# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=333 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 334 --- ## [New GeoIP ingest processor is missing databases, but existing GeoIP processors work fine](https://discuss.elastic.co/t/new-geoip-ingest-processor-is-missing-databases-but-existing-geoip-processors-work-fine/320381)
**Author:** [@twilson](https://discuss.elastic.co/u/twilson)\ **Replies:** 14\ **Last updated:** [December 6, 2022, 7:59pm UTC](https://discuss.elastic.co/t/new-geoip-ingest-processor-is-missing-databases-but-existing-geoip-processors-work-fine/320381 "2022-12-06T19:59:32Z")
Elasticsearch 8.4.1 and 8.5.2. When creating a new ingest pipeline with the GeoIP processor the MaxMind databases are not found. Yet, the existing managed pipelines (logs-system.security\*, logs-iptables.log\*, etc) don'… --- ## [How to create a data view and an index aat the same time in elastic search using python](https://discuss.elastic.co/t/how-to-create-a-data-view-and-an-index-aat-the-same-time-in-elastic-search-using-python/320620)
**Author:** [@Shashank02](https://discuss.elastic.co/u/Shashank02)\ **Replies:** 3\ **Last updated:** [December 6, 2022, 7:39pm UTC](https://discuss.elastic.co/t/how-to-create-a-data-view-and-an-index-aat-the-same-time-in-elastic-search-using-python/320620 "2022-12-06T19:39:46Z")
I am trying to push a CSV file directly into Elasticsearch using python and it's working. But, it is only creating an index. I want to create a data view along with it so that I can create a dashboard in Kibana but I'm g… --- ## [\[SOLVED\] Issue with runtime field](https://discuss.elastic.co/t/solved-issue-with-runtime-field/320618)
**Author:** [@abkrim](https://discuss.elastic.co/u/abkrim)\ **Replies:** 2\ **Last updated:** [December 6, 2022, 7:27pm UTC](https://discuss.elastic.co/t/solved-issue-with-runtime-field/320618 "2022-12-06T19:27:42Z")
If create a runtime field for searches with aggregations. PUT /work-analyzers/\_mapping { "runtime": { "total\_consumption": { "type": "double", "script": { "source": """ emit(doc\['pa1\_w'… --- ## [Can't enable 'Minimal' security](https://discuss.elastic.co/t/cant-enable-minimal-security/320473)
**Author:** [@thealy](https://discuss.elastic.co/u/thealy)\ **Replies:** 6\ **Last updated:** [December 6, 2022, 5:27pm UTC](https://discuss.elastic.co/t/cant-enable-minimal-security/320473 "2022-12-06T17:27:54Z")
I am attempting to enable Minimal security on a 7 node V7.17.7 cluster using the Basic license, with the intent of moving on to Basic Security to allow us to upgrade to the latest version. I am working from this set of i… --- ## [8.5.2 won't start](https://discuss.elastic.co/t/8-5-2-wont-start/320516)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 1\ **Last updated:** [December 6, 2022, 3:16pm UTC](https://discuss.elastic.co/t/8-5-2-wont-start/320516 "2022-12-06T15:16:58Z")
I have try to upgrade one of the cluster to 8.5.2 and it won't start I found this which is exact error I am getting. this is not on docker though. running on centos8.x https://github.com/elastic/elasticsearch/pull/9170… --- ## [How to setup watcher condition ctx.payload.hits.total in percentage?](https://discuss.elastic.co/t/how-to-setup-watcher-condition-ctx-payload-hits-total-in-percentage/320593)
**Author:** [@dharini\_u](https://discuss.elastic.co/u/dharini_u)\ **Replies:** 0\ **Last updated:** [December 6, 2022, 2:22pm UTC](https://discuss.elastic.co/t/how-to-setup-watcher-condition-ctx-payload-hits-total-in-percentage/320593 "2022-12-06T14:22:51Z")
Hi Folks, Please help me in setting up a watcher with the below condition: percentage of ctx.payload.hits.total of variable1 in percentage of variable2 \> 10% currently the condition is ctx.payload.hits.total \> params.… --- ## [It is possible to limit amount of hits per token?](https://discuss.elastic.co/t/it-is-possible-to-limit-amount-of-hits-per-token/320561)
**Author:** [@va2dim](https://discuss.elastic.co/u/va2dim)\ **Replies:** 2\ **Last updated:** [December 6, 2022, 1:47pm UTC](https://discuss.elastic.co/t/it-is-possible-to-limit-amount-of-hits-per-token/320561 "2022-12-06T13:47:00Z")
I have indexed refBook of materials: doc/id name 1 polibutilen 5 polibutelenteraftalat 13 elastan, 23 elastodien, 25 elastodin query could contain many materials (using OR operator): elastan, polibutilen. (examp… --- ## [How to download only desired entry rows from Eland (Elasticsearch python+pandas client)?](https://discuss.elastic.co/t/how-to-download-only-desired-entry-rows-from-eland-elasticsearch-python-pandas-client/320591)
**Author:** [@Ivo\_Tavares](https://discuss.elastic.co/u/Ivo_Tavares)\ **Replies:** 0\ **Last updated:** [December 6, 2022, 1:58pm UTC](https://discuss.elastic.co/t/how-to-download-only-desired-entry-rows-from-eland-elasticsearch-python-pandas-client/320591 "2022-12-06T13:58:10Z")
Currently, if I want to create a dataframe with specific entries from an index, using Eland, I must first download a dataframe with all the entries, and then filter them out, locally... this is hardly desirable in terms … --- ## [Ingestion pipeline dynamically creates empty object upon nested JSON](https://discuss.elastic.co/t/ingestion-pipeline-dynamically-creates-empty-object-upon-nested-json/320480)
**Author:** [@Douglas\_Korgut](https://discuss.elastic.co/u/Douglas_Korgut)\ **Replies:** 2\ **Last updated:** [December 6, 2022, 1:37pm UTC](https://discuss.elastic.co/t/ingestion-pipeline-dynamically-creates-empty-object-upon-nested-json/320480 "2022-12-06T13:37:08Z")
Hello guys! I've been trying to ingest documents through the ingestion pipeline provided by elastic. The idea is quite simple, transform the original JSON into one that has well formatted field names that at some point … --- ## [ElasticSearch phrase search not working for wildcard search](https://discuss.elastic.co/t/elasticsearch-phrase-search-not-working-for-wildcard-search/320543)
**Author:** [@golofetuk](https://discuss.elastic.co/u/golofetuk)\ **Replies:** 6\ **Last updated:** [December 6, 2022, 12:18pm UTC](https://discuss.elastic.co/t/elasticsearch-phrase-search-not-working-for-wildcard-search/320543 "2022-12-06T12:18:55Z")
I have a word index and I can't search phrases on elasticsearch. there is no result. I check tons of solutions but I can't implement them to my query. My mapping looks like this; PUT /words/\_mapping { "properties": {… --- ## [Indicator match](https://discuss.elastic.co/t/indicator-match/320569)
**Author:** [@ramiwashere](https://discuss.elastic.co/u/ramiwashere)\ **Replies:** 0\ **Last updated:** [December 6, 2022, 11:17am UTC](https://discuss.elastic.co/t/indicator-match/320569 "2022-12-06T11:17:22Z")
Hello, I'm sorry if this information had already been asked but I didn't find my answer on old topic. I'm stuck on a indicator match rule and idk if I misunderstand this type of rule: I have 2 index, lets call them in… --- ## [Coordinating-only nodes are a \_significant\_ bottleneck for our cluster](https://discuss.elastic.co/t/coordinating-only-nodes-are-a-significant-bottleneck-for-our-cluster/319813)
**Author:** [@drs](https://discuss.elastic.co/u/drs)\ **Replies:** 9\ **Last updated:** [December 6, 2022, 10:50am UTC](https://discuss.elastic.co/t/coordinating-only-nodes-are-a-significant-bottleneck-for-our-cluster/319813 "2022-12-06T10:50:34Z")
We have a very large Elasticsearch cluster with the following node layout: masters: 5 ingest-only: 4 data-only: 98 coordinating-only: 3 Coordinating-only nodes have 32 cores and 64 GB of memory, data nodes typically… --- ## [DataNode disk full, despite on flood\_stage configuration](https://discuss.elastic.co/t/datanode-disk-full-despite-on-flood-stage-configuration/320468)
**Author:** [@gidonshn](https://discuss.elastic.co/u/gidonshn)\ **Replies:** 4\ **Last updated:** [December 6, 2022, 7:40am UTC](https://discuss.elastic.co/t/datanode-disk-full-despite-on-flood-stage-configuration/320468 "2022-12-06T07:40:22Z")
Hi All. I have a cluster (7.16.2) running on k8s, with multiple DataNodes, dedicated ClientNodes, and Dedicated MasterNodes. Some of the DataNodes are "hot" data nodes, and some of them are "warm". I have daily indice… --- ## [Access Secure Elastisearch Cluster from Ruby on Rails](https://discuss.elastic.co/t/access-secure-elastisearch-cluster-from-ruby-on-rails/320461)
**Author:** [@mbm1607](https://discuss.elastic.co/u/mbm1607)\ **Replies:** 4\ **Last updated:** [December 6, 2022, 7:31am UTC](https://discuss.elastic.co/t/access-secure-elastisearch-cluster-from-ruby-on-rails/320461 "2022-12-06T07:31:32Z")
I have setup a secure Elastisearch cluster with three nodes using the official installation with Docker Compose guide. It is being accessed from Kibana without issue. However now I need to access it from my custom ROR a… --- ## [Unable to restart a node - index.mapper.dynamic was removed after version 6.0.0](https://discuss.elastic.co/t/unable-to-restart-a-node-index-mapper-dynamic-was-removed-after-version-6-0-0/320506)
**Author:** [@newkidtopc](https://discuss.elastic.co/u/newkidtopc)\ **Replies:** 2\ **Last updated:** [December 6, 2022, 6:32am UTC](https://discuss.elastic.co/t/unable-to-restart-a-node-index-mapper-dynamic-was-removed-after-version-6-0-0/320506 "2022-12-06T06:32:08Z")
We have been running our ES cluster (ES Version 7.16.3) for a few months now. This cluster was built using the data from earlier ES version (ES 6.8) and the cluster has been running smoothly after the upgrade. We run on… --- ## [Boost results by yeke weights](https://discuss.elastic.co/t/boost-results-by-yeke-weights/320338)
**Author:** [@Ostr1969](https://discuss.elastic.co/u/Ostr1969)\ **Replies:** 4\ **Last updated:** [December 6, 2022, 6:27am UTC](https://discuss.elastic.co/t/boost-results-by-yeke-weights/320338 "2022-12-06T06:27:29Z")
This is a question for a possible strategic. I use yeke to get meaningful words from text. I want to ingest those words with the weights so that Elasticsearch could boost the doc using those weights. for example: doc… --- ## [Can we ingest csv directly into elastric search from python?](https://discuss.elastic.co/t/can-we-ingest-csv-directly-into-elastric-search-from-python/320404)
**Author:** [@Shashank02](https://discuss.elastic.co/u/Shashank02)\ **Replies:** 14\ **Last updated:** [December 6, 2022, 6:07am UTC](https://discuss.elastic.co/t/can-we-ingest-csv-directly-into-elastric-search-from-python/320404 "2022-12-06T06:07:24Z")
Actually, I've tried pushing the data but to no use. I'm using Elastic Search version '8.4.1'. I want to push the CSV directly into the Elasticsearch without uploading it manually using the File Data Visualizer option in… --- ## [Display average of every 100 records](https://discuss.elastic.co/t/display-average-of-every-100-records/320521)
**Author:** [@Yungxin\_Shin](https://discuss.elastic.co/u/Yungxin_Shin)\ **Replies:** 0\ **Last updated:** [December 6, 2022, 4:08am UTC](https://discuss.elastic.co/t/display-average-of-every-100-records/320521 "2022-12-06T04:08:33Z")
I want to display the average of every 100 records, which works similarly to grouping 100 records as a "batch"/"group". So far the moving average only works on the time field, is it possible to apply the moving average t… --- ## [Can i update child document while update parent document from script](https://discuss.elastic.co/t/can-i-update-child-document-while-update-parent-document-from-script/320515)
**Author:** [@robocon20x](https://discuss.elastic.co/u/robocon20x)\ **Replies:** 0\ **Last updated:** [December 6, 2022, 3:20am UTC](https://discuss.elastic.co/t/can-i-update-child-document-while-update-parent-document-from-script/320515 "2022-12-06T03:20:07Z")
can i update special document while update a document? For example: i have 2 docs, doc parent A and doc child B. whenever i update doc child B, i want filed a1 of doc A have value v1. is it possible? cause as i know 1 … --- ## [Moving indices to Docker](https://discuss.elastic.co/t/moving-indices-to-docker/320069)
**Author:** [@Jozef](https://discuss.elastic.co/u/Jozef)\ **Replies:** 5\ **Last updated:** [December 5, 2022, 7:56pm UTC](https://discuss.elastic.co/t/moving-indices-to-docker/320069 "2022-12-05T19:56:09Z")
Hi, I am currently trying to test the overhead a docker container adds to query latency, among other tests requiring a containerized ES. In order to do this I am creating a container and mounting the folder containing th… --- ## [How can i exclude 0 from an uniqe count?](https://discuss.elastic.co/t/how-can-i-exclude-0-from-an-uniqe-count/320471)
**Author:** [@Jakomo04](https://discuss.elastic.co/u/Jakomo04)\ **Replies:** 1\ **Last updated:** [December 5, 2022, 4:46pm UTC](https://discuss.elastic.co/t/how-can-i-exclude-0-from-an-uniqe-count/320471 "2022-12-05T16:46:48Z")
Hi, I have to do a Visualization that only shows the data over 10 of an unique count i tried "clamp(unique\_count('info.job-id.keyword') - 10, 0, 1) \* unique\_count('info.job-id.keyword')" . Now i have all the data under … --- ## [Rollover of Index and delete delta data as per customer configuration](https://discuss.elastic.co/t/rollover-of-index-and-delete-delta-data-as-per-customer-configuration/320452)
**Author:** [@atpr](https://discuss.elastic.co/u/atpr)\ **Replies:** 3\ **Last updated:** [December 5, 2022, 2:48pm UTC](https://discuss.elastic.co/t/rollover-of-index-and-delete-delta-data-as-per-customer-configuration/320452 "2022-12-05T14:48:32Z")
Hi Experts, I have customer requirement where each customer can opt XGB of data or Y days of data and n no of records. Customer is saying they only want this much, if more data is coming, please delete oldest among all.… --- ## [Tune for indexing speed](https://discuss.elastic.co/t/tune-for-indexing-speed/318873)
**Author:** [@lduvnjak](https://discuss.elastic.co/u/lduvnjak)\ **Replies:** 10\ **Last updated:** [December 5, 2022, 2:15pm UTC](https://discuss.elastic.co/t/tune-for-indexing-speed/318873 "2022-12-05T14:15:37Z")
Hey Everyone, We're having some issues optimizing the indexing speed on our cluster. Try as we might, we can't go over 200k/s. Here are the things we tried: Increasing the amount of documents used in a bulk request - … --- ## [64 Gb limit for per NODE](https://discuss.elastic.co/t/64-gb-limit-for-per-node/319950)
**Author:** [@Kamran\_Ahmadzade](https://discuss.elastic.co/u/Kamran_Ahmadzade)\ **Replies:** 11\ **Last updated:** [December 5, 2022, 2:03pm UTC](https://discuss.elastic.co/t/64-gb-limit-for-per-node/319950 "2022-12-05T14:03:54Z")
Why do we have 64 GB limit for per node in cluster ? --- ## [Unable to install Fleet Server](https://discuss.elastic.co/t/unable-to-install-fleet-server/319110)
**Author:** [@leschev](https://discuss.elastic.co/u/leschev)\ **Replies:** 20\ **Last updated:** [December 5, 2022, 1:51pm UTC](https://discuss.elastic.co/t/unable-to-install-fleet-server/319110 "2022-12-05T13:51:59Z")
Hello! I am trying to install Fleet Server with my self-hosted ELK. So, I have the error: sudo ./elastic-agent install -f --fleet-server-es=https://\*\*\*\*.org:9200 --fleet-server-service-token=AAEAAWV\*\*\*\* --fleet-serv… --- ## [Rolling upgrades, master nodes & voting\_config\_exclusions](https://discuss.elastic.co/t/rolling-upgrades-master-nodes-voting-config-exclusions/320463)
**Author:** [@aidofitz](https://discuss.elastic.co/u/aidofitz)\ **Replies:** 2\ **Last updated:** [December 5, 2022, 11:33am UTC](https://discuss.elastic.co/t/rolling-upgrades-master-nodes-voting-config-exclusions/320463 "2022-12-05T11:33:44Z")
Hi, We are planning to upgrade our v7.8 cluster to v7.17, in a rolling upgrade. The cluster has 22 nodes and all nodes have both Master and Data roles. We're planning to leave the currently elected master node till la… --- ## [Search\_after but with paging](https://discuss.elastic.co/t/search-after-but-with-paging/319886)
**Author:** [@daniel77](https://discuss.elastic.co/u/daniel77)\ **Replies:** 5\ **Last updated:** [December 5, 2022, 10:55am UTC](https://discuss.elastic.co/t/search-after-but-with-paging/319886 "2022-12-05T10:55:04Z")
We know the from + size parameters in a search query are limited to 10000. In a search which returns 20k hits, and assuming each page is 1k results, it's impossible to retrieve any page beyond #10 (like page 11, from set… --- ## [Integration of ELK in TheHive](https://discuss.elastic.co/t/integration-of-elk-in-thehive/320455)
**Author:** [@Midiou\_00](https://discuss.elastic.co/u/Midiou_00)\ **Replies:** 0\ **Last updated:** [December 5, 2022, 9:50am UTC](https://discuss.elastic.co/t/integration-of-elk-in-thehive/320455 "2022-12-05T09:50:29Z")
Hi everyone, I want to integrate ELK in Thehive SOAR. This is an open source SOAR. May somebody help me for the processus please ? --- ## [Do EQL deprecations also imply deprecation of the Java API?](https://discuss.elastic.co/t/do-eql-deprecations-also-imply-deprecation-of-the-java-api/320462)
**Author:** [@martinwun](https://discuss.elastic.co/u/martinwun)\ **Replies:** 0\ **Last updated:** [December 5, 2022, 10:48am UTC](https://discuss.elastic.co/t/do-eql-deprecations-also-imply-deprecation-of-the-java-api/320462 "2022-12-05T10:48:50Z")
Hello, in the release notes for 7.13 it states the following in the section on "EQL deprecations": "The wildcard function is deprecated." What is not clear to me is whether or not this is also affecting the Java API… --- ## [GC on elastic search data nodes and node automatically reconnect from the cluster](https://discuss.elastic.co/t/gc-on-elastic-search-data-nodes-and-node-automatically-reconnect-from-the-cluster/319426)
**Author:** [@Siva\_Karan](https://discuss.elastic.co/u/Siva_Karan)\ **Replies:** 4\ **Last updated:** [December 5, 2022, 4:23am UTC](https://discuss.elastic.co/t/gc-on-elastic-search-data-nodes-and-node-automatically-reconnect-from-the-cluster/319426 "2022-12-05T04:23:47Z")
Hi Team, we are getting the below alerts in elasticsearch data nodes. \[2022-11-20T21:27:36,237\]\[INFO \]\[o.e.m.j.JvmGcMonitorService\] \[esnode1\] \[gc\]\[438806\] overhead, spent \[276ms\] collecting in the last \[1s\] \[2022-11-2… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=332) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=334)