# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=311 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 312 --- ## [ES 8 Java client: BoolQuery.Builder no longer has hasClauses() method](https://discuss.elastic.co/t/es-8-java-client-boolquery-builder-no-longer-has-hasclauses-method/323894)
**Author:** [@yusufozcan](https://discuss.elastic.co/u/yusufozcan)\ **Replies:** 3\ **Last updated:** [January 25, 2023, 10:33am UTC](https://discuss.elastic.co/t/es-8-java-client-boolquery-builder-no-longer-has-hasclauses-method/323894 "2023-01-25T10:33:00Z")
Hello. We are upgrading our elastic java client from 6.8.10 to 8.1.3 and it seems BoolQuery.Builder doesn't have hasClauses() method anymore. Is there any workaround which provides the same functionality? Thanks in adv… --- ## [Make virtualization file beat aggregation](https://discuss.elastic.co/t/make-virtualization-file-beat-aggregation/323907)
**Author:** [@devdev7711](https://discuss.elastic.co/u/devdev7711)\ **Replies:** 0\ **Last updated:** [January 25, 2023, 10:26am UTC](https://discuss.elastic.co/t/make-virtualization-file-beat-aggregation/323907 "2023-01-25T10:26:00Z")
"log.file.path": \[ "C:\\ProgramData\\UNO\\SES\\Logs\\user1\\101.log" 10 count "log.file.path": \[ "C:\\ProgramData\\UNO\\SES\\Logs\\user1\\102.log" 20 count "log.file.path": \[ "C:\\ProgramData\\UNO\\SES\\Logs\\user2\\101.log" … --- ## [Showing 'actual' & 'typical' values in ML anomaly detection alert](https://discuss.elastic.co/t/showing-actual-typical-values-in-ml-anomaly-detection-alert/322810)
**Author:** [@nospace](https://discuss.elastic.co/u/nospace)\ **Replies:** 2\ **Last updated:** [January 25, 2023, 9:56am UTC](https://discuss.elastic.co/t/showing-actual-typical-values-in-ml-anomaly-detection-alert/322810 "2023-01-25T09:56:58Z")
Hey folks, We're running a couple of ML jobs for anomaly detection with mail alerts. For faster detection of false alerts I would like to extend the alert with the values from 'actual' and 'typical'. The documentation … --- ## [Replacement of QueryBuilder(ES 5.6) in ES 8.5](https://discuss.elastic.co/t/replacement-of-querybuilder-es-5-6-in-es-8-5/323856)
**Author:** [@Harsh0145](https://discuss.elastic.co/u/Harsh0145)\ **Replies:** 3\ **Last updated:** [January 25, 2023, 9:49am UTC](https://discuss.elastic.co/t/replacement-of-querybuilder-es-5-6-in-es-8-5/323856 "2023-01-25T09:49:44Z")
Hi, We have been using the ES 5.6 cluster, but are now migrating to a new ES 8.5 cluster. The Data migration, and indexing queries are all sorted. However, earlier we used to use QueryBuilder in ES 5.6 java app and ther… --- ## [Interrupted system call, INTERNAL\_SERVER\_ERROR during Elasticsearch snapshot](https://discuss.elastic.co/t/interrupted-system-call-internal-server-error-during-elasticsearch-snapshot/323900)
**Author:** [@chaitra\_hegde](https://discuss.elastic.co/u/chaitra_hegde)\ **Replies:** 0\ **Last updated:** [January 25, 2023, 9:30am UTC](https://discuss.elastic.co/t/interrupted-system-call-internal-server-error-during-elasticsearch-snapshot/323900 "2023-01-25T09:30:53Z")
Hi, I am using ES 7.8.0 version and sometimes my snapshot is failing with below errors. What could be the reason for this? "failures\\":\[{\\"index\\":\\"operation-2022.12.23\\",\\"index\_uuid\\":\\"operation-2022.12.23\\",\\"shar… --- ## [DEPLOY ELK STACK (with eck) using CLONED DISKS](https://discuss.elastic.co/t/deploy-elk-stack-with-eck-using-cloned-disks/323744)
**Author:** [@Maria\_Gabriela\_Perez](https://discuss.elastic.co/u/Maria_Gabriela_Perez)\ **Replies:** 6\ **Last updated:** [January 25, 2023, 7:28am UTC](https://discuss.elastic.co/t/deploy-elk-stack-with-eck-using-cloned-disks/323744 "2023-01-25T07:28:17Z")
Is it possible to deploy on kubernetes (gke) a new copy of elasticsearch using cloned disks from another elasticsearch deployment in another cluster, without conflicts? Any workarounds ?.. I need to restore logs saved i… --- ## [Elastic Search - Error Detail - Only one usage of each socket address (protocol/network address/port) is normally permitted Error](https://discuss.elastic.co/t/elastic-search-error-detail-only-one-usage-of-each-socket-address-protocol-network-address-port-is-normally-permitted-error/323792)
**Author:** [@ankurpatel](https://discuss.elastic.co/u/ankurpatel)\ **Replies:** 2\ **Last updated:** [January 25, 2023, 5:07am UTC](https://discuss.elastic.co/t/elastic-search-error-detail-only-one-usage-of-each-socket-address-protocol-network-address-port-is-normally-permitted-error/323792 "2023-01-25T05:07:31Z")
We have got below error in API which access data from Elastic Search. Error generated when web site traffic is high. We have configured Elastic Search on Single Node. We developed API(.NET core) by using NEST (7.15.1 lib… --- ## [ElascticsearchClient 8.5.3 (Java) cannot unblock index via client](https://discuss.elastic.co/t/elascticsearchclient-8-5-3-java-cannot-unblock-index-via-client/323812)
**Author:** [@Denko](https://discuss.elastic.co/u/Denko)\ **Replies:** 3\ **Last updated:** [January 24, 2023, 8:42pm UTC](https://discuss.elastic.co/t/elascticsearchclient-8-5-3-java-cannot-unblock-index-via-client/323812 "2023-01-24T20:42:05Z")
Hi, everyone! I'm trying to create a custom health check for Elasticsearch where its status is Down if an index is blocked (read-only, read-only-allow-delete, write) but I can't cover it with tests. This code doesn't wo… --- ## [Methodology for merge data nodes to big one](https://discuss.elastic.co/t/methodology-for-merge-data-nodes-to-big-one/323823)
**Author:** [@INS](https://discuss.elastic.co/u/INS)\ **Replies:** 3\ **Last updated:** [January 24, 2023, 3:52pm UTC](https://discuss.elastic.co/t/methodology-for-merge-data-nodes-to-big-one/323823 "2023-01-24T15:52:10Z")
Hi I need to change architecture of my cluster, thus I need to know Your's idea/approaches to do this. So currently my cluster consist on 3 bare metal server with sdd and hdd disk. But I need to increase memory of the… --- ## [Keep data in a rolling window of 3 months](https://discuss.elastic.co/t/keep-data-in-a-rolling-window-of-3-months/323458)
**Author:** [@Harsh0145](https://discuss.elastic.co/u/Harsh0145)\ **Replies:** 7\ **Last updated:** [January 24, 2023, 3:31pm UTC](https://discuss.elastic.co/t/keep-data-in-a-rolling-window-of-3-months/323458 "2023-01-24T15:31:31Z")
Hi, I am trying to delete or archive documents older than 3 months. Since our use case allows customers to update the data for the last 3 months, so at any moment in time, we should have the last 3 months of data. Accor… --- ## [Elasticserch is refusing connection from my external Java client, but accepting it when they are on the same server](https://discuss.elastic.co/t/elasticserch-is-refusing-connection-from-my-external-java-client-but-accepting-it-when-they-are-on-the-same-server/323816)
**Author:** [@m.jaafar](https://discuss.elastic.co/u/m.jaafar)\ **Replies:** 0\ **Last updated:** [January 24, 2023, 12:06pm UTC](https://discuss.elastic.co/t/elasticserch-is-refusing-connection-from-my-external-java-client-but-accepting-it-when-they-are-on-the-same-server/323816 "2023-01-24T12:06:44Z")
I have a server that I connect to through \:22226, my java client uses port 8099, while elasticsearch is installed on docker on the same server but with port 9200. I got the certificate from elasticsear… --- ## [Get random record using must\_not](https://discuss.elastic.co/t/get-random-record-using-must-not/323786)
**Author:** [@sphawk](https://discuss.elastic.co/u/sphawk)\ **Replies:** 4\ **Last updated:** [January 24, 2023, 12:20pm UTC](https://discuss.elastic.co/t/get-random-record-using-must-not/323786 "2023-01-24T12:20:36Z")
hello again I need to get a random record excluding some values using must\_not directive. this is the query i've created using some online post. { "index": "articles", "body": { "size": 1, … --- ## [Watcher and python client (8.6)](https://discuss.elastic.co/t/watcher-and-python-client-8-6/323811)
**Author:** [@MalfuncEddie](https://discuss.elastic.co/u/MalfuncEddie)\ **Replies:** 0\ **Last updated:** [January 24, 2023, 11:17am UTC](https://discuss.elastic.co/t/watcher-and-python-client-8-6/323811 "2023-01-24T11:17:21Z")
Hi, I was hoping someone can help me get started using the python client form elastic. Background: I just upgrades to 8.6 and e python script that reads .watches does not work anymore. results = es.search(size = 200,… --- ## [FSCrawler Rest with Elasticsearch](https://discuss.elastic.co/t/fscrawler-rest-with-elasticsearch/323803)
**Author:** [@Johnson\_F](https://discuss.elastic.co/u/Johnson_F)\ **Replies:** 4\ **Last updated:** [January 24, 2023, 11:09am UTC](https://discuss.elastic.co/t/fscrawler-rest-with-elasticsearch/323803 "2023-01-24T11:09:36Z")
Dear All, I had configured fscrawler 2.10 on ubuntu which works great, got some minor issues: - a. why touch is required? i can understand timestamp has to be new on copied or uploaded files in directory so fscrawler l… --- ## [Elasticsearch search by part of a word](https://discuss.elastic.co/t/elasticsearch-search-by-part-of-a-word/323748)
**Author:** [@maks1](https://discuss.elastic.co/u/maks1)\ **Replies:** 3\ **Last updated:** [January 24, 2023, 9:37am UTC](https://discuss.elastic.co/t/elasticsearch-search-by-part-of-a-word/323748 "2023-01-24T09:37:38Z")
Hello. Could you help me? There is an ELK cluster (version 5) and through kibana I execute a query for a part of a word using a wildcard, for example, examp\*, but nothing is found. If I search for the whole word example,… --- ## [Query\_string using special character work and dont work without escaping](https://discuss.elastic.co/t/query-string-using-special-character-work-and-dont-work-without-escaping/323794)
**Author:** [@eladonline](https://discuss.elastic.co/u/eladonline)\ **Replies:** 0\ **Last updated:** [January 24, 2023, 8:17am UTC](https://discuss.elastic.co/t/query-string-using-special-character-work-and-dont-work-without-escaping/323794 "2023-01-24T08:17:57Z")
Hey, what is the diferent that the first works and the others does not? GET /forensics/\_search { "query": { "query\_string": { "fields": \["referer"\], "query": "http://10.26.30.206\*" // but these doe… --- ## [Node Left Cluster After enabling X-Pack](https://discuss.elastic.co/t/node-left-cluster-after-enabling-x-pack/323745)
**Author:** [@A.Hani](https://discuss.elastic.co/u/A.Hani)\ **Replies:** 2\ **Last updated:** [January 24, 2023, 4:13am UTC](https://discuss.elastic.co/t/node-left-cluster-after-enabling-x-pack/323745 "2023-01-24T04:13:41Z")
Hello, I have formed a cluster of 2 Nodes, one is master-data and the other is data. Everything was working perfectly until I decided to enable X-Pack minimal security. Below is the config file for both Nodes. Curling t… --- ## [How to send data in index from ELK Stack to Prometheus?](https://discuss.elastic.co/t/how-to-send-data-in-index-from-elk-stack-to-prometheus/323708)
**Author:** [@jom0](https://discuss.elastic.co/u/jom0)\ **Replies:** 2\ **Last updated:** [January 24, 2023, 12:29am UTC](https://discuss.elastic.co/t/how-to-send-data-in-index-from-elk-stack-to-prometheus/323708 "2023-01-24T00:29:40Z")
Hello, I'm working on my project that use ELK Stack to receive syslog from network devices (router and switch) and then send them to Prometheus. Now I'm tried using Elasticsearch exporter but I can't find syslog in Prome… --- ## [Reindexing fails because missing shards](https://discuss.elastic.co/t/reindexing-fails-because-missing-shards/323773)
**Author:** [@EthanJ1999](https://discuss.elastic.co/u/EthanJ1999)\ **Replies:** 0\ **Last updated:** [January 23, 2023, 11:15pm UTC](https://discuss.elastic.co/t/reindexing-fails-because-missing-shards/323773 "2023-01-23T23:15:20Z")
Hi everyone hope you doing ok. We are trying to reindex data from an index with one missing shard, but we get this error: { "completed":true, "task":{ "node":"node", "id":7297895, "type":"transp… --- ## [Internal settings for data limit/transfer between data tier](https://discuss.elastic.co/t/internal-settings-for-data-limit-transfer-between-data-tier/323766)
**Author:** [@INS](https://discuss.elastic.co/u/INS)\ **Replies:** 0\ **Last updated:** [January 23, 2023, 9:29pm UTC](https://discuss.elastic.co/t/internal-settings-for-data-limit-transfer-between-data-tier/323766 "2023-01-23T21:29:15Z")
would like to share my case " what's going on? I'm shooting the date to node which have 16GB of mem limit so we have 8GB of heap size so what I got circuit\_breaking\_exception for 3.9 GB??? Yes because this date was to … --- ## [Extract @datetime field from a string in an index pattern and make it filterable using datetime](https://discuss.elastic.co/t/extract-datetime-field-from-a-string-in-an-index-pattern-and-make-it-filterable-using-datetime/323640)
**Author:** [@Amit\_Bhushan](https://discuss.elastic.co/u/Amit_Bhushan)\ **Replies:** 5\ **Last updated:** [January 23, 2023, 8:55pm UTC](https://discuss.elastic.co/t/extract-datetime-field-from-a-string-in-an-index-pattern-and-make-it-filterable-using-datetime/323640 "2023-01-23T20:55:29Z")
The orignal task is to make an index pattern (here alb-logs\*) in Elasticsearch searchable in datetime field (get those histogram). So I approached this problem and found out that this index does not have any datetime fi… --- ## [Async Background Search with .NET NEST Client](https://discuss.elastic.co/t/async-background-search-with-net-nest-client/323271)
**Author:** [@xef](https://discuss.elastic.co/u/xef)\ **Replies:** 12\ **Last updated:** [January 23, 2023, 6:25pm UTC](https://discuss.elastic.co/t/async-background-search-with-net-nest-client/323271 "2023-01-23T18:25:03Z")
How does one use the Elasticsearch Async Background search facility using the NEST Library. We cannot find any documentation on the syntax. Any help would be appreciated. --- ## [Aggregation of sums instead of sum of aggregation](https://discuss.elastic.co/t/aggregation-of-sums-instead-of-sum-of-aggregation/323751)
**Author:** [@rxtx](https://discuss.elastic.co/u/rxtx)\ **Replies:** 0\ **Last updated:** [January 23, 2023, 5:04pm UTC](https://discuss.elastic.co/t/aggregation-of-sums-instead-of-sum-of-aggregation/323751 "2023-01-23T17:04:46Z")
I'm trying to figure out if I can aggregate something by the sum of a value field rather than the number of value fields. I have an events index The events has the following fields: property\_id, name, value, timestamp I… --- ## [How to discount index who change from a Transform](https://discuss.elastic.co/t/how-to-discount-index-who-change-from-a-transform/323449)
**Author:** [@solrac97gr](https://discuss.elastic.co/u/solrac97gr)\ **Replies:** 5\ **Last updated:** [January 23, 2023, 4:34pm UTC](https://discuss.elastic.co/t/how-to-discount-index-who-change-from-a-transform/323449 "2023-01-23T16:34:34Z")
I have a specific task and we decided to solved it using transform Our Case: We need to count and aggregate by status a index like this { created\_at: "2023-01-15" accepted:10, review: 15, } On… --- ## [Watcher http input : What is the expected response?](https://discuss.elastic.co/t/watcher-http-input-what-is-the-expected-response/323608)
**Author:** [@Javier\_Molina\_Sanz](https://discuss.elastic.co/u/Javier_Molina_Sanz)\ **Replies:** 1\ **Last updated:** [January 23, 2023, 4:20pm UTC](https://discuss.elastic.co/t/watcher-http-input-what-is-the-expected-response/323608 "2023-01-23T16:20:17Z")
Hi team, I am trying to build a watcher that calls an external web service to build the query and then fire an action. "input": { "http": { "request": { "scheme": "https", "host": "myhost", … --- ## [How to change "index.refresh\_interval" value](https://discuss.elastic.co/t/how-to-change-index-refresh-interval-value/323310)
**Author:** [@praveen\_raju](https://discuss.elastic.co/u/praveen_raju)\ **Replies:** 5\ **Last updated:** [January 23, 2023, 2:08pm UTC](https://discuss.elastic.co/t/how-to-change-index-refresh-interval-value/323310 "2023-01-23T14:08:46Z")
Hello, We would like to set index.refresh\_interval --\> 120s as we are seeing write rejections on the data nodes. But how to se this value on all the current indices (Fleet Managed) and the new indices which are going t… --- ## [Remote Connection to Elastic](https://discuss.elastic.co/t/remote-connection-to-elastic/323732)
**Author:** [@Patryk\_Ostrowski](https://discuss.elastic.co/u/Patryk_Ostrowski)\ **Replies:** 0\ **Last updated:** [January 23, 2023, 1:49pm UTC](https://discuss.elastic.co/t/remote-connection-to-elastic/323732 "2023-01-23T13:49:58Z")
Hello, I have problem, and I cannot find solution of my problem. I have standalone Elasticsearch on 10.1.251.1, and hosts (Ubuntu 20) with Suricata on 10.2.251.5 and 10.1.251.5. When I try connect fro 10.1.251.1 to my e… --- ## [Monitor ELK Snaphot](https://discuss.elastic.co/t/monitor-elk-snaphot/323719)
**Author:** [@elk-user-0001](https://discuss.elastic.co/u/elk-user-0001)\ **Replies:** 2\ **Last updated:** [January 23, 2023, 1:42pm UTC](https://discuss.elastic.co/t/monitor-elk-snaphot/323719 "2023-01-23T13:42:11Z")
Hello! Im trying to monitor my snapshots. When i exec GET \_snapshot/\_all/status it doesnt show anything. Does anyone how to create a watcher or a query to see if a snapshot fail or if some of their shards fails ? Tha… --- ## [Update\_by\_query](https://discuss.elastic.co/t/update-by-query/323730)
**Author:** [@Srujan](https://discuss.elastic.co/u/Srujan)\ **Replies:** 0\ **Last updated:** [January 23, 2023, 1:06pm UTC](https://discuss.elastic.co/t/update-by-query/323730 "2023-01-23T13:06:58Z")
I am new to Elasticsearch. I have a huge index with around 50k documents. I have to update all the document, when I run the update\_by\_query function it is throwing an error Traceback (most recent call last): File "E:\\A… --- ## [How to find the time taken to upload/write a file from filebeat to logstash to elastic search(pipeline)?](https://discuss.elastic.co/t/how-to-find-the-time-taken-to-upload-write-a-file-from-filebeat-to-logstash-to-elastic-search-pipeline/323716)
**Author:** [@greg\_deg](https://discuss.elastic.co/u/greg_deg)\ **Replies:** 0\ **Last updated:** [January 23, 2023, 10:22am UTC](https://discuss.elastic.co/t/how-to-find-the-time-taken-to-upload-write-a-file-from-filebeat-to-logstash-to-elastic-search-pipeline/323716 "2023-01-23T10:22:23Z")
So I have a log file that is taken as an input by filebeat which is then outputted to logstash and from there to Elasticsearch. I need to calculate the time required/elapsed from the time I start filbeat and its reading … [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=310) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=312)