# Elasticsearch

**URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=327

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 328

---

## [Amazon like search feature](https://discuss.elastic.co/t/amazon-like-search-feature/321458)

<div class="topic-metadata">

**Author:** [@Divit\_Sharma](https://discuss.elastic.co/u/Divit_Sharma)\
**Replies:** 1\
**Last updated:** [December 18, 2022, 10:54pm UTC](https://discuss.elastic.co/t/amazon-like-search-feature/321458 "2022-12-18T22:54:43Z")

</div>

I have a query about Elasticsearch text search use case and I couldn't find any article/blogs on it. I want to implement a feature (similar to Amazon.com) where user can type "tshirt below 500" and the searches would re…

---

## [Can not configure elastic search when running elasticsearch.bat](https://discuss.elastic.co/t/can-not-configure-elastic-search-when-running-elasticsearch-bat/321410)

<div class="topic-metadata">

**Author:** [@sezohessen](https://discuss.elastic.co/u/sezohessen)\
**Replies:** 2\
**Last updated:** [December 18, 2022, 10:51pm UTC](https://discuss.elastic.co/t/can-not-configure-elastic-search-when-running-elasticsearch-bat/321410 "2022-12-18T22:51:02Z")

</div>

warning: ignoring JAVA\_HOME=C:\\Program Files\\Java\\jdk-19.0.1; using bundled JDK Exception in thread "main" java.lang.RuntimeException: starting java failed with \[1\] output: error: Unrecognized VM option 'UseConcMarkS…

---

## [Elasticsearch Authentication problem in python](https://discuss.elastic.co/t/elasticsearch-authentication-problem-in-python/321293)

<div class="topic-metadata">

**Author:** [@cristian.salcedo](https://discuss.elastic.co/u/cristian.salcedo)\
**Replies:** 1\
**Last updated:** [December 18, 2022, 10:35pm UTC](https://discuss.elastic.co/t/elasticsearch-authentication-problem-in-python/321293 "2022-12-18T22:35:35Z")

</div>

Hí, I am making an application to query elasticsearch and I get an error when launching the query: ElasticsearchWarning: The client is unable to verify that the server is Elasticsearch due security privileges on the se…

---

## [Can the sorting order of doc\_values arrays be controlled?](https://discuss.elastic.co/t/can-the-sorting-order-of-doc-values-arrays-be-controlled/321304)

<div class="topic-metadata">

**Author:** [@David\_Michael\_Gang](https://discuss.elastic.co/u/David_Michael_Gang)\
**Replies:** 1\
**Last updated:** [December 18, 2022, 10:33pm UTC](https://discuss.elastic.co/t/can-the-sorting-order-of-doc-values-arrays-be-controlled/321304 "2022-12-18T22:33:00Z")

</div>

As written in the documentation Doc values are the on-disk data structure, built at document index time, which makes this data access pattern possible. They store the same values as the \_source but in a column-oriented…

---

## [Logstach configuration for ealsticsearch cluster with multiple nodes](https://discuss.elastic.co/t/logstach-configuration-for-ealsticsearch-cluster-with-multiple-nodes/321469)

<div class="topic-metadata">

**Author:** [@SaM9](https://discuss.elastic.co/u/SaM9)\
**Replies:** 3\
**Last updated:** [December 17, 2022, 7:33pm UTC](https://discuss.elastic.co/t/logstach-configuration-for-ealsticsearch-cluster-with-multiple-nodes/321469 "2022-12-17T19:33:02Z")

</div>

In my ealstic stack I have 3 master node (dedicated master and 2 Eligible master ) my question is in my logstach configuration file in the output pluging what should I set as destination : the ip address of all the thr…

---

## [Why do I get empty buckets when I aggregate on nested field?](https://discuss.elastic.co/t/why-do-i-get-empty-buckets-when-i-aggregate-on-nested-field/321465)

<div class="topic-metadata">

**Author:** [@learningelastic](https://discuss.elastic.co/u/learningelastic)\
**Replies:** 0\
**Last updated:** [December 17, 2022, 5:23pm UTC](https://discuss.elastic.co/t/why-do-i-get-empty-buckets-when-i-aggregate-on-nested-field/321465 "2022-12-17T17:23:27Z")

</div>

I'm trying to count() the network.protocol field when grouped by network.protocol. So I tried something like this: GET .ds-packetbeat-8.5.3-2022.12.14-000001/\_search { "aggs": { "network": { "nested": { …

---

## [Elasticsearch is incompatible with new versions of openjdk from redhat](https://discuss.elastic.co/t/elasticsearch-is-incompatible-with-new-versions-of-openjdk-from-redhat/318928)

<div class="topic-metadata">

**Author:** [@sayfeddine](https://discuss.elastic.co/u/sayfeddine)\
**Replies:** 11\
**Last updated:** [December 17, 2022, 1:55pm UTC](https://discuss.elastic.co/t/elasticsearch-is-incompatible-with-new-versions-of-openjdk-from-redhat/318928 "2022-12-17T13:55:54Z")

</div>

Redhat introduced a new change in their openjdk packages (starting from 1.8.0-345.b01-5.el8\_7) for rhel 8.7 where they check for the system cacert automatically when you initialize a new trustmanager object (even without…

---

## [Sum Aggregation using multiple fields](https://discuss.elastic.co/t/sum-aggregation-using-multiple-fields/321357)

<div class="topic-metadata">

**Author:** [@searchwithme](https://discuss.elastic.co/u/searchwithme)\
**Replies:** 5\
**Last updated:** [December 16, 2022, 7:02pm UTC](https://discuss.elastic.co/t/sum-aggregation-using-multiple-fields/321357 "2022-12-16T19:02:00Z")

</div>

Hi team! I am indexing the following sample data: travel index Flight price - 550 Hotel price - 220 Meals - 120 (Total Expense - 890) If I query for travel index with total expense \< 1000, it should return result…

---

## [Nested query inside the function\_score](https://discuss.elastic.co/t/nested-query-inside-the-function-score/321428)

<div class="topic-metadata">

**Author:** [@Kankipati\_rajaram](https://discuss.elastic.co/u/Kankipati_rajaram)\
**Replies:** 0\
**Last updated:** [December 16, 2022, 6:28pm UTC](https://discuss.elastic.co/t/nested-query-inside-the-function-score/321428 "2022-12-16T18:28:07Z")

</div>

I have the following document schema "properties": { "doc\_id": {"type": "long"}, "cortex\_id": {"type": "long"}, "sentence\_embedding": { …

---

## [Enrich processor is sometimes not enriching](https://discuss.elastic.co/t/enrich-processor-is-sometimes-not-enriching/321188)

<div class="topic-metadata">

**Author:** [@siginigin](https://discuss.elastic.co/u/siginigin)\
**Replies:** 1\
**Last updated:** [December 16, 2022, 2:06pm UTC](https://discuss.elastic.co/t/enrich-processor-is-sometimes-not-enriching/321188 "2022-12-16T14:06:55Z")

</div>

Hi, I have pipeline with enrich processor for user enriching and another pipeline with enrich processor for vulnerability enriching. Both pipelines are in parent logs\_syslog pipeline. I noticed some events are not enri…

---

## [ElasticSearch pri.store.size](https://discuss.elastic.co/t/elasticsearch-pri-store-size/321397)

<div class="topic-metadata">

**Author:** [@gjahagir](https://discuss.elastic.co/u/gjahagir)\
**Replies:** 2\
**Last updated:** [December 16, 2022, 1:43pm UTC](https://discuss.elastic.co/t/elasticsearch-pri-store-size/321397 "2022-12-16T13:43:58Z")

</div>

Hi, We are performing capacity planning in elastic to evaluate the storage sizes. For this we indexed one doc with dummy fields (7 simple fields and 13 nested) took the size of the doc which is 1148 bytes. Then we ex…

---

## [Cannot pass param in sql command](https://discuss.elastic.co/t/cannot-pass-param-in-sql-command/321398)

<div class="topic-metadata">

**Author:** [@thanhdinh98](https://discuss.elastic.co/u/thanhdinh98)\
**Replies:** 2\
**Last updated:** [December 16, 2022, 12:07pm UTC](https://discuss.elastic.co/t/cannot-pass-param-in-sql-command/321398 "2022-12-16T12:07:52Z")

</div>

Hi everyone, I just face a problem in passing a param value in SQL command, The request is something like this { "query": "select \* from index where field in (?)", "params": \[ \[ "value1", "value2" …

---

## [Ldap Authorization from certain OU](https://discuss.elastic.co/t/ldap-authorization-from-certain-ou/321404)

<div class="topic-metadata">

**Author:** [@Aleksei](https://discuss.elastic.co/u/Aleksei)\
**Replies:** 0\
**Last updated:** [December 16, 2022, 11:29am UTC](https://discuss.elastic.co/t/ldap-authorization-from-certain-ou/321404 "2022-12-16T11:29:45Z")

</div>

Hi all. The question is how to properly configure the config for authorization through LDAP so that you can specify certain OU ( Organizational Unit ) from which users can log in ? As I understood from the article, thi…

---

## [\_id is not unique. is repeated in indexes addressed by a single alias](https://discuss.elastic.co/t/id-is-not-unique-is-repeated-in-indexes-addressed-by-a-single-alias/321386)

<div class="topic-metadata">

**Author:** [@Petr.Simik](https://discuss.elastic.co/u/Petr.Simik)\
**Replies:** 4\
**Last updated:** [December 16, 2022, 10:55am UTC](https://discuss.elastic.co/t/id-is-not-unique-is-repeated-in-indexes-addressed-by-a-single-alias/321386 "2022-12-16T10:55:12Z")

</div>

I experience the situation that index is having multiple same \_id within the same index I have version 7.17.0 the data are ingested by python requests lib via API this way the uniqueness is broken among multiple inde…

---

## [ElasticSearch Low Level Client search using anonymous type](https://discuss.elastic.co/t/elasticsearch-low-level-client-search-using-anonymous-type/320668)

<div class="topic-metadata">

**Author:** [@gjahagir](https://discuss.elastic.co/u/gjahagir)\
**Replies:** 2\
**Last updated:** [December 16, 2022, 10:13am UTC](https://discuss.elastic.co/t/elasticsearch-low-level-client-search-using-anonymous-type/320668 "2022-12-16T10:13:38Z")

</div>

Hi, We are exploring Elastic search to see if it fits into our application requirements. We would want to search using anonymous type, here is what i found in the documentation - var searchResponse = lowlevelClient.Se…

---

## [Complex filter query](https://discuss.elastic.co/t/complex-filter-query/321234)

<div class="topic-metadata">

**Author:** [@Henri\_L](https://discuss.elastic.co/u/Henri_L)\
**Replies:** 1\
**Last updated:** [December 15, 2022, 9:38pm UTC](https://discuss.elastic.co/t/complex-filter-query/321234 "2022-12-15T21:38:46Z")

</div>

Sorry if it might be obvious but I'm stuck with this query. Here are some example input: { "\_index" : "education", "\_type" : "logs", "\_id" : "educ\_0610426G", "\_score" : 10.917585, …

---

## [Elasticsearch 7.17.8 mvnrepository artifact](https://discuss.elastic.co/t/elasticsearch-7-17-8-mvnrepository-artifact/320775)

<div class="topic-metadata">

**Author:** [@Charis\_Yfantis](https://discuss.elastic.co/u/Charis_Yfantis)\
**Replies:** 4\
**Last updated:** [December 16, 2022, 8:27am UTC](https://discuss.elastic.co/t/elasticsearch-7-17-8-mvnrepository-artifact/320775 "2022-12-16T08:27:59Z")

</div>

Hello everyone, I just upgraded elasticsearch to 7.17.8 and i need to build a plugin for that version, but it seems https://mvnrepository.com/artifact/org.elasticsearch/elasticsearch does not have the artifact for 7.17…

---

## [How to use custom ID for inserting document using java sdk](https://discuss.elastic.co/t/how-to-use-custom-id-for-inserting-document-using-java-sdk/321380)

<div class="topic-metadata">

**Author:** [@suresh\_chaudhari](https://discuss.elastic.co/u/suresh_chaudhari)\
**Replies:** 1\
**Last updated:** [December 16, 2022, 7:44am UTC](https://discuss.elastic.co/t/how-to-use-custom-id-for-inserting-document-using-java-sdk/321380 "2022-12-16T07:44:32Z")

</div>

Hi I want to use java sdk to insert document using ID .I will have custom my own IDs to insert docs. Thanks Suresh

---

## [Log requests](https://discuss.elastic.co/t/log-requests/321216)

<div class="topic-metadata">

**Author:** [@lubosvr](https://discuss.elastic.co/u/lubosvr)\
**Replies:** 2\
**Last updated:** [December 16, 2022, 7:29am UTC](https://discuss.elastic.co/t/log-requests/321216 "2022-12-16T07:29:00Z")

</div>

Hi, I'm migrating from the High Level Rest Client to Java Client and have problem to log the requests that are sent to ES. I'm not using direct query, but somethink like this: final var countRequest = new CountRequest…

---

## [Does elastic support transfer old data to ecs format?](https://discuss.elastic.co/t/does-elastic-support-transfer-old-data-to-ecs-format/321378)

<div class="topic-metadata">

**Author:** [@alex\_su](https://discuss.elastic.co/u/alex_su)\
**Replies:** 0\
**Last updated:** [December 16, 2022, 7:06am UTC](https://discuss.elastic.co/t/does-elastic-support-transfer-old-data-to-ecs-format/321378 "2022-12-16T07:06:30Z")

</div>

Hi, I want to know if i have old data (ex: windows event log) as below , does elasitc has package support transfer this format to ecs ? thanks. "{ ""configSource"": ""XXX"", ""\_User"": """", ""@version"": ""1"", …

---

## [Update Fields Based On The Same Value Of The Other Field (Same Index)](https://discuss.elastic.co/t/update-fields-based-on-the-same-value-of-the-other-field-same-index/321376)

<div class="topic-metadata">

**Author:** [@baoletrg](https://discuss.elastic.co/u/baoletrg)\
**Replies:** 0\
**Last updated:** [December 16, 2022, 6:52am UTC](https://discuss.elastic.co/t/update-fields-based-on-the-same-value-of-the-other-field-same-index/321376 "2022-12-16T06:52:29Z")

</div>

Hi guys, Im new to ELK and have googled for a solution for this case. For example, in my index, one transaction has 3 records logged, they all has the same ofsID field. Then I want to update a field named durationTime in…

---

## [Confused issue when I search indices using wildcard pattern](https://discuss.elastic.co/t/confused-issue-when-i-search-indices-using-wildcard-pattern/321369)

<div class="topic-metadata">

**Author:** [@Young\_Edmond](https://discuss.elastic.co/u/Young_Edmond)\
**Replies:** 0\
**Last updated:** [December 16, 2022, 6:01am UTC](https://discuss.elastic.co/t/confused-issue-when-i-search-indices-using-wildcard-pattern/321369 "2022-12-16T06:01:14Z")

</div>

Hi. I meet such interesting issue, I have created 3 indices named as below es-os-complex-neo-000001 es-os-complex-neo-000002 es-os-complex-neo-yudyang, when I try to get index using the specific name in dev tools, …

---

## [Can I add normalizer in runtime?](https://discuss.elastic.co/t/can-i-add-normalizer-in-runtime/321323)

<div class="topic-metadata">

**Author:** [@Michal\_Stefaniuk](https://discuss.elastic.co/u/Michal_Stefaniuk)\
**Replies:** 1\
**Last updated:** [December 16, 2022, 5:18am UTC](https://discuss.elastic.co/t/can-i-add-normalizer-in-runtime/321323 "2022-12-16T05:18:28Z")

</div>

Hey guys! I want to add a new field into my existing mapping (using dynamic templates as well). As far as I understand the best way to do it is to use update mapping API (Update mapping API | Elasticsearch Guide \[8.5\] |…

---

## [Elasticsearch-js ConnectionError: socket hang up](https://discuss.elastic.co/t/elasticsearch-js-connectionerror-socket-hang-up/321359)

<div class="topic-metadata">

**Author:** [@Jinhyuck\_Cha](https://discuss.elastic.co/u/Jinhyuck_Cha)\
**Replies:** 0\
**Last updated:** [December 16, 2022, 2:31am UTC](https://discuss.elastic.co/t/elasticsearch-js-connectionerror-socket-hang-up/321359 "2022-12-16T02:31:50Z")

</div>

hi I'm try to make github ci test flow in my project But there are a issue about ConnectionError: socket hang up I don't know what it is happen. Because this docker-file is well work in my local dev environment. How …

---

## [Index sizes increasing after upgrade from 7.10.2 -\> 7.17.0](https://discuss.elastic.co/t/index-sizes-increasing-after-upgrade-from-7-10-2-7-17-0/321352)

<div class="topic-metadata">

**Author:** [@zfisher](https://discuss.elastic.co/u/zfisher)\
**Replies:** 0\
**Last updated:** [December 15, 2022, 10:24pm UTC](https://discuss.elastic.co/t/index-sizes-increasing-after-upgrade-from-7-10-2-7-17-0/321352 "2022-12-15T22:24:29Z")

</div>

We recently upgraded our cluster from version 7.10.2 to version 7.17 and have noticed that, starting on the day of the upgrade, the total storage size for our indices has grown while our event count has stayed relatively…

---

## [Elastcisearch](https://discuss.elastic.co/t/elastcisearch/321319)

<div class="topic-metadata">

**Author:** [@Sarthak\_Agarwal](https://discuss.elastic.co/u/Sarthak_Agarwal)\
**Replies:** 0\
**Last updated:** [December 15, 2022, 2:46pm UTC](https://discuss.elastic.co/t/elastcisearch/321319 "2022-12-15T14:46:51Z")

</div>

I am using the last Java Client API for Elasticsearch 7.17.5. I have a boolean query builder and I want to add conditions before checking if a must clause is already there or not. But the issue is that I can build the q…

---

## [Mapping conflict between object, text, & keyword](https://discuss.elastic.co/t/mapping-conflict-between-object-text-keyword/321343)

<div class="topic-metadata">

**Author:** [@datdoo](https://discuss.elastic.co/u/datdoo)\
**Replies:** 2\
**Last updated:** [December 15, 2022, 8:39pm UTC](https://discuss.elastic.co/t/mapping-conflict-between-object-text-keyword/321343 "2022-12-15T20:39:59Z")

</div>

I have this mapping currently "response": { "properties": { "body": { "properties": { "id": { "type": "long" }, "json…

---

## [.net client application log not creating index in elasticsearch](https://discuss.elastic.co/t/net-client-application-log-not-creating-index-in-elasticsearch/321259)

<div class="topic-metadata">

**Author:** [@rajvel](https://discuss.elastic.co/u/rajvel)\
**Replies:** 4\
**Last updated:** [December 15, 2022, 4:41pm UTC](https://discuss.elastic.co/t/net-client-application-log-not-creating-index-in-elasticsearch/321259 "2022-12-15T16:41:38Z")

</div>

Hello Team, we have .net application we used .net client elasticsearch to share the log to new index. Recently we haven't received any new index created by .net application. there is no way to find the whether the inde…

---

## [Migrate from NEST 6.6 to ElasticSearch client 8](https://discuss.elastic.co/t/migrate-from-nest-6-6-to-elasticsearch-client-8/321288)

<div class="topic-metadata">

**Author:** [@apokryfos](https://discuss.elastic.co/u/apokryfos)\
**Replies:** 1\
**Last updated:** [December 15, 2022, 3:15pm UTC](https://discuss.elastic.co/t/migrate-from-nest-6-6-to-elasticsearch-client-8/321288 "2022-12-15T15:15:36Z")

</div>

I've recently upgraded my Elasticsearch server from 6.6 to 8.5 (quite a jump I know but it was long overdue). The main process to create/updated indexes is written in C# and was previously using NEST. I originally asked…

---

## [High cpu usage after ES update to 7.17.7](https://discuss.elastic.co/t/high-cpu-usage-after-es-update-to-7-17-7/321143)

<div class="topic-metadata">

**Author:** [@anon90868141](https://discuss.elastic.co/u/anon90868141)\
**Replies:** 14\
**Last updated:** [December 15, 2022, 2:40pm UTC](https://discuss.elastic.co/t/high-cpu-usage-after-es-update-to-7-17-7/321143 "2022-12-15T14:40:59Z")

</div>

Hello, after an update from 7.16.2 to 7.17.7, we're experiencing about double the CPU usage without changing anything else. This happens during all time and the usage basically never dropped below the new baseline. When…

[Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=326)

[Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=328)
