# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=328 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 329 --- ## [Learning to Rank not working for nested field type](https://discuss.elastic.co/t/learning-to-rank-not-working-for-nested-field-type/321182)
**Author:** [@varunbharti48](https://discuss.elastic.co/u/varunbharti48)\ **Replies:** 1\ **Last updated:** [December 15, 2022, 2:34pm UTC](https://discuss.elastic.co/t/learning-to-rank-not-working-for-nested-field-type/321182 "2022-12-15T14:34:29Z")
Hi, I am implementing learning to rank on a nested field type. It is working completely fine for object field type(non-nested). But in case of nested field we are using score\_mode : "sum" to cumulate the score of child … --- ## [2 aliases to 1 index with rollover](https://discuss.elastic.co/t/2-aliases-to-1-index-with-rollover/321313)
**Author:** [@avnere](https://discuss.elastic.co/u/avnere)\ **Replies:** 3\ **Last updated:** [December 15, 2022, 2:30pm UTC](https://discuss.elastic.co/t/2-aliases-to-1-index-with-rollover/321313 "2022-12-15T14:30:23Z")
Hi, I want to define two aliases to index with rollover. I have set the following: PUT \_ilm/policy/policy1 { "policy": { "phases": { "hot": { "actions": { "rollover": { "max\_… --- ## [Best strategy for re-indexing?](https://discuss.elastic.co/t/best-strategy-for-re-indexing/320567)
**Author:** [@Michal\_Stefaniuk](https://discuss.elastic.co/u/Michal_Stefaniuk)\ **Replies:** 5\ **Last updated:** [December 15, 2022, 11:56am UTC](https://discuss.elastic.co/t/best-strategy-for-re-indexing/320567 "2022-12-15T11:56:15Z")
Hey guys! I have an index in my ES and apparently I've added a new fields in the mapping (on the spring boot application side). Now the application will be released to the client and on the client side we will have to c… --- ## [Different Query format for wildcard query and term query](https://discuss.elastic.co/t/different-query-format-for-wildcard-query-and-term-query/321250)
**Author:** [@adholpuria](https://discuss.elastic.co/u/adholpuria)\ **Replies:** 2\ **Last updated:** [December 15, 2022, 10:50am UTC](https://discuss.elastic.co/t/different-query-format-for-wildcard-query-and-term-query/321250 "2022-12-15T10:50:59Z")
Hey community, I am currently using below mentioned query format for term query { "query": { "term": { "core.externalId": "Kimchy" } } Below is the query format described in Elasticsearch Document Ter… --- ## [Transforms combining pivot & latest](https://discuss.elastic.co/t/transforms-combining-pivot-latest/321193)
**Author:** [@ylasri](https://discuss.elastic.co/u/ylasri)\ **Replies:** 5\ **Last updated:** [December 15, 2022, 10:35am UTC](https://discuss.elastic.co/t/transforms-combining-pivot-latest/321193 "2022-12-15T10:35:17Z")
Hello, I have a case where i pivot data based on : @timestamp (interval of 1 day) Entity (let say customer\_account) A customer\_account can order items any time, so raw data are like : order\_id @timestamp product\_i… --- ## [Forward logs from Kafka to Elastic](https://discuss.elastic.co/t/forward-logs-from-kafka-to-elastic/320075)
**Author:** [@Deepika1](https://discuss.elastic.co/u/Deepika1)\ **Replies:** 3\ **Last updated:** [December 15, 2022, 10:10am UTC](https://discuss.elastic.co/t/forward-logs-from-kafka-to-elastic/320075 "2022-12-15T10:10:44Z")
Hello, I'm trying to forward logs from Kafka machine to Elasticsearch machine using kafka elastic connect referring below document configurations are: name=elasticsearch-sink connector.class=io.confluent.connect.ela… --- ## [Can't get started with the ElasticSearch Java API classes](https://discuss.elastic.co/t/cant-get-started-with-the-elasticsearch-java-api-classes/320951)
**Author:** [@Alain\_Desilets](https://discuss.elastic.co/u/Alain_Desilets)\ **Replies:** 2\ **Last updated:** [December 15, 2022, 10:10am UTC](https://discuss.elastic.co/t/cant-get-started-with-the-elasticsearch-java-api-classes/320951 "2022-12-15T10:10:02Z")
I am am having a hell of a time trying to get started with the ES Java API using the instructions on the official doc I install it as instructed here, i.e., I put this in my pom.xml file: \ \ **Author:** [@mpniel](https://discuss.elastic.co/u/mpniel)\ **Replies:** 9\ **Last updated:** [December 15, 2022, 9:15am UTC](https://discuss.elastic.co/t/7-5-how-to-grant-a-user-permission-to-create-an-index-pattern/319588 "2022-12-15T09:15:37Z") Hi \[7.5\] How to grant a user permission to create an index pattern? --- ## [Socket timeout using the v8 driver](https://discuss.elastic.co/t/socket-timeout-using-the-v8-driver/321197)
**Author:** [@Mhanna\_Abu\_Tareef](https://discuss.elastic.co/u/Mhanna_Abu_Tareef)\ **Replies:** 1\ **Last updated:** [December 15, 2022, 8:14am UTC](https://discuss.elastic.co/t/socket-timeout-using-the-v8-driver/321197 "2022-12-15T08:14:15Z")
Just moved to the new elastic client v8, but not able to overcome this annoying issue. a single request - create index - fails by timeout in the server log i can see the index got created the delete index right after … --- ## [Shard size increase right after rollover](https://discuss.elastic.co/t/shard-size-increase-right-after-rollover/321261)
**Author:** [@nairobi](https://discuss.elastic.co/u/nairobi)\ **Replies:** 2\ **Last updated:** [December 15, 2022, 7:48am UTC](https://discuss.elastic.co/t/shard-size-increase-right-after-rollover/321261 "2022-12-15T07:48:01Z")
I have index that primaries 3 replicas 1 ilm: roll over when any primary shard reaches 50gb (hot to warm) So when it reached to 300gb, it roll over to warm phase. But after it roll over, size of shard increase to abo… --- ## [Show first record of each group](https://discuss.elastic.co/t/show-first-record-of-each-group/319446)
**Author:** [@johnnyh](https://discuss.elastic.co/u/johnnyh)\ **Replies:** 2\ **Last updated:** [December 15, 2022, 7:41am UTC](https://discuss.elastic.co/t/show-first-record-of-each-group/319446 "2022-12-15T07:41:21Z")
Hi guys, I have been trying to find a way perform group by, and then obtaining the first of each group. This set should also be filterable and sort-able, and should also be able to count each group. Wondering if what I… --- ## [FOR Weekly Index ISM Policy](https://discuss.elastic.co/t/for-weekly-index-ism-policy/321255)
**Author:** [@dharminfadia](https://discuss.elastic.co/u/dharminfadia)\ **Replies:** 5\ **Last updated:** [December 15, 2022, 6:43am UTC](https://discuss.elastic.co/t/for-weekly-index-ism-policy/321255 "2022-12-15T06:43:14Z")
Hello Guys I am using Elasticsearch 7.10.2 I have 6 Data node Cluster in this Cluster I am Facing Space Issue so I set Index Policy for Daily Index but I am having Monthly and Weekly Index I want setup Automatically Del… --- ## [Windows event logs into the ECS format](https://discuss.elastic.co/t/windows-event-logs-into-the-ecs-format/321002)
**Author:** [@alex\_su](https://discuss.elastic.co/u/alex_su)\ **Replies:** 2\ **Last updated:** [December 15, 2022, 5:53am UTC](https://discuss.elastic.co/t/windows-event-logs-into-the-ecs-format/321002 "2022-12-15T05:53:57Z")
Hello, I want to ask how to use python convert windows event logs into the ECS format. not use beats or logstash method. --- ## [Unable to Connect to ElasticSearch](https://discuss.elastic.co/t/unable-to-connect-to-elasticsearch/321254)
**Author:** [@makarand](https://discuss.elastic.co/u/makarand)\ **Replies:** 2\ **Last updated:** [December 15, 2022, 5:51am UTC](https://discuss.elastic.co/t/unable-to-connect-to-elasticsearch/321254 "2022-12-15T05:51:39Z")
Hi guys can you please look into this? It is taking too much of my time. This is an error regarding connection from nodeJs client to Elasticsearch. Trying to connect to elasticsearch domain using lambda and elasticse… --- ## [Authenticating with built-in users](https://discuss.elastic.co/t/authenticating-with-built-in-users/321246)
**Author:** [@zirota](https://discuss.elastic.co/u/zirota)\ **Replies:** 2\ **Last updated:** [December 15, 2022, 4:55am UTC](https://discuss.elastic.co/t/authenticating-with-built-in-users/321246 "2022-12-15T04:55:08Z")
Hello, I ran into some problems with authenticating with built-in users (in this case elastic) on my cluster nodes other than the master. I have a cluster setup on 8.5.3: 3 master nodes 4 data nodes 2 coordinator node… --- ## [Circle radius propblem v8.5.3](https://discuss.elastic.co/t/circle-radius-propblem-v8-5-3/321091)
**Author:** [@Dat\_Le\_Tien](https://discuss.elastic.co/u/Dat_Le_Tien)\ **Replies:** 4\ **Last updated:** [December 15, 2022, 3:08am UTC](https://discuss.elastic.co/t/circle-radius-propblem-v8-5-3/321091 "2022-12-15T03:08:52Z")
I'm trying to insert a location that is using a circle processor to generate the circle points. Location \[30, 10\] in the document is generated with the circle points properly. docs: Circle processor | Elasticsearch Guid… --- ## [Automatically remove old reports](https://discuss.elastic.co/t/automatically-remove-old-reports/321201)
**Author:** [@JohnJ\_M](https://discuss.elastic.co/u/JohnJ_M)\ **Replies:** 2\ **Last updated:** [December 14, 2022, 11:46pm UTC](https://discuss.elastic.co/t/automatically-remove-old-reports/321201 "2022-12-14T23:46:22Z")
Hi the community. I've alerters that generates multiple report once per week sent per mail automatically. Reports older than 2 weeks are not necessary and I want to be able to setup an automatic cleaning of those report… --- ## [Caused by: javax.net.ssl.SSLHandshakeException: No available authentication scheme](https://discuss.elastic.co/t/caused-by-javax-net-ssl-sslhandshakeexception-no-available-authentication-scheme/321207)
**Author:** [@hello5346](https://discuss.elastic.co/u/hello5346)\ **Replies:** 0\ **Last updated:** [December 14, 2022, 10:34am UTC](https://discuss.elastic.co/t/caused-by-javax-net-ssl-sslhandshakeexception-no-available-authentication-scheme/321207 "2022-12-14T10:34:30Z")
we have started a new ealsticsearch 3 node cluster with the following yaml. cluster.name: elk-aws node.name: ip-10-22-221-24 node.master: true node.data: true path.logs: /var/log/elasticsearch network.host: 10.22.221.2… --- ## [Add Metric Aggregation inside the bucket aggregation query to get metrics of all buckets using DSL Query](https://discuss.elastic.co/t/add-metric-aggregation-inside-the-bucket-aggregation-query-to-get-metrics-of-all-buckets-using-dsl-query/321217)
**Author:** [@Divyank\_Mahalle](https://discuss.elastic.co/u/Divyank_Mahalle)\ **Replies:** 1\ **Last updated:** [December 14, 2022, 7:27pm UTC](https://discuss.elastic.co/t/add-metric-aggregation-inside-the-bucket-aggregation-query-to-get-metrics-of-all-buckets-using-dsl-query/321217 "2022-12-14T19:27:39Z")
Hi, I am able to get bucket aggregation results for below DSL Query,But I want to get metric aggregation for all buckets inside the same bucket aggregation query. Bucket aggrgation query: { "size": 0, "query":… --- ## [Can I run multiple Elasticsearch instances in one server?](https://discuss.elastic.co/t/can-i-run-multiple-elasticsearch-instances-in-one-server/321230)
**Author:** [@Lakshmi\_Kumari](https://discuss.elastic.co/u/Lakshmi_Kumari)\ **Replies:** 3\ **Last updated:** [December 14, 2022, 5:50pm UTC](https://discuss.elastic.co/t/can-i-run-multiple-elasticsearch-instances-in-one-server/321230 "2022-12-14T17:50:50Z")
Can I run multiple Elasticsearch instances in one server? -If yes, How can I install 2 Elasticsearch instances in a single Linux server. I am aware if we use "yum install" will be installed without any issue. Thanks i… --- ## [Abnormal Datafeeding detected in Anomaly Detection Jobs](https://discuss.elastic.co/t/abnormal-datafeeding-detected-in-anomaly-detection-jobs/320672)
**Author:** [@Souvik\_Das](https://discuss.elastic.co/u/Souvik_Das)\ **Replies:** 1\ **Last updated:** [December 14, 2022, 5:47pm UTC](https://discuss.elastic.co/t/abnormal-datafeeding-detected-in-anomaly-detection-jobs/320672 "2022-12-14T17:47:58Z")
Hi Team, There are a couple of machine learning jobs currently running in our ELK environment. With this, we have configured watcher alerts also, based on the record-level anomaly score. Since a few days back, we've bee… --- ## [Log collector solution](https://discuss.elastic.co/t/log-collector-solution/320964)
**Author:** [@Indeed2000](https://discuss.elastic.co/u/Indeed2000)\ **Replies:** 2\ **Last updated:** [December 14, 2022, 3:32pm UTC](https://discuss.elastic.co/t/log-collector-solution/320964 "2022-12-14T15:32:48Z")
Hi TL;DR: need log collector for file with minimum configuration, and support different conditions. I have 3 servers that generate log file daily with size about 12GB (12\*3=36GB) How can I gather these files on centra… --- ## [Recompute event.hash for documents in cold indices](https://discuss.elastic.co/t/recompute-event-hash-for-documents-in-cold-indices/321203)
**Author:** [@ivo.raisr](https://discuss.elastic.co/u/ivo.raisr)\ **Replies:** 0\ **Last updated:** [December 14, 2022, 9:55am UTC](https://discuss.elastic.co/t/recompute-event-hash-for-documents-in-cold-indices/321203 "2022-12-14T09:55:42Z")
For certain datasets which contain important log events, logstash pipeline computes event.hash, using fingerprint filter with SHA256 method and a key, over all the event fields. The events are then ingested into elastics… --- ## [How to consume a Elastic indexs between different Clouds](https://discuss.elastic.co/t/how-to-consume-a-elastic-indexs-between-different-clouds/321162)
**Author:** [@Rodrigoscotti](https://discuss.elastic.co/u/Rodrigoscotti)\ **Replies:** 5\ **Last updated:** [December 14, 2022, 12:35pm UTC](https://discuss.elastic.co/t/how-to-consume-a-elastic-indexs-between-different-clouds/321162 "2022-12-14T12:35:15Z")
We run Elasticsearch using a self-hosting solution from GCP. Our services consume a BD in Elastic to work correctly. A new client asks us if it is possible to consume their Elastic BD directly from their Elastic self-hos… --- ## [Send raw logs to elastic server](https://discuss.elastic.co/t/send-raw-logs-to-elastic-server/321096)
**Author:** [@Indeed2000](https://discuss.elastic.co/u/Indeed2000)\ **Replies:** 13\ **Last updated:** [December 14, 2022, 11:54am UTC](https://discuss.elastic.co/t/send-raw-logs-to-elastic-server/321096 "2022-12-14T11:54:36Z")
Hi I have 2 question about elastic 1-how can i send all files located in specific path with random name via filebeat like this: /var/log/app/serverlog.log /var/log/app/applog.log /var/log/app/exceptionlog.log ... t… --- ## [Timestamp includes different timezones](https://discuss.elastic.co/t/timestamp-includes-different-timezones/321190)
**Author:** [@PRASHANT\_MEHTA](https://discuss.elastic.co/u/PRASHANT_MEHTA)\ **Replies:** 1\ **Last updated:** [December 14, 2022, 11:52am UTC](https://discuss.elastic.co/t/timestamp-includes-different-timezones/321190 "2022-12-14T11:52:41Z")
Hello All, In response from backend data I have event with timezone, i have added one field in elastic templte :nextEvent. The date format of above fields are important, it has timezone in it.. like below: "nextEvent"… --- ## [Skip xpack authentication for a specific endpoint](https://discuss.elastic.co/t/skip-xpack-authentication-for-a-specific-endpoint/321122)
**Author:** [@smiley\_tamy](https://discuss.elastic.co/u/smiley_tamy)\ **Replies:** 3\ **Last updated:** [December 14, 2022, 11:34am UTC](https://discuss.elastic.co/t/skip-xpack-authentication-for-a-specific-endpoint/321122 "2022-12-14T11:34:54Z")
I have enabled x-pack and all the requests are expected to provide the credentials to access Elasticsearch. I have a scenario where for certain endpoints, I must be able to access without providing credentials. It means… --- ## [Configuration LDAPS](https://discuss.elastic.co/t/configuration-ldaps/320441)
**Author:** [@Aleksei](https://discuss.elastic.co/u/Aleksei)\ **Replies:** 8\ **Last updated:** [December 14, 2022, 11:29am UTC](https://discuss.elastic.co/t/configuration-ldaps/320441 "2022-12-14T11:29:20Z")
Hi everybody. Tell me please. I'm trying to set up a config for authorization via LDAP. I can't understand this setting xpack: security: authc: realms: ldap: ldap1: order: 0 url: "ldaps://ldap.example.com:636" … --- ## [Elasticsearch-create-enrollment-token using IP from wrong ethernet adaptor](https://discuss.elastic.co/t/elasticsearch-create-enrollment-token-using-ip-from-wrong-ethernet-adaptor/320999)
**Author:** [@vimalv](https://discuss.elastic.co/u/vimalv)\ **Replies:** 5\ **Last updated:** [December 14, 2022, 10:55am UTC](https://discuss.elastic.co/t/elasticsearch-create-enrollment-token-using-ip-from-wrong-ethernet-adaptor/320999 "2022-12-14T10:55:52Z")
Hi, We have two ethernet adaptors and hence 2 IPs, When we try to generate enrollment token, it always uses 2nd IP by default. Is there any way to override the default and specify which IP to use or can we use hostname… --- ## [Send mustach tag in Weebhook call without having it interpreted?](https://discuss.elastic.co/t/send-mustach-tag-in-weebhook-call-without-having-it-interpreted/320165)
**Author:** [@JohnJ\_M](https://discuss.elastic.co/u/JohnJ_M)\ **Replies:** 1\ **Last updated:** [December 14, 2022, 9:34am UTC](https://discuss.elastic.co/t/send-mustach-tag-in-weebhook-call-without-having-it-interpreted/320165 "2022-12-14T09:34:31Z")
Hi the community, I am looking a way to send via webhook mustach tab (like {{ctx.payload.total\_assets.hits.total}} that should not be interpreted. The reason: The main watcher create new watchers using the webhook. Th… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=327) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=329)