# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=313 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 314 --- ## [Elastic index template and ilm policy configuracion reset by no reason](https://discuss.elastic.co/t/elastic-index-template-and-ilm-policy-configuracion-reset-by-no-reason/323566)
**Author:** [@Samuel\_Ruiz](https://discuss.elastic.co/u/Samuel_Ruiz)\ **Replies:** 0\ **Last updated:** [January 20, 2023, 7:38am UTC](https://discuss.elastic.co/t/elastic-index-template-and-ilm-policy-configuracion-reset-by-no-reason/323566 "2023-01-20T07:38:41Z")
Hey. We have a docker cluster deploy of various nodes of elasticsearch (7.17.6) and a kibana node (7.17.6). In addition we have two Wazuh nodes, master-worker. This ELK-Wazuh implementation don't let us update the cluste… --- ## [Unable to use 2 fie log and 2 different index for them](https://discuss.elastic.co/t/unable-to-use-2-fie-log-and-2-different-index-for-them/323563)
**Author:** [@devdev7711](https://discuss.elastic.co/u/devdev7711)\ **Replies:** 0\ **Last updated:** [January 20, 2023, 5:39am UTC](https://discuss.elastic.co/t/unable-to-use-2-fie-log-and-2-different-index-for-them/323563 "2023-01-20T05:39:21Z")
below is my filebeat it is working fine for 1 log location and 1 index but i want to use 2 file log location and 2 diifferent index 1 index for 1 log path. how can we do this filebeat.inputs: type: log enabled: true … --- ## [Discard non-letter characters during Completion Suggestor indexing](https://discuss.elastic.co/t/discard-non-letter-characters-during-completion-suggestor-indexing/323561)
**Author:** [@vikk](https://discuss.elastic.co/u/vikk)\ **Replies:** 0\ **Last updated:** [January 20, 2023, 3:58am UTC](https://discuss.elastic.co/t/discard-non-letter-characters-during-completion-suggestor-indexing/323561 "2023-01-20T03:58:31Z")
Here's my index: PUT autocomplete-food { "mappings": { "properties": { "suggest": { "type": "completion" } } } } Adding a document to this index: PUT autocomplete-food/\_doc/1?refresh { … --- ## [How to get enrollment token when re-install Elasticsearch to Windows](https://discuss.elastic.co/t/how-to-get-enrollment-token-when-re-install-elasticsearch-to-windows/323314)
**Author:** [@oga](https://discuss.elastic.co/u/oga)\ **Replies:** 2\ **Last updated:** [January 20, 2023, 3:36am UTC](https://discuss.elastic.co/t/how-to-get-enrollment-token-when-re-install-elasticsearch-to-windows/323314 "2023-01-20T03:36:08Z")
When installing Elasticsarch8.6 on Windows, after runnning elasticsearch.bat I forgot to write down the enrollment token. To get the enrollment token,delete the elasticsearch directory and unzip the elasticsearch an… --- ## [Vulnerabilities Related to Java (in January 2023.)](https://discuss.elastic.co/t/vulnerabilities-related-to-java-in-january-2023/323557)
**Author:** [@its-ogawa](https://discuss.elastic.co/u/its-ogawa)\ **Replies:** 2\ **Last updated:** [January 20, 2023, 2:33am UTC](https://discuss.elastic.co/t/vulnerabilities-related-to-java-in-january-2023/323557 "2023-01-20T02:33:39Z")
Oracle released "Critical Patch Updates, Security Alerts and Bulletins" in January 2023. These include vulnerabilities involving Java. Is there any official word on the impact on Elastic products? cf. --- ## [How to do Calculation in Elasticsearch Query](https://discuss.elastic.co/t/how-to-do-calculation-in-elasticsearch-query/323496)
**Author:** [@yuswanul](https://discuss.elastic.co/u/yuswanul)\ **Replies:** 5\ **Last updated:** [January 20, 2023, 1:39am UTC](https://discuss.elastic.co/t/how-to-do-calculation-in-elasticsearch-query/323496 "2023-01-20T01:39:44Z")
Hi there, to continue discussion below, I decided to create a new topic. please read the topic below first so you can understand it. OK, so the next question is how if i use elasticsearch query to calculate expire dat… --- ## [Bool query with boost for should clause](https://discuss.elastic.co/t/bool-query-with-boost-for-should-clause/323555)
**Author:** [@seeminglee](https://discuss.elastic.co/u/seeminglee)\ **Replies:** 1\ **Last updated:** [January 20, 2023, 1:33am UTC](https://discuss.elastic.co/t/bool-query-with-boost-for-should-clause/323555 "2023-01-20T01:33:55Z")
How can you add boost to specific part of a should query. For example: { "query": { "bool": { "should": \[ {"term":{"fruit.keyword":"apple"}}, {"term":{"fruit.keyword":"banana"}}, {"te… --- ## [My cluster frequently has shards on initializing\_shards](https://discuss.elastic.co/t/my-cluster-frequently-has-shards-on-initializing-shards/323446)
**Author:** [@Lohanna\_Sarah](https://discuss.elastic.co/u/Lohanna_Sarah)\ **Replies:** 12\ **Last updated:** [January 19, 2023, 9:57pm UTC](https://discuss.elastic.co/t/my-cluster-frequently-has-shards-on-initializing-shards/323446 "2023-01-19T21:57:03Z")
My cluster frequently has shards in the initializing\_shards state. The cluster is running on ks8. Exists any fix that I could do to fix it? The data nodes are restarted at least once a day --- ## [Elastic Search for Frequent Location Updates](https://discuss.elastic.co/t/elastic-search-for-frequent-location-updates/323542)
**Author:** [@nsarvesh](https://discuss.elastic.co/u/nsarvesh)\ **Replies:** 0\ **Last updated:** [January 19, 2023, 7:32pm UTC](https://discuss.elastic.co/t/elastic-search-for-frequent-location-updates/323542 "2023-01-19T19:32:03Z")
Hi Team, We are planning to build a calendar application with Location-based Search Capabilities. We want to store the user availability and the geolocation. Eg: { User: "foo" day: "Jan-19-2022… --- ## [Elasticsearch windows server high split i/o and service restart](https://discuss.elastic.co/t/elasticsearch-windows-server-high-split-i-o-and-service-restart/323147)
**Author:** [@elastic101](https://discuss.elastic.co/u/elastic101)\ **Replies:** 4\ **Last updated:** [January 19, 2023, 4:39pm UTC](https://discuss.elastic.co/t/elasticsearch-windows-server-high-split-i-o-and-service-restart/323147 "2023-01-19T16:39:08Z")
Hello, We are using an app that has Elasticsearch database. The version is old and we are seeing a lot of issues lately. The split I/O increases to 50% + and the service becomes unresponsive. Below are the cluster detai… --- ## [Dsl Query - calculate incidence in percentage (%) or bucket\_script](https://discuss.elastic.co/t/dsl-query-calculate-incidence-in-percentage-or-bucket-script/323501)
**Author:** [@SalvoDM91](https://discuss.elastic.co/u/SalvoDM91)\ **Replies:** 0\ **Last updated:** [January 19, 2023, 11:24am UTC](https://discuss.elastic.co/t/dsl-query-calculate-incidence-in-percentage-or-bucket-script/323501 "2023-01-19T11:24:21Z")
Hi guys, I've a sample dataset with 3 columns (ID, ACTION and AMOUNT): I would like to create a DSL query in order to check minute by minute: number of documents with ACTION = "purchase" (paramA) number of documen… --- ## [Multi-node cluster certificates](https://discuss.elastic.co/t/multi-node-cluster-certificates/323522)
**Author:** [@cdy5159](https://discuss.elastic.co/u/cdy5159)\ **Replies:** 0\ **Last updated:** [January 19, 2023, 1:27pm UTC](https://discuss.elastic.co/t/multi-node-cluster-certificates/323522 "2023-01-19T13:27:52Z")
I have a 3 node cluster that was created using the defaults at installation. Elastic version is 8.4.2. Only the cert from the initial node has a host-name built in. Do I need to re-create the transport certs and/or th… --- ## [I get no data from Elastic via asp.net core](https://discuss.elastic.co/t/i-get-no-data-from-elastic-via-asp-net-core/323515)
**Author:** [@fozgul](https://discuss.elastic.co/u/fozgul)\ **Replies:** 0\ **Last updated:** [January 19, 2023, 12:54pm UTC](https://discuss.elastic.co/t/i-get-no-data-from-elastic-via-asp-net-core/323515 "2023-01-19T12:54:57Z")
My Elastic server(7.16.2) is running on an on-prem server with certain Ip. (Free version) I have the following setup for client creation in asp.net core: var pool = new SingleNodeConnectionPool(new Uri("http://username… --- ## [Complex queries inside nested fields](https://discuss.elastic.co/t/complex-queries-inside-nested-fields/323514)
**Author:** [@Hemabh\_Ravee\_Fox](https://discuss.elastic.co/u/Hemabh_Ravee_Fox)\ **Replies:** 0\ **Last updated:** [January 19, 2023, 12:51pm UTC](https://discuss.elastic.co/t/complex-queries-inside-nested-fields/323514 "2023-01-19T12:51:32Z")
I have some documents which contain a nested field planList which is an array of objects. It's length will always be 2 or 3. And the objects always have 3 keys - planName, planType, and planId. I want to write a query w… --- ## [How to use DTOs in new java client with ILM](https://discuss.elastic.co/t/how-to-use-dtos-in-new-java-client-with-ilm/323511)
**Author:** [@bilak](https://discuss.elastic.co/u/bilak)\ **Replies:** 0\ **Last updated:** [January 19, 2023, 12:36pm UTC](https://discuss.elastic.co/t/how-to-use-dtos-in-new-java-client-with-ilm/323511 "2023-01-19T12:36:46Z")
I'm using 7.17 client and I'd like to build ILM from java. This is what I've tried: final RolloverConditions rollover = new RolloverConditions.Builder() .maxSize("4GB") .maxAge(t -\> t.time("1D")) … --- ## [Dev Tools Console can't retrieve data - Error Bad Gateway 502](https://discuss.elastic.co/t/dev-tools-console-cant-retrieve-data-error-bad-gateway-502/323500)
**Author:** [@Kamil\_BdBelfort](https://discuss.elastic.co/u/Kamil_BdBelfort)\ **Replies:** 3\ **Last updated:** [January 19, 2023, 11:51am UTC](https://discuss.elastic.co/t/dev-tools-console-cant-retrieve-data-error-bad-gateway-502/323500 "2023-01-19T11:51:09Z")
Hi there, Can anyone explain me please why do I get this error when I am running elasticsearch on localhost? See screenshot: Thanks a lot, Kamil --- ## [elasticsearch.AuthorizationException: AuthorizationException(403, 'security\_exception', 'action \[cluster:monitor/main\] is unauthorized for user\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*this action is grante d by the cluster privileges \[monitor,manage,all\]')](https://discuss.elastic.co/t/elasticsearch-authorizationexception-authorizationexception-403-security-exception-action-cluster-monitor-main-is-unauthorized-for-user-this-action-is-grante-d-by-the-cluster-privileges-monitor-manage-all/323499)
**Author:** [@savitaSUtar](https://discuss.elastic.co/u/savitaSUtar)\ **Replies:** 1\ **Last updated:** [January 19, 2023, 11:42am UTC](https://discuss.elastic.co/t/elasticsearch-authorizationexception-authorizationexception-403-security-exception-action-cluster-monitor-main-is-unauthorized-for-user-this-action-is-grante-d-by-the-cluster-privileges-monitor-manage-all/323499 "2023-01-19T11:42:54Z")
I am writting a Elastic search connection code from python like : es = Elasticsearch("url", basic\_auth=("Username", "password")) print(es.info()) but getting error as : elasticsearch.AuthorizationException: Authorizat… --- ## [org.elasticsearch.action.UnavailableShardsException: \[ . async—searchl \[01 primary shard is not active Timeout: \[1m](https://discuss.elastic.co/t/org-elasticsearch-action-unavailableshardsexception-async-searchl-01-primary-shard-is-not-active-timeout-1m/323466)
**Author:** [@forabraham1](https://discuss.elastic.co/u/forabraham1)\ **Replies:** 4\ **Last updated:** [January 19, 2023, 11:17am UTC](https://discuss.elastic.co/t/org-elasticsearch-action-unavailableshardsexception-async-searchl-01-primary-shard-is-not-active-timeout-1m/323466 "2023-01-19T11:17:19Z")
After upgrading ES from 7.9 to 7.17 ES is throwing this exception "org.elasticsearch.action.UnavailableShardsException: \[ . async—searchl \[01 primary shard is not active Timeout: \[1m". Due to which Kibana isn't returnin… --- ## [Would turning off swap require extra configuration](https://discuss.elastic.co/t/would-turning-off-swap-require-extra-configuration/323342)
**Author:** [@hasancansaral](https://discuss.elastic.co/u/hasancansaral)\ **Replies:** 2\ **Last updated:** [January 19, 2023, 10:46am UTC](https://discuss.elastic.co/t/would-turning-off-swap-require-extra-configuration/323342 "2023-01-19T10:46:43Z")
I have a 3 node cluster, all master eligible and all having 4 cores, 16gb memory. I have 2 read/write indexes with none of them above 1 GB/1 million documents. Each index is 1 primary shard and 2 replicas. I've recently… --- ## [Failed to save to index due to maximum shard overlimit](https://discuss.elastic.co/t/failed-to-save-to-index-due-to-maximum-shard-overlimit/323424)
**Author:** [@aagirre92](https://discuss.elastic.co/u/aagirre92)\ **Replies:** 4\ **Last updated:** [January 19, 2023, 10:13am UTC](https://discuss.elastic.co/t/failed-to-save-to-index-due-to-maximum-shard-overlimit/323424 "2023-01-19T10:13:29Z")
Hello, I am running a web application (in my own windows server machine) called Automation Anywhere A360. This web application uses a local Elasticsearch instance to handle its Audit Logs. Cluster health endpoint shows… --- ## [Unassigned Shards when New Index was created: Cluster Yellow](https://discuss.elastic.co/t/unassigned-shards-when-new-index-was-created-cluster-yellow/323483)
**Author:** [@rpraveenverma](https://discuss.elastic.co/u/rpraveenverma)\ **Replies:** 3\ **Last updated:** [January 19, 2023, 9:32am UTC](https://discuss.elastic.co/t/unassigned-shards-when-new-index-was-created-cluster-yellow/323483 "2023-01-19T09:32:54Z")
New Index Creation led to Unassigned Shards and Yellow Cluster State. Context : It happened when relocation for one node was already in progress. Checked explanation for its state. It says : Relocation Throttled , rea… --- ## [Migrate to datastreams withou aliases + datastreams filter](https://discuss.elastic.co/t/migrate-to-datastreams-withou-aliases-datastreams-filter/323401)
**Author:** [@bilak](https://discuss.elastic.co/u/bilak)\ **Replies:** 3\ **Last updated:** [January 19, 2023, 9:28am UTC](https://discuss.elastic.co/t/migrate-to-datastreams-withou-aliases-datastreams-filter/323401 "2023-01-19T09:28:49Z")
Hello, I'd like to use data streams and migrate our indices to it. However currently we don't use aliases. Do I have to create an alias for given indices pattern (technical-logs\*) at first and only after that I'm able t… --- ## [Scaling of cardinality sub-aggregation](https://discuss.elastic.co/t/scaling-of-cardinality-sub-aggregation/320264)
**Author:** [@astrodi](https://discuss.elastic.co/u/astrodi)\ **Replies:** 16\ **Last updated:** [January 19, 2023, 7:20am UTC](https://discuss.elastic.co/t/scaling-of-cardinality-sub-aggregation/320264 "2023-01-19T07:20:55Z")
Hello there, as continuation of this discussion thread, what other options are there in Elasticsearch to scale aggregation? I have experimented with: adding client nodes (didn't help for big result-set) playing wit… --- ## [Logstash stops elasticsearch](https://discuss.elastic.co/t/logstash-stops-elasticsearch/323017)
**Author:** [@bas\_kos](https://discuss.elastic.co/u/bas_kos)\ **Replies:** 27\ **Last updated:** [January 19, 2023, 7:17am UTC](https://discuss.elastic.co/t/logstash-stops-elasticsearch/323017 "2023-01-19T07:17:45Z")
After starting logstash, elasticsearch stops. If logstash is not running, then elasticsearch and kibana work and I go to the kibana web interface. I tried to cleanly remove logstash and install with default settings, I… --- ## [Why are 3 zones less expensive than 2 zones?](https://discuss.elastic.co/t/why-are-3-zones-less-expensive-than-2-zones/323453)
**Author:** [@michielswaanen](https://discuss.elastic.co/u/michielswaanen)\ **Replies:** 3\ **Last updated:** [January 19, 2023, 6:53am UTC](https://discuss.elastic.co/t/why-are-3-zones-less-expensive-than-2-zones/323453 "2023-01-19T06:53:11Z")
Why is tiebreaker only needed in a 2 zone setup? Pricing for 2 zones: Pricing for 3 zones: --- ## [Data flows through nodes](https://discuss.elastic.co/t/data-flows-through-nodes/323078)
**Author:** [@yinbucheng](https://discuss.elastic.co/u/yinbucheng)\ **Replies:** 2\ **Last updated:** [January 19, 2023, 6:19am UTC](https://discuss.elastic.co/t/data-flows-through-nodes/323078 "2023-01-19T06:19:14Z")
The elastic cluster node I built has a separate data role master role coordinate role ingest role. I also configured the ingest pipeline, which nodes I will pass through when I insert data. The exposed cluster link is … --- ## [Is there a limit on the number of ILM Policies that can be created in a Cluster?](https://discuss.elastic.co/t/is-there-a-limit-on-the-number-of-ilm-policies-that-can-be-created-in-a-cluster/323398)
**Author:** [@siddhartha\_c](https://discuss.elastic.co/u/siddhartha_c)\ **Replies:** 2\ **Last updated:** [January 19, 2023, 5:40am UTC](https://discuss.elastic.co/t/is-there-a-limit-on-the-number-of-ilm-policies-that-can-be-created-in-a-cluster/323398 "2023-01-19T05:40:57Z")
I have a situation where I need to create 120 indices , wherein each index has the data for a particular month. The data is stored for past 10 years (12 month\*10 year = 120 indices). Each index hold 1 month Data. I ha… --- ## [Copy users and roles created in kibana to new cluster](https://discuss.elastic.co/t/copy-users-and-roles-created-in-kibana-to-new-cluster/323392)
**Author:** [@dadiasish](https://discuss.elastic.co/u/dadiasish)\ **Replies:** 4\ **Last updated:** [January 19, 2023, 5:34am UTC](https://discuss.elastic.co/t/copy-users-and-roles-created-in-kibana-to-new-cluster/323392 "2023-01-19T05:34:43Z")
Hi, I've multiple users which are created to access Kibana in my current cluster. Now, we have planned to have a new cluster and I would like to have all these existing users copied from my previous cluster to the new … --- ## [Bulk indexing of signals failed: no such index \[.alerts-security.alerts-default\] and \[require\_alias\] request flag is \[true\]](https://discuss.elastic.co/t/bulk-indexing-of-signals-failed-no-such-index-alerts-security-alerts-default-and-require-alias-request-flag-is-true/323437)
**Author:** [@raghiboon](https://discuss.elastic.co/u/raghiboon)\ **Replies:** 2\ **Last updated:** [January 19, 2023, 4:48am UTC](https://discuss.elastic.co/t/bulk-indexing-of-signals-failed-no-such-index-alerts-security-alerts-default-and-require-alias-request-flag-is-true/323437 "2023-01-19T04:48:35Z")
Hi everybody. i just removed .alerts-security.alerts-default-0000 suddenly after i was working with rules and made my dashboards. is there a way to recreate it? because it gives me this error: Bulk indexing of signals… --- ## [How to build QueryBuilder to search for the map of entry's in ElasticSearch index](https://discuss.elastic.co/t/how-to-build-querybuilder-to-search-for-the-map-of-entrys-in-elasticsearch-index/323469)
**Author:** [@SandhyaRani](https://discuss.elastic.co/u/SandhyaRani)\ **Replies:** 0\ **Last updated:** [January 19, 2023, 4:40am UTC](https://discuss.elastic.co/t/how-to-build-querybuilder-to-search-for-the-map-of-entrys-in-elasticsearch-index/323469 "2023-01-19T04:40:10Z")
I would need queryBuilder to search the index with entire map of values and return documents only if all map values matched in ES index. I could do for set of values like below val sampleSet = setOf("foo", "bar") val … [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=312) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=314)