# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=339 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 340 --- ## [EQL match event A only if event B does not occur within maxspan](https://discuss.elastic.co/t/eql-match-event-a-only-if-event-b-does-not-occur-within-maxspan/319684)
**Author:** [@jyoung15](https://discuss.elastic.co/u/jyoung15)\ **Replies:** 0\ **Last updated:** [November 23, 2022, 9:17pm UTC](https://discuss.elastic.co/t/eql-match-event-a-only-if-event-b-does-not-occur-within-maxspan/319684 "2022-11-23T21:17:41Z")
Hi, My question is similar to https://discuss.elastic.co/t/creating-alert-when-event-didnt-occur/282195, which was never really resolved. I'm looking to see if there are any other suggestions how to handle this. Basica… --- ## [Retrieve records and update a field at the same time](https://discuss.elastic.co/t/retrieve-records-and-update-a-field-at-the-same-time/319465)
**Author:** [@xef](https://discuss.elastic.co/u/xef)\ **Replies:** 8\ **Last updated:** [November 23, 2022, 5:35pm UTC](https://discuss.elastic.co/t/retrieve-records-and-update-a-field-at-the-same-time/319465 "2022-11-23T17:35:38Z")
Is there anyway when making a query in Elasticsearch, to update a field (such as say a counter++) in each record that is selected by the query. Thanks --- ## [Forward logs from rsyslog to Elasticsearch](https://discuss.elastic.co/t/forward-logs-from-rsyslog-to-elasticsearch/319597)
**Author:** [@vassiliy.vins](https://discuss.elastic.co/u/vassiliy.vins)\ **Replies:** 2\ **Last updated:** [November 23, 2022, 1:18pm UTC](https://discuss.elastic.co/t/forward-logs-from-rsyslog-to-elasticsearch/319597 "2022-11-23T13:18:52Z")
Hi! Need to use rsyslog to send data to Elasticsearh. Could you provide link to documentation? Manual? Thank you, Regards, Vassiliy --- ## [Field data type for multi\_match query with type phrase](https://discuss.elastic.co/t/field-data-type-for-multi-match-query-with-type-phrase/319652)
**Author:** [@ChristopherHS](https://discuss.elastic.co/u/ChristopherHS)\ **Replies:** 0\ **Last updated:** [November 23, 2022, 11:44am UTC](https://discuss.elastic.co/t/field-data-type-for-multi-match-query-with-type-phrase/319652 "2022-11-23T11:44:45Z")
Hello, I have the following query: { "size": 40, "from": 0, "query": { "bool": { "must": \[ { "multi\_match": { "query": "my sea… --- ## [Elasticsearch disk keep getting full when using data-stream](https://discuss.elastic.co/t/elasticsearch-disk-keep-getting-full-when-using-data-stream/319276)
**Author:** [@MyNameHasDiactrics](https://discuss.elastic.co/u/MyNameHasDiactrics)\ **Replies:** 2\ **Last updated:** [November 23, 2022, 9:16am UTC](https://discuss.elastic.co/t/elasticsearch-disk-keep-getting-full-when-using-data-stream/319276 "2022-11-23T09:16:50Z")
This morning I woke up to this: This is not the first time that it happens, and when it happens it blocks everything: I cannot access Kibana, Elasticsearch doesn't answer at all, this means I also cannot delete data u… --- ## [And of array items in terms query](https://discuss.elastic.co/t/and-of-array-items-in-terms-query/319633)
**Author:** [@chirag\_bansal](https://discuss.elastic.co/u/chirag_bansal)\ **Replies:** 0\ **Last updated:** [November 23, 2022, 9:07am UTC](https://discuss.elastic.co/t/and-of-array-items-in-terms-query/319633 "2022-11-23T09:07:17Z")
Hi, I need to know that whether an AND functionality of terms query exists or not? For example - { "terms": { "color": \[ blue, red, black \] } } The above query will return all t… --- ## [Authentication of \[elastic\] was terminated by realm \[reserved\]](https://discuss.elastic.co/t/authentication-of-elastic-was-terminated-by-realm-reserved/319621)
**Author:** [@Elitlogik](https://discuss.elastic.co/u/Elitlogik)\ **Replies:** 0\ **Last updated:** [November 23, 2022, 7:32am UTC](https://discuss.elastic.co/t/authentication-of-elastic-was-terminated-by-realm-reserved/319621 "2022-11-23T07:32:57Z")
Authentication of \[elastic\] was terminated by realm \[reserved\] - failed to authenticate user \[elastic\] | @timestamp=2022-11-23T07:21:04.573Z log.level=INFO ecs.version=1.2.0 service.name=ES\_ECS event.dataset=elasticsear… --- ## [Deleted docs could be still retrieved although refreshed](https://discuss.elastic.co/t/deleted-docs-could-be-still-retrieved-although-refreshed/319609)
**Author:** [@fanqiaoqing](https://discuss.elastic.co/u/fanqiaoqing)\ **Replies:** 14\ **Last updated:** [November 23, 2022, 6:44am UTC](https://discuss.elastic.co/t/deleted-docs-could-be-still-retrieved-although-refreshed/319609 "2022-11-23T06:44:52Z")
Hi Elasticsearch, I have an index with about 2.5 billion documents. The primary has a total of 10 shards, and each shard is about 10G. We have a problem like this: A query will find out the number of documents for som… --- ## [Logstash 7.3.1 with Elasticsearch 7.17.1](https://discuss.elastic.co/t/logstash-7-3-1-with-elasticsearch-7-17-1/319617)
**Author:** [@Wan\_Nur\_Athirah\_Wan](https://discuss.elastic.co/u/Wan_Nur_Athirah_Wan)\ **Replies:** 0\ **Last updated:** [November 23, 2022, 6:30am UTC](https://discuss.elastic.co/t/logstash-7-3-1-with-elasticsearch-7-17-1/319617 "2022-11-23T06:30:02Z")
Hai. one quick question since i already upgrade my Elasticsearch version from 7.3.1 to 7.17.1. Is it compatible to use logstash 7.3.1 with Elasticsearch 7.17.1 and do i also must upgrade logstash? since there still no er… --- ## [Automatically create shards](https://discuss.elastic.co/t/automatically-create-shards/319613)
**Author:** [@dms6978](https://discuss.elastic.co/u/dms6978)\ **Replies:** 2\ **Last updated:** [November 23, 2022, 5:54am UTC](https://discuss.elastic.co/t/automatically-create-shards/319613 "2022-11-23T05:54:09Z")
Is there a way to automatically create a shard in one index when the specified shard capacity is full like index rollover? --- ## [Elastic search doesnot bootstrap with 8.5.0](https://discuss.elastic.co/t/elastic-search-doesnot-bootstrap-with-8-5-0/318993)
**Author:** [@smiley\_tamy](https://discuss.elastic.co/u/smiley_tamy)\ **Replies:** 6\ **Last updated:** [November 23, 2022, 3:07am UTC](https://discuss.elastic.co/t/elastic-search-doesnot-bootstrap-with-8-5-0/318993 "2022-11-23T03:07:08Z")
I have Elasticsearch service with version 8.5.0 When I try to invoke Elasticsearch.main from Java class, the following exception is thrown Can you please help me to resolve that Invoked call - Elasticsearch.main(args… --- ## [Access child aggregations from parent](https://discuss.elastic.co/t/access-child-aggregations-from-parent/319607)
**Author:** [@HasiAmarasena](https://discuss.elastic.co/u/HasiAmarasena)\ **Replies:** 0\ **Last updated:** [November 23, 2022, 3:04am UTC](https://discuss.elastic.co/t/access-child-aggregations-from-parent/319607 "2022-11-23T03:04:01Z")
I have below search POST /MY\_ID/\_search?typed\_keys=true { "aggs": { "terms\_agg": { "terms": { "field": "\[RefNumber\]" }, "aggs": { "max\_agg\_startdate": { "max": { … --- ## [Elasticsearch multi-match query using a fuzziness criteria behaves in a strange way](https://discuss.elastic.co/t/elasticsearch-multi-match-query-using-a-fuzziness-criteria-behaves-in-a-strange-way/319498)
**Author:** [@Ivo\_Tavares](https://discuss.elastic.co/u/Ivo_Tavares)\ **Replies:** 2\ **Last updated:** [November 23, 2022, 12:40am UTC](https://discuss.elastic.co/t/elasticsearch-multi-match-query-using-a-fuzziness-criteria-behaves-in-a-strange-way/319498 "2022-11-23T00:40:37Z")
I'm trying to search for some files using the function fetch\_document to fetch a document by its name in the data.name subfield. This function is being used in the following way: fetch\_document( client=server, … --- ## [Elasticsearch not returning larger results (not total result size/length, but size of individual hit](https://discuss.elastic.co/t/elasticsearch-not-returning-larger-results-not-total-result-size-length-but-size-of-individual-hit/319242)
**Author:** [@NickIsWorking](https://discuss.elastic.co/u/NickIsWorking)\ **Replies:** 5\ **Last updated:** [November 22, 2022, 10:59pm UTC](https://discuss.elastic.co/t/elasticsearch-not-returning-larger-results-not-total-result-size-length-but-size-of-individual-hit/319242 "2022-11-22T22:59:25Z")
Hello. I have an Elasticsearch instance, storing objects that contain really large strings. I am trying to make a request to retrieve those objects from elasticsearch, but for whatever reason, elasticsearch will not retu… --- ## [Rsyslog + Elasticsearch + Kibana](https://discuss.elastic.co/t/rsyslog-elasticsearch-kibana/319594)
**Author:** [@vassiliy.vins](https://discuss.elastic.co/u/vassiliy.vins)\ **Replies:** 0\ **Last updated:** [November 22, 2022, 10:41pm UTC](https://discuss.elastic.co/t/rsyslog-elasticsearch-kibana/319594 "2022-11-22T22:41:56Z")
Hello! Could you give link to rsyslog configuration to work with Elasticsearch and Kibana? Thank you, Vassiliy --- ## [MaxTimeoutReached occurring after failing to connect via sniffing connection pool](https://discuss.elastic.co/t/maxtimeoutreached-occurring-after-failing-to-connect-via-sniffing-connection-pool/318973)
**Author:** [@Hoppities](https://discuss.elastic.co/u/Hoppities)\ **Replies:** 1\ **Last updated:** [November 22, 2022, 7:53pm UTC](https://discuss.elastic.co/t/maxtimeoutreached-occurring-after-failing-to-connect-via-sniffing-connection-pool/318973 "2022-11-22T19:53:45Z")
Whenever we run into this scenario where a sniff happened and elastic was unable to connect, we then see this timeout with a massive negative number. I'm not even sure where to start with this. Any help would be appreci… --- ## [Defender for Endpoint to Azure Event Hub to Elasticsearch?](https://discuss.elastic.co/t/defender-for-endpoint-to-azure-event-hub-to-elasticsearch/319578)
**Author:** [@mathurin68](https://discuss.elastic.co/u/mathurin68)\ **Replies:** 0\ **Last updated:** [November 22, 2022, 5:53pm UTC](https://discuss.elastic.co/t/defender-for-endpoint-to-azure-event-hub-to-elasticsearch/319578 "2022-11-22T17:53:31Z")
Our Defender for Endpoint Device tables are around 1TB a day, I'll never get the money to use Sentinel so I'm looking for an alternative. Is there no way to use Azure Event Hubs with Elasticsearch? Stream the events fr… --- ## [Discover gives error from Kibana](https://discuss.elastic.co/t/discover-gives-error-from-kibana/319371)
**Author:** [@mpniel](https://discuss.elastic.co/u/mpniel)\ **Replies:** 4\ **Last updated:** [November 22, 2022, 5:25pm UTC](https://discuss.elastic.co/t/discover-gives-error-from-kibana/319371 "2022-11-22T17:25:36Z")
Hi, Click on discover icon from kibana gives the following error: Error: Request to Elasticsearch failed: ("error": {"root\_cause": \[{"reason': 'forbidden' due to \["OPERATION NOT ALLOWED"\]}\], "reason": "forbidden", "du… --- ## [mTLS only setup for Elasticsearch](https://discuss.elastic.co/t/mtls-only-setup-for-elasticsearch/319576)
**Author:** [@Rohit\_Shrivastava](https://discuss.elastic.co/u/Rohit_Shrivastava)\ **Replies:** 0\ **Last updated:** [November 22, 2022, 4:59pm UTC](https://discuss.elastic.co/t/mtls-only-setup-for-elasticsearch/319576 "2022-11-22T16:59:20Z")
Is it possible to only use mTLS i.e. only authentication via PKI realm. I almost have the cluster working (using open source helm charts and 7.1.7 images). One issue I have is the pod readiness doesn't succeed as the \_c… --- ## [Unable to output container password details when using ansible with podman](https://discuss.elastic.co/t/unable-to-output-container-password-details-when-using-ansible-with-podman/319563)
**Author:** [@millerthegorilla](https://discuss.elastic.co/u/millerthegorilla)\ **Replies:** 0\ **Last updated:** [November 22, 2022, 3:21pm UTC](https://discuss.elastic.co/t/unable-to-output-container-password-details-when-using-ansible-with-podman/319563 "2022-11-22T15:21:28Z")
Hi, when using ansible-podman, I am unable to output the std-out of the container run command as I might do when using the command line. This means that I don't get to see the automatically generated password and keysto… --- ## [Weekly Index Delete Automatically from Elasticsearch Cluster](https://discuss.elastic.co/t/weekly-index-delete-automatically-from-elasticsearch-cluster/319552)
**Author:** [@dharminfadia](https://discuss.elastic.co/u/dharminfadia)\ **Replies:** 5\ **Last updated:** [November 22, 2022, 2:36pm UTC](https://discuss.elastic.co/t/weekly-index-delete-automatically-from-elasticsearch-cluster/319552 "2022-11-22T14:36:02Z")
Hello Guys I am using Elasticsearch 7.10.2 I have 6 Data node Cluster in this Cluster I am Facing Space Issue so I set Index Policy for Daily Index but I am having Monthly and Weekly Index I want setup Automatically De… --- ## [Elasticsearch PHP Client implementation for a webshop](https://discuss.elastic.co/t/elasticsearch-php-client-implementation-for-a-webshop/319557)
**Author:** [@Thymen](https://discuss.elastic.co/u/Thymen)\ **Replies:** 0\ **Last updated:** [November 22, 2022, 2:26pm UTC](https://discuss.elastic.co/t/elasticsearch-php-client-implementation-for-a-webshop/319557 "2022-11-22T14:26:03Z")
Hello there, I am using the Elasticsearch PHP client (8.3), as can be found on: github I've used several types of queries to find and filter through results on several indices to find relevant/popular. Some more comple… --- ## [Elasticsearch-certutil parameters](https://discuss.elastic.co/t/elasticsearch-certutil-parameters/319529)
**Author:** [@adrien\_moreau](https://discuss.elastic.co/u/adrien_moreau)\ **Replies:** 1\ **Last updated:** [November 22, 2022, 1:47pm UTC](https://discuss.elastic.co/t/elasticsearch-certutil-parameters/319529 "2022-11-22T13:47:45Z")
Hello, I am using Elasticsearch on a self managed cluster and I had to use the "elasticsearch-certutil" tool to manage my cluster certificates. The help menu from the tool only lists the following options Simplifies c… --- ## [Dumping requests](https://discuss.elastic.co/t/dumping-requests/319462)
**Author:** [@Georgi\_Danov](https://discuss.elastic.co/u/Georgi_Danov)\ **Replies:** 4\ **Last updated:** [November 22, 2022, 1:39pm UTC](https://discuss.elastic.co/t/dumping-requests/319462 "2022-11-22T13:39:03Z")
I'm reverse engineering and optimizing ES instance. One of the things that would help me enormously is to understand what operations (updates and queries) are coming in. What's the best way do dump & analyze the operat… --- ## [Index lost the alias rollover](https://discuss.elastic.co/t/index-lost-the-alias-rollover/319396)
**Author:** [@artax\_sb](https://discuss.elastic.co/u/artax_sb)\ **Replies:** 5\ **Last updated:** [November 22, 2022, 11:56am UTC](https://discuss.elastic.co/t/index-lost-the-alias-rollover/319396 "2022-11-22T11:56:50Z")
Hi, when the index make de rollover and delete step, index-000001 is deleted, but then fluentd creates a new index-000001 (instead write in index-000002) and de alias is deleted so appears the error illegal\_argument\_ex… --- ## [Match queries and ASCII folding](https://discuss.elastic.co/t/match-queries-and-ascii-folding/319544)
**Author:** [@babolivier](https://discuss.elastic.co/u/babolivier)\ **Replies:** 1\ **Last updated:** [November 22, 2022, 11:44am UTC](https://discuss.elastic.co/t/match-queries-and-ascii-folding/319544 "2022-11-22T11:44:25Z")
Hi all, I have an index that was created with the following configuration: { "settings": { "analysis": { "analyzer": { "std\_asciifolding": { "tokenizer": "standard", "filter": \[ … --- ## [Issue generating token after adding PV](https://discuss.elastic.co/t/issue-generating-token-after-adding-pv/319537)
**Author:** [@lkurczy](https://discuss.elastic.co/u/lkurczy)\ **Replies:** 0\ **Last updated:** [November 22, 2022, 10:18am UTC](https://discuss.elastic.co/t/issue-generating-token-after-adding-pv/319537 "2022-11-22T10:18:05Z")
Hello, Im trying to configure a new instance of elasticsearch and kibana in docker. When i run it with the following commands, everything runs smoothly and im able to run kibana with security enabled: docker run --nam… --- ## [System integration VS Windows Integration](https://discuss.elastic.co/t/system-integration-vs-windows-integration/317701)
**Author:** [@lamp123432](https://discuss.elastic.co/u/lamp123432)\ **Replies:** 1\ **Last updated:** [November 22, 2022, 10:02am UTC](https://discuss.elastic.co/t/system-integration-vs-windows-integration/317701 "2022-11-22T10:02:26Z")
Hello, if I add both integrations (system and windows) in Fleet, for the same policy, will there be duplication of logs? Here;s what System collects: Here's what Windows integration collects: Is Sysmon included … --- ## [Can We set a Node to be both ML Node and Content Node](https://discuss.elastic.co/t/can-we-set-a-node-to-be-both-ml-node-and-content-node/319304)
**Author:** [@Umang\_Pachaury](https://discuss.elastic.co/u/Umang_Pachaury)\ **Replies:** 2\ **Last updated:** [November 22, 2022, 7:40am UTC](https://discuss.elastic.co/t/can-we-set-a-node-to-be-both-ml-node-and-content-node/319304 "2022-11-22T07:40:52Z")
Hello Team, I am new to Elastic and Machine Learning but what I have gathered by documentation is that to Use machine learning ( For the production cluster) it is better to use a dedicated machine learning node. Now in … --- ## [Search single character](https://discuss.elastic.co/t/search-single-character/319516)
**Author:** [@Zaid\_Raza](https://discuss.elastic.co/u/Zaid_Raza)\ **Replies:** 0\ **Last updated:** [November 22, 2022, 7:23am UTC](https://discuss.elastic.co/t/search-single-character/319516 "2022-11-22T07:23:34Z")
Hi, I am creating a search query in which I am searching course name. For example if I search "Introduction to R" then the output is "Introduction to Scrum". In this query "R" is not considered as a single word while se… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=338) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=340)