94673 "2017-07-26T17:18:12Z")

</div>

I have multiple updateByQuery requests, and looking for a way to group them together, and then execute (for performance reasons). Example: -- QueryByField || field11111 || field222222 || field333333 || xxxxxxxxxxxx |…

---

## [Java Plugin for Detection changes in clustering topology](https://discuss.elastic.co/t/java-plugin-for-detection-changes-in-clustering-topology/94659)

<div class="topic-metadata">

**Author:** [@Leonardo\_Oporto](https://discuss.elastic.co/u/Leonardo_Oporto)\
**Replies:** 0\
**Last updated:** [July 26, 2017, 3:31pm UTC](https://discuss.elastic.co/t/java-plugin-for-detection-changes-in-clustering-topology/94659 "2017-07-26T15:31:20Z")

</div>

Hi community! I am implementing a plugin for ES 2.x using Java and I need to detect when a node joins to the cluster in order to take an action. I understand that this should be related with the use of Discovery class…

---

## [What is the upper limit on index.query.bool.max\_clause\_count for different ES versions?](https://discuss.elastic.co/t/what-is-the-upper-limit-on-index-query-bool-max-clause-count-for-different-es-versions/92892)

<div class="topic-metadata">

**Author:** [@abzter10690](https://discuss.elastic.co/u/abzter10690)\
**Replies:** 1\
**Last updated:** [July 26, 2017, 2:35pm UTC](https://discuss.elastic.co/t/what-is-the-upper-limit-on-index-query-bool-max-clause-count-for-different-es-versions/92892 "2017-07-26T14:35:15Z")

</div>

What is the maximum that we can set for index.query.bool.max\_clause\_count(old versions) and indices.query.bool.max\_clause\_count (\>5.1)?

---

## [Mappings, timestamps and templates](https://discuss.elastic.co/t/mappings-timestamps-and-templates/94141)

<div class="topic-metadata">

**Author:** [@elaair](https://discuss.elastic.co/u/elaair)\
**Replies:** 2\
**Last updated:** [July 26, 2017, 2:14pm UTC](https://discuss.elastic.co/t/mappings-timestamps-and-templates/94141 "2017-07-26T14:14:21Z")

</div>

I have imported data into Elastic using the CSV plugin. The first two fields are a timestamp which I would like to perform analysis on in Elastic and Kibana. The issue I have is the the two time stamp fields are being im…

---

## [Need help (re)enabling xpack](https://discuss.elastic.co/t/need-help-re-enabling-xpack/94596)

<div class="topic-metadata">

**Author:** [@yehosef](https://discuss.elastic.co/u/yehosef)\
**Replies:** 4\
**Last updated:** [July 26, 2017, 1:01pm UTC](https://discuss.elastic.co/t/need-help-re-enabling-xpack/94596 "2017-07-26T13:01:57Z")

</div>

I installed xpack on my OSX machine to test out the features (ES 5.5). The installation went fine and I saw the x-pack features in the kibana side-menu. I wasn't ready to play with it because I was still importing data…

---

## [Scroll to get scroll\_id only](https://discuss.elastic.co/t/scroll-to-get-scroll-id-only/94643)

<div class="topic-metadata">

**Author:** [@wintsu](https://discuss.elastic.co/u/wintsu)\
**Replies:** 0\
**Last updated:** [July 26, 2017, 12:48pm UTC](https://discuss.elastic.co/t/scroll-to-get-scroll-id-only/94643 "2017-07-26T12:48:39Z")

</div>

I'm now working with large data, which means each doc is a little bit large. I have a scenario that, we have to query a huge number of data which exceeds the limit of from+size(10000). I'm now using scroll, but sometim…

---

## [Time range query without "TO"](https://discuss.elastic.co/t/time-range-query-without-to/94578)

<div class="topic-metadata">

**Author:** [@fetch](https://discuss.elastic.co/u/fetch)\
**Replies:** 3\
**Last updated:** [July 26, 2017, 12:20pm UTC](https://discuss.elastic.co/t/time-range-query-without-to/94578 "2017-07-26T12:20:03Z")

</div>

Hi, Since Elasticsearch 5.2 to 5.4.0 (I haven't checked other versions, but these were installed on my server) I was able to use the following statement in my queries: timestamp: \[now-2d now\] It worked just fine. W…

---

## [Analytic quandry](https://discuss.elastic.co/t/analytic-quandry/94621)

<div class="topic-metadata">

**Author:** [@boldfish](https://discuss.elastic.co/u/boldfish)\
**Replies:** 0\
**Last updated:** [July 26, 2017, 10:58am UTC](https://discuss.elastic.co/t/analytic-quandry/94621 "2017-07-26T10:58:09Z")

</div>

I have an aggregated set of event based documents. Each document can be distinguished by an ip field and another field which categorises the use of said ip. the field which categorises the usage is limited to a set of d…

---

## [How to fix elasticsearch error failed service](https://discuss.elastic.co/t/how-to-fix-elasticsearch-error-failed-service/94605)

<div class="topic-metadata">

**Author:** [@omid](https://discuss.elastic.co/u/omid)\
**Replies:** 0\
**Last updated:** [July 26, 2017, 9:32am UTC](https://discuss.elastic.co/t/how-to-fix-elasticsearch-error-failed-service/94605 "2017-07-26T09:32:46Z")

</div>

my elk and filebeat ver = 5.5.1 installation steps with = https://goo.gl/EP2WD4 but, elasticsearch service = Failed ... ERROR = root@elk:~# systemctl status elasticsearch.service\_ ● elasticsearch.service - Elastic…

---

## [Set the value of a field to another field using elastic search processor](https://discuss.elastic.co/t/set-the-value-of-a-field-to-another-field-using-elastic-search-processor/93944)

<div class="topic-metadata">

**Author:** [@ssmishra](https://discuss.elastic.co/u/ssmishra)\
**Replies:** 2\
**Last updated:** [July 26, 2017, 9:49am UTC](https://discuss.elastic.co/t/set-the-value-of-a-field-to-another-field-using-elastic-search-processor/93944 "2017-07-26T09:49:41Z")

</div>

i am trying to set a the value of a field to another field. Like i have a field "date" and "name". i want the set the value of these fields to another field "log" I am using set processor: { "set": { "f…

---

## [Does the Location of a Filter in a Query Matter?](https://discuss.elastic.co/t/does-the-location-of-a-filter-in-a-query-matter/94601)

<div class="topic-metadata">

**Author:** [@Ong](https://discuss.elastic.co/u/Ong)\
**Replies:** 1\
**Last updated:** [July 26, 2017, 9:13am UTC](https://discuss.elastic.co/t/does-the-location-of-a-filter-in-a-query-matter/94601 "2017-07-26T09:13:37Z")

</div>

In an Elasticsearch query, does it matter where we place the filter? The examples I come across put filter after the query. Like the following: GET \_search { "query": { "bool": { "must": { "match…

---

## [How can change the bulk size with geonames](https://discuss.elastic.co/t/how-can-change-the-bulk-size-with-geonames/94594)

<div class="topic-metadata">

**Author:** [@zqc0512](https://discuss.elastic.co/u/zqc0512)\
**Replies:** 3\
**Last updated:** [July 26, 2017, 9:03am UTC](https://discuss.elastic.co/t/how-can-change-the-bulk-size-with-geonames/94594 "2017-07-26T09:03:45Z")

</div>

@danielmitterdorfer how can change the bulk size with geonames when i change about .rally/benchmarks/tracks/default/geonames/operations/default.json i wan't change "bulk-size": 5000 to 10000,but when i change it i can'…

---

## [Under the traditional search, is the elasticsearch search result safe?](https://discuss.elastic.co/t/under-the-traditional-search-is-the-elasticsearch-search-result-safe/94591)

<div class="topic-metadata">

**Author:** [@KevinFei](https://discuss.elastic.co/u/KevinFei)\
**Replies:** 2\
**Last updated:** [July 26, 2017, 8:59am UTC](https://discuss.elastic.co/t/under-the-traditional-search-is-the-elasticsearch-search-result-safe/94591 "2017-07-26T08:59:52Z")

</div>

Recently, our company tried to use ES to improve the previous business experience. The result is awesome. However my boss ask me how safe is elasticsearch, and I said I need to ask a professional. While i am in a finance…

---

## [Index template not match as will after i modify it in dev-tool](https://discuss.elastic.co/t/index-template-not-match-as-will-after-i-modify-it-in-dev-tool/94593)

<div class="topic-metadata">

**Author:** [@gangxiong\_chen](https://discuss.elastic.co/u/gangxiong_chen)\
**Replies:** 0\
**Last updated:** [July 26, 2017, 8:15am UTC](https://discuss.elastic.co/t/index-template-not-match-as-will-after-i-modify-it-in-dev-tool/94593 "2017-07-26T08:15:06Z")

</div>

first create index template like this use java transport client: template 1 "order": 0, "template": "log\_\*", "settings": { "index": { "mapper": { "dynamic": "true" }, …

---

## [Numerical metric field not visible in drop-down during aggregation](https://discuss.elastic.co/t/numerical-metric-field-not-visible-in-drop-down-during-aggregation/94581)

<div class="topic-metadata">

**Author:** [@Nikhil\_Utane](https://discuss.elastic.co/u/Nikhil_Utane)\
**Replies:** 1\
**Last updated:** [July 26, 2017, 8:29am UTC](https://discuss.elastic.co/t/numerical-metric-field-not-visible-in-drop-down-during-aggregation/94581 "2017-07-26T08:29:43Z")

</div>

Hi, I am creating data with these 3 fields: "field" : "xxx", "post\_date" : "2017-07-26T12:45:00", "status" : 3 Later when I am creating a heatmap visualization and selecting aggregation for a metric, I see the post\_…

---

## [Perl and new Boolean restriction in ES5](https://discuss.elastic.co/t/perl-and-new-boolean-restriction-in-es5/94529)

<div class="topic-metadata">

**Author:** [@Ron\_Kass](https://discuss.elastic.co/u/Ron_Kass)\
**Replies:** 6\
**Last updated:** [July 26, 2017, 8:12am UTC](https://discuss.elastic.co/t/perl-and-new-boolean-restriction-in-es5/94529 "2017-07-26T08:12:00Z")

</div>

In ElasticSearch 5, we now get the following error message \[DEPRECATION\] 299 Elasticsearch-5.4.0-780f8c4 "Expected a boolean \[true/false\] for property \[isAnonymous\] but got \[0\]" (isAnonymous is just a field name we use) …

---

## [Additional storage block](https://discuss.elastic.co/t/additional-storage-block/94440)

<div class="topic-metadata">

**Author:** [@pczyz-UI](https://discuss.elastic.co/u/pczyz-UI)\
**Replies:** 1\
**Last updated:** [July 26, 2017, 8:09am UTC](https://discuss.elastic.co/t/additional-storage-block/94440 "2017-07-26T08:09:54Z")

</div>

I have an additional 100 Gb storage block mounted on /mnt/volume-fra1-01. How can I make Elasticsearch store it's data there? I suspect that now they are being stored in /var/lib/elasticsearch but on this storage device …

---

## [Could not find logs in kibana for some servers](https://discuss.elastic.co/t/could-not-find-logs-in-kibana-for-some-servers/92932)

<div class="topic-metadata">

**Author:** [@dixitsatish34](https://discuss.elastic.co/u/dixitsatish34)\
**Replies:** 1\
**Last updated:** [July 26, 2017, 8:00am UTC](https://discuss.elastic.co/t/could-not-find-logs-in-kibana-for-some-servers/92932 "2017-07-26T08:00:03Z")

</div>

Hi Team, we have 2 DC(data center) and in each DC we have 26 servers. We have configured elk on all servers. We could see filebeat is sending data to logstash from all servers. While checking in kibana, we are not se…

---

## [Issue with Generating a PDF from a Dashboard](https://discuss.elastic.co/t/issue-with-generating-a-pdf-from-a-dashboard/84756)

<div class="topic-metadata">

**Author:** [@juice](https://discuss.elastic.co/u/juice)\
**Replies:** 6\
**Last updated:** [June 28, 2017, 3:55pm UTC](https://discuss.elastic.co/t/issue-with-generating-a-pdf-from-a-dashboard/84756 "2017-06-28T15:55:46Z")

</div>

Hi there, I've got Kibana 5.2.2 running nicely and I've created a dashboard containing about 12 different elements, a combo of bar chart, data table, and pie chart visualizations. The dashboard looks fine in my browser…

---

## [ElasticSearch can I reach GET consistency cross replicas (for same client)?](https://discuss.elastic.co/t/elasticsearch-can-i-reach-get-consistency-cross-replicas-for-same-client/93413)

<div class="topic-metadata">

**Author:** [@Tomer\_Ben\_David](https://discuss.elastic.co/u/Tomer_Ben_David)\
**Replies:** 0\
**Last updated:** [July 17, 2017, 2:58pm UTC](https://discuss.elastic.co/t/elasticsearch-can-i-reach-get-consistency-cross-replicas-for-same-client/93413 "2017-07-17T14:58:48Z")

</div>

Hi, I was reading https://discuss.elastic.co/t/question-on-read-consistency/14232/10 ElasticSearch can I reach GET consistency cross replicas (for same client, client does set then get)? Please correct me if i'm wron…

---

## [Is it possible to not use shared file system while taking snapshots?](https://discuss.elastic.co/t/is-it-possible-to-not-use-shared-file-system-while-taking-snapshots/94568)

<div class="topic-metadata">

**Author:** [@Suman\_Kumari](https://discuss.elastic.co/u/Suman_Kumari)\
**Replies:** 2\
**Last updated:** [July 26, 2017, 5:41am UTC](https://discuss.elastic.co/t/is-it-possible-to-not-use-shared-file-system-while-taking-snapshots/94568 "2017-07-26T05:41:58Z")

</div>

Hi, The documentation here says that we need to use shared file system to take snapshots and backup. Is is possible to not use a shared file repository?

---

## [Elasticsearch can't run and can't connect to kibana . help](https://discuss.elastic.co/t/elasticsearch-cant-run-and-cant-connect-to-kibana-help/94566)

<div class="topic-metadata">

**Author:** [@Amity4](https://discuss.elastic.co/u/Amity4)\
**Replies:** 4\
**Last updated:** [July 26, 2017, 5:15am UTC](https://discuss.elastic.co/t/elasticsearch-cant-run-and-cant-connect-to-kibana-help/94566 "2017-07-26T05:15:11Z")

</div>

here's screenshoot from when i try tu run systemctl start elasticsearch and then systemctl status elasticsearch. and screenshoot from when i open kibana from browser.

---

## [Unable to install elasticsearch 5.5](https://discuss.elastic.co/t/unable-to-install-elasticsearch-5-5/94452)

<div class="topic-metadata">

**Author:** [@vijjun123](https://discuss.elastic.co/u/vijjun123)\
**Replies:** 8\
**Last updated:** [July 26, 2017, 4:50am UTC](https://discuss.elastic.co/t/unable-to-install-elasticsearch-5-5/94452 "2017-07-26T04:50:38Z")

</div>

Unable to install elasticsearch 5.5 While executing ./elasticsearch got the below error Could you please guide the further $ ./elasticsearch 2017-07-25 09:28:57,277 main ERROR Could not register mbeans java.security.…

---

## [Watcher alerts for failed logons](https://discuss.elastic.co/t/watcher-alerts-for-failed-logons/92517)

<div class="topic-metadata">

**Author:** [@Izayuh](https://discuss.elastic.co/u/Izayuh)\
**Replies:** 7\
**Last updated:** [July 25, 2017, 1:08pm UTC](https://discuss.elastic.co/t/watcher-alerts-for-failed-logons/92517 "2017-07-25T13:08:38Z")

</div>

I am currently using Winlogbeat to send security logs from multiple domain controllers. I want to set up a watcher alert that would trigger on x amount of failed logon attempts to the same user in a certain time range. W…

---

## [Please help about clear ES cache](https://discuss.elastic.co/t/please-help-about-clear-es-cache/93723)

<div class="topic-metadata">

**Author:** [@palmer](https://discuss.elastic.co/u/palmer)\
**Replies:** 4\
**Last updated:** [July 26, 2017, 2:29am UTC](https://discuss.elastic.co/t/please-help-about-clear-es-cache/93723 "2017-07-26T02:29:45Z")

</div>

Hi , i'm a tester, by use ES 5.3, testing the search result used time; original search use about 20s, after cache search use 2s; but don't know how to correct clear the cache , (have tried command "curl -XPOST '127.0.…

---

## [Sort a prefix query in compound queries in java](https://discuss.elastic.co/t/sort-a-prefix-query-in-compound-queries-in-java/94138)

<div class="topic-metadata">

**Author:** [@jth1](https://discuss.elastic.co/u/jth1)\
**Replies:** 6\
**Last updated:** [July 26, 2017, 1:47am UTC](https://discuss.elastic.co/t/sort-a-prefix-query-in-compound-queries-in-java/94138 "2017-07-26T01:47:57Z")

</div>

prefix query, returns results with constant score. How to sort results alphabetically by a field in ascending in JAVA?

---

## [How to set config in es 5](https://discuss.elastic.co/t/how-to-set-config-in-es-5/94430)

<div class="topic-metadata">

**Author:** [@zqc0512](https://discuss.elastic.co/u/zqc0512)\
**Replies:** 2\
**Last updated:** [July 26, 2017, 1:46am UTC](https://discuss.elastic.co/t/how-to-set-config-in-es-5/94430 "2017-07-26T01:46:13Z")

</div>

how to set the flow configure in es 5 indices.memory.index\_buffer\_size: 30% indices.memory.min\_index\_buffer\_size: 3096mb indices.memory.max\_index\_buffer\_size: 60% indices.queries.cache.size: 20 indices.recovery.con…

---

## [Combined index like database(RDBMS)？](https://discuss.elastic.co/t/combined-index-like-database-rdbms/93262)

<div class="topic-metadata">

**Author:** [@ginger](https://discuss.elastic.co/u/ginger)\
**Replies:** 11\
**Last updated:** [July 26, 2017, 1:34am UTC](https://discuss.elastic.co/t/combined-index-like-database-rdbms/93262 "2017-07-26T01:34:24Z")

</div>

Hi. I am testing es to analysis user data. I load a day's data of 1 million users into es. The common query pattern is using date histogram aggregation to analysis one user's data. I encounter performance problem when u…

---

## [Es 2.4 , can't add a \_parent field that points to an already existing type](https://discuss.elastic.co/t/es-2-4-cant-add-a--parent-field-that-points-to-an-already-existing-type/91819)

<div class="topic-metadata">

**Author:** [@Miguel\_Michelsongs](https://discuss.elastic.co/u/Miguel_Michelsongs)\
**Replies:** 4\
**Last updated:** [July 26, 2017, 12:47am UTC](https://discuss.elastic.co/t/es-2-4-cant-add-a--parent-field-that-points-to-an-already-existing-type/91819 "2017-07-26T00:47:14Z")

</div>

Hi guys, how are you today ? I have a index with records on type1, And I'm trying to add a new type type2 which has a type1 parent type. i'm receiving the error can't add a \_parent field that points to an already exis…

[Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1999)

[Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=2001)
