# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=342 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 343 --- ## [Indexes getting deleted if deleted from one cluster](https://discuss.elastic.co/t/indexes-getting-deleted-if-deleted-from-one-cluster/319179)
**Author:** [@Rahul\_Gupta1](https://discuss.elastic.co/u/Rahul_Gupta1)\ **Replies:** 6\ **Last updated:** [November 17, 2022, 12:31pm UTC](https://discuss.elastic.co/t/indexes-getting-deleted-if-deleted-from-one-cluster/319179 "2022-11-17T12:31:41Z")
Hi, in my current system i am using a single log stash configuration to write into two different Elasticsearch cluster, one is on version 7.5.1 and another is on version 7.17.7 using the following configuration file: - … --- ## [Static Lookup Table in Elastic](https://discuss.elastic.co/t/static-lookup-table-in-elastic/319181)
**Author:** [@jamesm1](https://discuss.elastic.co/u/jamesm1)\ **Replies:** 2\ **Last updated:** [November 17, 2022, 11:49am UTC](https://discuss.elastic.co/t/static-lookup-table-in-elastic/319181 "2022-11-17T11:49:40Z")
Hello - I am wondering if there is a way in which you can store static data in Elastic which can then be referenced by an ingestion pipeline? The reason for it is that i want to parse my http.referrer field and then if … --- ## [Timestamp in DSL query](https://discuss.elastic.co/t/timestamp-in-dsl-query/319058)
**Author:** [@oalimerko](https://discuss.elastic.co/u/oalimerko)\ **Replies:** 3\ **Last updated:** [November 17, 2022, 11:39am UTC](https://discuss.elastic.co/t/timestamp-in-dsl-query/319058 "2022-11-17T11:39:08Z")
Dear all, i have the query below for monitoring the logs of my application in case any issue with database connection occurs in the last 6min: GET \_search { "query": { "query\_string": { "query"… --- ## [Impossible to pull elastic image because of cloudfront](https://discuss.elastic.co/t/impossible-to-pull-elastic-image-because-of-cloudfront/319094)
**Author:** [@Althea\_Vestrit](https://discuss.elastic.co/u/Althea_Vestrit)\ **Replies:** 3\ **Last updated:** [November 17, 2022, 9:51am UTC](https://discuss.elastic.co/t/impossible-to-pull-elastic-image-because-of-cloudfront/319094 "2022-11-17T09:51:42Z")
Hello, I am trying to install an elastic-agent on a new server but cannot pull the elastic-agent container image (same problem with other elastic images). For example I have the same error with the kibana image, even th… --- ## [ILM errors on shrink index](https://discuss.elastic.co/t/ilm-errors-on-shrink-index/318967)
**Author:** [@sai\_kiran1](https://discuss.elastic.co/u/sai_kiran1)\ **Replies:** 3\ **Last updated:** [November 17, 2022, 9:34am UTC](https://discuss.elastic.co/t/ilm-errors-on-shrink-index/318967 "2022-11-17T09:34:41Z")
I see lifecycle errors on shrink indices with below error. java.lang.IllegalStateException: no rollover info found for \[shrink-wmgr-.ds-linux-audit-2022.08.24-000156\] with rollover target \[linux-audit\], the index has no… --- ## [Search combined/JOIN indexes](https://discuss.elastic.co/t/search-combined-join-indexes/318907)
**Author:** [@Johanna12221](https://discuss.elastic.co/u/Johanna12221)\ **Replies:** 5\ **Last updated:** [November 17, 2022, 9:19am UTC](https://discuss.elastic.co/t/search-combined-join-indexes/318907 "2022-11-17T09:19:15Z")
Hello, We are working on setting up a search with document contents (pdf/docx etc.) where permissions comes from a database. I've gotten all the data into Elastic with the help of Logstash and FSCrawler. However they… --- ## [Alias APIs in ElasticSearch](https://discuss.elastic.co/t/alias-apis-in-elasticsearch/319140)
**Author:** [@manikanta](https://discuss.elastic.co/u/manikanta)\ **Replies:** 3\ **Last updated:** [November 17, 2022, 8:55am UTC](https://discuss.elastic.co/t/alias-apis-in-elasticsearch/319140 "2022-11-17T08:55:20Z")
I have a doubt in Alias APIs. Can Elasticsearch itself creates alias when a new value is added for a field? alias-name : {value} { "filter": { "term": { "fieldname": {value} } } } --- ## [Breaking index into small indices with duplicates items across indices](https://discuss.elastic.co/t/breaking-index-into-small-indices-with-duplicates-items-across-indices/319097)
**Author:** [@x41lakazam](https://discuss.elastic.co/u/x41lakazam)\ **Replies:** 4\ **Last updated:** [November 17, 2022, 8:33am UTC](https://discuss.elastic.co/t/breaking-index-into-small-indices-with-duplicates-items-across-indices/319097 "2022-11-17T08:33:22Z")
I am facing a problem that look pretty popular from what I saw on the forum, but always different from mine. I currently have one big index (actually one big alias split into several ILM indices) which contain data avai… --- ## [Problem when installing elk 8.5.1](https://discuss.elastic.co/t/problem-when-installing-elk-8-5-1/319072)
**Author:** [@Neelam\_Zanvar](https://discuss.elastic.co/u/Neelam_Zanvar)\ **Replies:** 5\ **Last updated:** [November 17, 2022, 7:32am UTC](https://discuss.elastic.co/t/problem-when-installing-elk-8-5-1/319072 "2022-11-17T07:32:46Z")
Hi i am trying to install elk stack 8.5.1 on amazon linux 2 redhat. When i try to start the service getting the following error I have set xpack.security.enabled: true discovery-type: single-node xpack.security.tra… --- ## [How do I extend the SSL Certificate expiry period?s](https://discuss.elastic.co/t/how-do-i-extend-the-ssl-certificate-expiry-period-s/318922)
**Author:** [@RusseL](https://discuss.elastic.co/u/RusseL)\ **Replies:** 4\ **Last updated:** [November 17, 2022, 7:05am UTC](https://discuss.elastic.co/t/how-do-i-extend-the-ssl-certificate-expiry-period-s/318922 "2022-11-17T07:05:43Z")
Hi everyone. I have an ES Cluster(ES version 7.4.2) that has been running for 3 years. when I run the following query. GET \_ssl/certificates I'm getting the output. "expiry" : "2022-11-20T07:27:29.000Z" My cluster … --- ## [How to migration frozen index to hot or warm?](https://discuss.elastic.co/t/how-to-migration-frozen-index-to-hot-or-warm/318817)
**Author:** [@InJong\_Park](https://discuss.elastic.co/u/InJong_Park)\ **Replies:** 2\ **Last updated:** [November 17, 2022, 5:38am UTC](https://discuss.elastic.co/t/how-to-migration-frozen-index-to-hot-or-warm/318817 "2022-11-17T05:38:14Z")
Hello I'm InJong from korea. I have a frozen indices with datastream. (in Elastic Cloud) I want to move frozen tier index to another tier. (hot, warm, cold) I checked document -\> "Migrate index allocation filters to … --- ## [Not able to login even after correct credentials in x-pack](https://discuss.elastic.co/t/not-able-to-login-even-after-correct-credentials-in-x-pack/317926)
**Author:** [@Murali\_Krishna2](https://discuss.elastic.co/u/Murali_Krishna2)\ **Replies:** 8\ **Last updated:** [November 17, 2022, 12:28am UTC](https://discuss.elastic.co/t/not-able-to-login-even-after-correct-credentials-in-x-pack/317926 "2022-11-17T00:28:54Z")
Hi Team, I am not able to login to elastic even after typing the correct username and password. Screenshot of the user details : In the above image, role is "viewer". We are able to login to those users whose role… --- ## [Updating two different version of elastic search from one log stash](https://discuss.elastic.co/t/updating-two-different-version-of-elastic-search-from-one-log-stash/319063)
**Author:** [@Rahul\_Gupta1](https://discuss.elastic.co/u/Rahul_Gupta1)\ **Replies:** 2\ **Last updated:** [November 16, 2022, 11:35pm UTC](https://discuss.elastic.co/t/updating-two-different-version-of-elastic-search-from-one-log-stash/319063 "2022-11-16T23:35:23Z")
Hi, i have two different version of Elasticsearch, one is old(6.3.4) and another one as new(8.3.2), currently we are writting into old cluster from logstash, and are willing to miggrate to new cluster, to avoid any data… --- ## [BulkIndexError while I try to ingest data from python](https://discuss.elastic.co/t/bulkindexerror-while-i-try-to-ingest-data-from-python/319043)
**Author:** [@eleven\_e](https://discuss.elastic.co/u/eleven_e)\ **Replies:** 1\ **Last updated:** [November 16, 2022, 10:47pm UTC](https://discuss.elastic.co/t/bulkindexerror-while-i-try-to-ingest-data-from-python/319043 "2022-11-16T22:47:10Z")
I try to ingest a csv using python and it raises an error "BulkIndexError". But when I upload it using the UI in kibana it uploads perfectly, so I also tried ingesting in the same index and also tried with the index's ma… --- ## [Update index type on field. It is possible?](https://discuss.elastic.co/t/update-index-type-on-field-it-is-possible/319049)
**Author:** [@abkrim](https://discuss.elastic.co/u/abkrim)\ **Replies:** 1\ **Last updated:** [November 16, 2022, 10:06pm UTC](https://discuss.elastic.co/t/update-index-type-on-field-it-is-possible/319049 "2022-11-16T22:06:32Z")
Hi I need change some fields created with index and doc\_valueswith false for new value true. I'm working with Elasticsearch 8.5 { "analyzers": { "mappings": { "properties": { "pf1":{ "ty… --- ## [Elasticsearch: I have a dream](https://discuss.elastic.co/t/elasticsearch-i-have-a-dream/319108)
**Author:** [@asdasd](https://discuss.elastic.co/u/asdasd)\ **Replies:** 1\ **Last updated:** [November 16, 2022, 9:35pm UTC](https://discuss.elastic.co/t/elasticsearch-i-have-a-dream/319108 "2022-11-16T21:35:15Z")
elasticsearch: I have a dream，To improve the comprehensive quality of every beginner, and finally make him a great elastic operation and maintenance personnel, we make it very difficult to connect kibana with Elasticsea… --- ## [Problem with aggregation returning most popular array entry among all documents](https://discuss.elastic.co/t/problem-with-aggregation-returning-most-popular-array-entry-among-all-documents/319127)
**Author:** [@Karol\_Radomski](https://discuss.elastic.co/u/Karol_Radomski)\ **Replies:** 0\ **Last updated:** [November 16, 2022, 8:52pm UTC](https://discuss.elastic.co/t/problem-with-aggregation-returning-most-popular-array-entry-among-all-documents/319127 "2022-11-16T20:52:20Z")
Please help me solve aggregation issue: Lets say I have mapping (...) "properties": { "kidName": { "type": "keyword", "fields": { "txt": { "type": "text", } … --- ## [Aggregation only over the search results](https://discuss.elastic.co/t/aggregation-only-over-the-search-results/319012)
**Author:** [@namespace-Pt](https://discuss.elastic.co/u/namespace-Pt)\ **Replies:** 1\ **Last updated:** [November 16, 2022, 6:32pm UTC](https://discuss.elastic.co/t/aggregation-only-over-the-search-results/319012 "2022-11-16T18:32:57Z")
I found that the terms aggregations always inspect the entire collection, for example I use { "query": { "match": { "text field": "some text" } }, "aggs": { "agg-terms": {… --- ## [Latest transform fails to fetch preview after running at 100% CPU for more than an hour](https://discuss.elastic.co/t/latest-transform-fails-to-fetch-preview-after-running-at-100-cpu-for-more-than-an-hour/318742)
**Author:** [@fgjensen](https://discuss.elastic.co/u/fgjensen)\ **Replies:** 4\ **Last updated:** [November 16, 2022, 4:51pm UTC](https://discuss.elastic.co/t/latest-transform-fails-to-fetch-preview-after-running-at-100-cpu-for-more-than-an-hour/318742 "2022-11-16T16:51:26Z")
Hello I am trying to create a transform from a filebeat 7.15 index on a 7.17 cluster with 4 nodes and sufficient RAM and CPU's. During normal operations the cluster runs smoothly with low CPU usages. In fact the setup i… --- ## [Deprecated Log](https://discuss.elastic.co/t/deprecated-log/319091)
**Author:** [@EExisT](https://discuss.elastic.co/u/EExisT)\ **Replies:** 0\ **Last updated:** [November 16, 2022, 2:49pm UTC](https://discuss.elastic.co/t/deprecated-log/319091 "2022-11-16T14:49:52Z")
Hello, i'm trying to patch the deprecated settings in my ES cluster v.7.13.x. I runned into these 2 deprecated settings: \[2022-11-16T15:03:23,504\]\[DEPRECATION\]\[o.e.d.c.s.Settings \] \[es-md-01\] \[xpack.security.htt… --- ## [Elasticsearch 8.05.00.00 ODBC connection error](https://discuss.elastic.co/t/elasticsearch-8-05-00-00-odbc-connection-error/318341)
**Author:** [@Gianluca\_De\_Pasquale](https://discuss.elastic.co/u/Gianluca_De_Pasquale)\ **Replies:** 2\ **Last updated:** [November 16, 2022, 1:35pm UTC](https://discuss.elastic.co/t/elasticsearch-8-05-00-00-odbc-connection-error/318341 "2022-11-16T13:35:17Z")
Hi, I want to try out the Elasticsearch ODBC driver for importing data from Microsoft Power Bi . After installation, I created a system DSN configuration, but when I tested the connection, I got the following error : Un… --- ## [Elasticsearch 7.7](https://discuss.elastic.co/t/elasticsearch-7-7/319079)
**Author:** [@Tiger1](https://discuss.elastic.co/u/Tiger1)\ **Replies:** 2\ **Last updated:** [November 16, 2022, 1:12pm UTC](https://discuss.elastic.co/t/elasticsearch-7-7/319079 "2022-11-16T13:12:26Z")
I'm trying to deploy elasticsearch 7.7 cluster, there's problem: \[es2\] master not discovered yet, this node has not previously joined a bootstrapped (v7+) cluster, and this node must discover master-eligible nodes \[es1,… --- ## [Put a rule that will allow me to detect brute force](https://discuss.elastic.co/t/put-a-rule-that-will-allow-me-to-detect-brute-force/319080)
**Author:** [@buhu698](https://discuss.elastic.co/u/buhu698)\ **Replies:** 0\ **Last updated:** [November 16, 2022, 12:40pm UTC](https://discuss.elastic.co/t/put-a-rule-that-will-allow-me-to-detect-brute-force/319080 "2022-11-16T12:40:52Z")
Hello, can you help me to put a rule that will allow me to detect brute force. type of rule ( event correlation or indicator match ). From the Kali machine, I run the following command: Hydra –L /usr/share/wordlists/… --- ## [Update Elasticsearch and Kibana](https://discuss.elastic.co/t/update-elasticsearch-and-kibana/319027)
**Author:** [@Clonky](https://discuss.elastic.co/u/Clonky)\ **Replies:** 6\ **Last updated:** [November 16, 2022, 11:55am UTC](https://discuss.elastic.co/t/update-elasticsearch-and-kibana/319027 "2022-11-16T11:55:48Z")
Hello, I am running on a local server Elasticsearch in version 7.16 and Kibana in version 7.17 I want both to be updated to version 8.5. I have read, that I should use the Update Assistance in the wiki However, when I… --- ## [Search for documents containing words with and without dots (e.g. “ceo”, “c.e.o”, “c.e.o.”)](https://discuss.elastic.co/t/search-for-documents-containing-words-with-and-without-dots-e-g-ceo-c-e-o-c-e-o/319035)
**Author:** [@revencu](https://discuss.elastic.co/u/revencu)\ **Replies:** 11\ **Last updated:** [November 16, 2022, 11:43am UTC](https://discuss.elastic.co/t/search-for-documents-containing-words-with-and-without-dots-e-g-ceo-c-e-o-c-e-o/319035 "2022-11-16T11:43:04Z")
{ "query":{ "match":{ "title": "ceo" } } } this query returns docs that only contain "ceo", "Ceo", "CEO". But the index has values like "c.e.o.", "C.E.O.", "c.e.o" How to set up a query so th… --- ## [ODBC connected to Power BI not doing "query folding"](https://discuss.elastic.co/t/odbc-connected-to-power-bi-not-doing-query-folding/318028)
**Author:** [@Raul\_Uria](https://discuss.elastic.co/u/Raul_Uria)\ **Replies:** 1\ **Last updated:** [November 16, 2022, 11:15am UTC](https://discuss.elastic.co/t/odbc-connected-to-power-bi-not-doing-query-folding/318028 "2022-11-16T11:15:47Z")
Hi, we´re trying ODBC driver, using it to connect PowerBI to Elasticsearch. We can see data into PowerBI, but performance is less than optimal, it seems like driver is not making "query folding" as "View native query" o… --- ## [Node stats API fails with a Null Pointer exception for data nodes](https://discuss.elastic.co/t/node-stats-api-fails-with-a-null-pointer-exception-for-data-nodes/319016)
**Author:** [@Dheeraj\_Gupta](https://discuss.elastic.co/u/Dheeraj_Gupta)\ **Replies:** 1\ **Last updated:** [November 16, 2022, 11:15am UTC](https://discuss.elastic.co/t/node-stats-api-fails-with-a-null-pointer-exception-for-data-nodes/319016 "2022-11-16T11:15:32Z")
Hi, We have recently upgraded to 8.5.0 from 8.4.1. We use the node stats API (\_nodes/stats) to pull stats about various nodes for storage into graphite. Since the update all data nodes are showing the following failure … --- ## [How can I clear "keyword" entries that have no documents?](https://discuss.elastic.co/t/how-can-i-clear-keyword-entries-that-have-no-documents/318537)
**Author:** [@wrobitza\_aveq](https://discuss.elastic.co/u/wrobitza_aveq)\ **Replies:** 7\ **Last updated:** [November 16, 2022, 10:45am UTC](https://discuss.elastic.co/t/how-can-i-clear-keyword-entries-that-have-no-documents/318537 "2022-11-16T10:45:21Z")
I accidentally indexed a document with a wrong text/keyword field. I later removed the document, but the keyword is still there. For instance, when I run the query: GET \_search { "size": 0, "aggs": { "group\_by\_… --- ## [Elastic DSL Query](https://discuss.elastic.co/t/elastic-dsl-query/319040)
**Author:** [@Nikhil\_Sharma2](https://discuss.elastic.co/u/Nikhil_Sharma2)\ **Replies:** 0\ **Last updated:** [November 16, 2022, 9:05am UTC](https://discuss.elastic.co/t/elastic-dsl-query/319040 "2022-11-16T09:05:38Z")
I have a query in sql which I want to transform in ES. Select \* from items where ( (State=== Open AND (userId=== '123' OR contributers.include('123'))) OR ( (State=== Review) AND ( AntherState=== Submitted AND A… --- ## [\[DOCS\] Monitoring](https://discuss.elastic.co/t/docs-monitoring/317197)
**Author:** [@sp-kyn](https://discuss.elastic.co/u/sp-kyn)\ **Replies:** 1\ **Last updated:** [November 16, 2022, 8:36am UTC](https://discuss.elastic.co/t/docs-monitoring/317197 "2022-11-16T08:36:26Z")
Hello, I'm new here, trying to understand the monitoring setup on a basic up to date 8.4.1 self-hosted elk stack. Continuing the discussion from No need to set \`xpack.monitoring.collection.enabled\` to true when using m… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=341) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=343)