# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=344 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 345 --- ## [How to Count repeated values in Kibana](https://discuss.elastic.co/t/how-to-count-repeated-values-in-kibana/318872)
**Author:** [@phil\_hcs\_tech](https://discuss.elastic.co/u/phil_hcs_tech)\ **Replies:** 1\ **Last updated:** [November 14, 2022, 1:00pm UTC](https://discuss.elastic.co/t/how-to-count-repeated-values-in-kibana/318872 "2022-11-14T13:00:19Z")
I have an index storing family data. One of the properties is "childrenAges" which stores a list of the ages of the children in the family, see sample data below. I need to be able to count the ages of children across t… --- ## [Can I use ES roles with security disabled?](https://discuss.elastic.co/t/can-i-use-es-roles-with-security-disabled/318861)
**Author:** [@powerful\_clouds](https://discuss.elastic.co/u/powerful_clouds)\ **Replies:** 3\ **Last updated:** [November 14, 2022, 11:18am UTC](https://discuss.elastic.co/t/can-i-use-es-roles-with-security-disabled/318861 "2022-11-14T11:18:47Z")
I'm trying to use field-level security with ES. I have successfully created an index and populated it with some data. I have also defined a roles.yml file: regular: cluster: all indices: - names: \['log-index'\] … --- ## [Field \[event.ingested\] of type \[keyword\] does not support custom formats](https://discuss.elastic.co/t/field-event-ingested-of-type-keyword-does-not-support-custom-formats/318850)
**Author:** [@tegerei](https://discuss.elastic.co/u/tegerei)\ **Replies:** 1\ **Last updated:** [November 14, 2022, 10:06am UTC](https://discuss.elastic.co/t/field-event-ingested-of-type-keyword-does-not-support-custom-formats/318850 "2022-11-14T10:06:30Z")
I am using elasticsearch 7.10. On Friday night, one of the indices threw the error llegal\_argument\_exception at shard 0index xx.yynode FNZgMx35SGBsn8a1rs0WKQ Field \[event.ingested\] of type \[keyword\] does not support cu… --- ## [Replace old Cold Node by a new one and migrate data](https://discuss.elastic.co/t/replace-old-cold-node-by-a-new-one-and-migrate-data/318410)
**Author:** [@zenzedoon](https://discuss.elastic.co/u/zenzedoon)\ **Replies:** 8\ **Last updated:** [November 14, 2022, 9:39am UTC](https://discuss.elastic.co/t/replace-old-cold-node-by-a-new-one-and-migrate-data/318410 "2022-11-14T09:39:16Z")
Hello, I have an ELK cluster with 3 nodes (debian 11 and ELK 7.17.0) : node1 (master+hot+ingest+content) 2Tb node2 (master+worm) 3Tb node3 (master+cold) 4Tb the cluster now is on red status cause the node3 is full ,… --- ## [Estimated bandwidth for normal operation](https://discuss.elastic.co/t/estimated-bandwidth-for-normal-operation/318840)
**Author:** [@Zay\_Lin\_Htun](https://discuss.elastic.co/u/Zay_Lin_Htun)\ **Replies:** 2\ **Last updated:** [November 14, 2022, 9:04am UTC](https://discuss.elastic.co/t/estimated-bandwidth-for-normal-operation/318840 "2022-11-14T09:04:40Z")
Hi all, I am the new to ELK stack and I would like to calculate the bandwidth for normal operation. "Based on my understanding, There's a number of consumers of bandwidth in an Elasticsearch cluster. The main two in no… --- ## [Elasticsearch index data not found in directory data.path](https://discuss.elastic.co/t/elasticsearch-index-data-not-found-in-directory-data-path/318835)
**Author:** [@suresh\_chaudhari](https://discuss.elastic.co/u/suresh_chaudhari)\ **Replies:** 1\ **Last updated:** [November 14, 2022, 8:20am UTC](https://discuss.elastic.co/t/elasticsearch-index-data-not-found-in-directory-data-path/318835 "2022-11-14T08:20:55Z")
Hi in .yml file i have mentioned data.path=custom directory.The index has approximate 500 mb data . when i CD to the custom directory and do \>\> ls -lh its only 4.kb I wonder where all the data resides of elasticsearch… --- ## [Does combined\_fields query (or multi-match+cross\_fields) support phrase?](https://discuss.elastic.co/t/does-combined-fields-query-or-multi-match-cross-fields-support-phrase/318837)
**Author:** [@yliu000](https://discuss.elastic.co/u/yliu000)\ **Replies:** 0\ **Last updated:** [November 14, 2022, 8:03am UTC](https://discuss.elastic.co/t/does-combined-fields-query-or-multi-match-cross-fields-support-phrase/318837 "2022-11-14T08:03:00Z")
Hi, I have documents with multiple fields, and want to do "term centric" search, instead of "field centric" search. (Following term centric combined\_fields for "term centric" definition). I have two needs: First, I n… --- ## [Elasticseach shards allocation](https://discuss.elastic.co/t/elasticseach-shards-allocation/318770)
**Author:** [@Petr.Simik](https://discuss.elastic.co/u/Petr.Simik)\ **Replies:** 2\ **Last updated:** [November 14, 2022, 5:13am UTC](https://discuss.elastic.co/t/elasticseach-shards-allocation/318770 "2022-11-14T05:13:22Z")
Hi, I have elastic version 7.17.0 and I have a problem with shard allocation, which causes problems with data loading. The cluster is rejecting requests and limiting ingest due to overloading 2 nodes. The nodes are ov… --- ## [ELK Migartion to 8.4.3](https://discuss.elastic.co/t/elk-migartion-to-8-4-3/318715)
**Author:** [@Suraj\_Jannu](https://discuss.elastic.co/u/Suraj_Jannu)\ **Replies:** 1\ **Last updated:** [November 14, 2022, 3:08am UTC](https://discuss.elastic.co/t/elk-migartion-to-8-4-3/318715 "2022-11-14T03:08:08Z")
Hello, Current ELK stack version details: Elasticsearch: 7.5.1 Kibana: 6.7.2 Logstash: 6.8.12 We are using ELK purely as a log-aggregation platform and I am planning to update my ELK cluster 8.4.3. Could you ple… --- ## [Enable user to generate API Key and access API](https://discuss.elastic.co/t/enable-user-to-generate-api-key-and-access-api/318695)
**Author:** [@zaeemmasood](https://discuss.elastic.co/u/zaeemmasood)\ **Replies:** 9\ **Last updated:** [November 14, 2022, 2:43am UTC](https://discuss.elastic.co/t/enable-user-to-generate-api-key-and-access-api/318695 "2022-11-14T02:43:43Z")
Hello. We are running ELK 7.6.2 stack. I need to create a user and provide it access for API key generation along with API access. When I check in Kibana console it says "API keys not enabled in Elasticsearch" Please … --- ## [How to split ".security-7"](https://discuss.elastic.co/t/how-to-split-security-7/317807)
**Author:** [@MuFeng](https://discuss.elastic.co/u/MuFeng)\ **Replies:** 18\ **Last updated:** [November 14, 2022, 1:58am UTC](https://discuss.elastic.co/t/how-to-split-security-7/317807 "2022-11-14T01:58:29Z")
Why can't I add multiple copies of. security-7 in the ES8 cluster? How to modify the number of replicas of the system index? --- ## [Kibana setup with elasticsearch 8.4.3](https://discuss.elastic.co/t/kibana-setup-with-elasticsearch-8-4-3/318792)
**Author:** [@Suraj\_Jannu](https://discuss.elastic.co/u/Suraj_Jannu)\ **Replies:** 1\ **Last updated:** [November 14, 2022, 12:38am UTC](https://discuss.elastic.co/t/kibana-setup-with-elasticsearch-8-4-3/318792 "2022-11-14T00:38:14Z")
Hello, I am setting up the Kibana and Elasticseach instances in AWS with version 8.4.3. The Elasticsearch instance is up and running. While configuring the kibana I have set the following properties. server.host: 0.0.… --- ## [What is the effect of circuit breakers limit on search queries](https://discuss.elastic.co/t/what-is-the-effect-of-circuit-breakers-limit-on-search-queries/318795)
**Author:** [@md2](https://discuss.elastic.co/u/md2)\ **Replies:** 1\ **Last updated:** [November 13, 2022, 11:36pm UTC](https://discuss.elastic.co/t/what-is-the-effect-of-circuit-breakers-limit-on-search-queries/318795 "2022-11-13T23:36:45Z")
Hi, I am wondering what happens to the queries that hit the circuit breakers memory limit, are they discarded completely and lost forever? What is the recommended method to monitor these queries? Does this entry from th… --- ## [Using Elasticsearch as a Data Lake and forwarding logs to SIEM based on the use cases implemented](https://discuss.elastic.co/t/using-elasticsearch-as-a-data-lake-and-forwarding-logs-to-siem-based-on-the-use-cases-implemented/318558)
**Author:** [@bit1290](https://discuss.elastic.co/u/bit1290)\ **Replies:** 3\ **Last updated:** [November 13, 2022, 11:31pm UTC](https://discuss.elastic.co/t/using-elasticsearch-as-a-data-lake-and-forwarding-logs-to-siem-based-on-the-use-cases-implemented/318558 "2022-11-13T23:31:52Z")
Hello, I really need your help and vision on a situation I'm passing through. Here is the description: We have a SIEM (QRadar) structure, with Event Collectors that receive logs from various data sources from many … --- ## [Upgrade to non free license in self managed elastic production](https://discuss.elastic.co/t/upgrade-to-non-free-license-in-self-managed-elastic-production/318807)
**Author:** [@Mahdi\_Moazami](https://discuss.elastic.co/u/Mahdi_Moazami)\ **Replies:** 2\ **Last updated:** [November 13, 2022, 9:43pm UTC](https://discuss.elastic.co/t/upgrade-to-non-free-license-in-self-managed-elastic-production/318807 "2022-11-13T21:43:25Z")
Hi there elastic team we have a self managed elastic setup in our production servers and we are looking for the way to buy Gold or Platinum license. what I got from searching in site was that this functionality is only … --- ## [Elasticsearch node fails after multiple G1GC triggers](https://discuss.elastic.co/t/elasticsearch-node-fails-after-multiple-g1gc-triggers/318779)
**Author:** [@BradVido](https://discuss.elastic.co/u/BradVido)\ **Replies:** 0\ **Last updated:** [November 12, 2022, 9:16pm UTC](https://discuss.elastic.co/t/elasticsearch-node-fails-after-multiple-g1gc-triggers/318779 "2022-11-12T21:16:09Z")
We have a 6 node cluster on ES 7.17.7, which is very stable except for our single coordinating node (which also is master eligible, so not a "true" coordinating node). After 4-6 hours of uptime, we always get the below … --- ## [How many Public IP need for my cluster](https://discuss.elastic.co/t/how-many-public-ip-need-for-my-cluster/318766)
**Author:** [@Zay\_Lin\_Htun](https://discuss.elastic.co/u/Zay_Lin_Htun)\ **Replies:** 1\ **Last updated:** [November 12, 2022, 11:06pm UTC](https://discuss.elastic.co/t/how-many-public-ip-need-for-my-cluster/318766 "2022-11-12T23:06:33Z")
I would like to know the how many Public IP addresses need to deploy my cluster in AWS. In my cluster, there are 2 data nodes for Hot data 2 data nodes for warm data 3 Master Nodes 2 Logstash Feel free to suggest me … --- ## [Add new documents to an enrich index](https://discuss.elastic.co/t/add-new-documents-to-an-enrich-index/318759)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 3\ **Last updated:** [November 12, 2022, 1:08am UTC](https://discuss.elastic.co/t/add-new-documents-to-an-enrich-index/318759 "2022-11-12T01:08:05Z")
Hi, I have filebeat sending data to elasticsearch, this data is enriched with an ingest pipeline, I have added a new document to the enrich index that already is in use, but the changes are not showing. What do I have … --- ## [\[ERROR\] Cannot race. This race ended with a fatal crash](https://discuss.elastic.co/t/error-cannot-race-this-race-ended-with-a-fatal-crash/318756)
**Author:** [@Sahitya\_Panchapakasa](https://discuss.elastic.co/u/Sahitya_Panchapakasa)\ **Replies:** 1\ **Last updated:** [November 11, 2022, 7:18pm UTC](https://discuss.elastic.co/t/error-cannot-race-this-race-ended-with-a-fatal-crash/318756 "2022-11-11T19:18:18Z")
Hi, Am just getting started with rally and got this error when doing esrally race --distribution-version=6.8.0 --track=geopoint --challenge=append-fast-with-conflicts Steps followed as per https://esrally.readthedocs.… --- ## [Multilingual search and retrieval of a translated field](https://discuss.elastic.co/t/multilingual-search-and-retrieval-of-a-translated-field/318683)
**Author:** [@ChristopherHS](https://discuss.elastic.co/u/ChristopherHS)\ **Replies:** 2\ **Last updated:** [November 11, 2022, 6:05pm UTC](https://discuss.elastic.co/t/multilingual-search-and-retrieval-of-a-translated-field/318683 "2022-11-11T18:05:55Z")
Hello, I have the following mapping: { "settings": { "analysis": { "analyzer": { "en\_stopwords": { "type": "standard", "stopwords": "\_english\_" }, "de\_stopwords":… --- ## [Rollup with max/min aggregation on @timestamp field typed as "float"](https://discuss.elastic.co/t/rollup-with-max-min-aggregation-on-timestamp-field-typed-as-float/317735)
**Author:** [@ISim](https://discuss.elastic.co/u/ISim)\ **Replies:** 3\ **Last updated:** [November 11, 2022, 1:46pm UTC](https://discuss.elastic.co/t/rollup-with-max-min-aggregation-on-timestamp-field-typed-as-float/317735 "2022-11-11T13:46:44Z")
Hello all, I have a index with accounting events with @timestamp (type "date"). There is a high volume of events so I created rollup job (elasticsearch 7.17.3) with "date\_histogram" : { "d… --- ## [Scaling elastic search for read heavy applications](https://discuss.elastic.co/t/scaling-elastic-search-for-read-heavy-applications/317597)
**Author:** [@himesh](https://discuss.elastic.co/u/himesh)\ **Replies:** 11\ **Last updated:** [November 11, 2022, 12:03pm UTC](https://discuss.elastic.co/t/scaling-elastic-search-for-read-heavy-applications/317597 "2022-11-11T12:03:37Z")
We have Node JS (Nest JS / Express) - based application services on the GCP cloud. We are using Elasticsearch to support full-text search on a blog/news website. Our requirement is to support 2000 reads per second mini… --- ## [Any performance difference between "must\_not" clause and "query\_string" with NOT operator?](https://discuss.elastic.co/t/any-performance-difference-between-must-not-clause-and-query-string-with-not-operator/318729)
**Author:** [@astrodi](https://discuss.elastic.co/u/astrodi)\ **Replies:** 0\ **Last updated:** [November 11, 2022, 11:09am UTC](https://discuss.elastic.co/t/any-performance-difference-between-must-not-clause-and-query-string-with-not-operator/318729 "2022-11-11T11:09:39Z")
Hi there, I'm wondering, if there is any performance gain using must\_not clause over to query\_string using NOT operator (will be used inside filter and should clause). query\_string has obviously shorter scripture, no r… --- ## [Input/output error when creating snapshot](https://discuss.elastic.co/t/input-output-error-when-creating-snapshot/318721)
**Author:** [@lifer](https://discuss.elastic.co/u/lifer)\ **Replies:** 1\ **Last updated:** [November 11, 2022, 10:48am UTC](https://discuss.elastic.co/t/input-output-error-when-creating-snapshot/318721 "2022-11-11T10:48:38Z")
Hi! We have a 3-nodes self-hosted ES 8.5 cluster, and when we make daily snapshots few shards fail every time with the following error: INTERNAL\_SERVER\_ERROR: UncategorizedExecutionException\[Failed execution\]; nested:… --- ## [Master not discovered or elected yet](https://discuss.elastic.co/t/master-not-discovered-or-elected-yet/318706)
**Author:** [@usilva](https://discuss.elastic.co/u/usilva)\ **Replies:** 3\ **Last updated:** [November 11, 2022, 9:12am UTC](https://discuss.elastic.co/t/master-not-discovered-or-elected-yet/318706 "2022-11-11T09:12:46Z")
{"type": "server", "timestamp": "2022-11-11T05:46:01,375Z", "level": "WARN", "component": "o.e.c.c.ClusterFormationFailureHelper", "cluster.name": "elasticsearch", "node.name": "elasticsearch-master-0", "message": "mas… --- ## [Extract data from elasticsearch and store into mongodb](https://discuss.elastic.co/t/extract-data-from-elasticsearch-and-store-into-mongodb/318337)
**Author:** [@chinmoy\_padhi](https://discuss.elastic.co/u/chinmoy_padhi)\ **Replies:** 4\ **Last updated:** [November 11, 2022, 7:44am UTC](https://discuss.elastic.co/t/extract-data-from-elasticsearch-and-store-into-mongodb/318337 "2022-11-11T07:44:32Z")
Hi, I'm looking for an option to extract data from Elasticsearch and store into the mongodb using some python script. Please help me with that. --- ## [How to resize image file in watcher](https://discuss.elastic.co/t/how-to-resize-image-file-in-watcher/318703)
**Author:** [@minkiyo](https://discuss.elastic.co/u/minkiyo)\ **Replies:** 0\ **Last updated:** [November 11, 2022, 2:51am UTC](https://discuss.elastic.co/t/how-to-resize-image-file-in-watcher/318703 "2022-11-11T02:51:00Z")
I want to add image file in email using watcher. but It's only added very big size image file. I think the width and height in img src don't seem to work. Would you please explain how to resize image file in watcher?? … --- ## [Elasticsearch8.5.0 jar hell problem](https://discuss.elastic.co/t/elasticsearch8-5-0-jar-hell-problem/318619)
**Author:** [@asasas234](https://discuss.elastic.co/u/asasas234)\ **Replies:** 1\ **Last updated:** [November 11, 2022, 1:10am UTC](https://discuss.elastic.co/t/elasticsearch8-5-0-jar-hell-problem/318619 "2022-11-11T01:10:51Z")
warning: ignoring JAVA\_HOME=/home/lizhibo/.sdkman/candidates/java/current; using bundled JDK java=/home/lizhibo/elasticsearch-8.5.0/jdk/bin/java \[2022-11-10T15:23:01,353\]\[ERROR\]\[o.e.b.Elasticsearch \] \[node-1\] fatal … --- ## [Filebeat Apache module not showing data on Dashboards when using Logstash](https://discuss.elastic.co/t/filebeat-apache-module-not-showing-data-on-dashboards-when-using-logstash/318594)
**Author:** [@Carlos\_T](https://discuss.elastic.co/u/Carlos_T)\ **Replies:** 12\ **Last updated:** [November 10, 2022, 11:08pm UTC](https://discuss.elastic.co/t/filebeat-apache-module-not-showing-data-on-dashboards-when-using-logstash/318594 "2022-11-10T23:08:08Z")
Good afternoon all. I've recently installed a filebeat and enabled the system and apache modules. After that I set the filebeat.yml to point to ES and Kibana and run the 'filebeat setup -e' Everything went as expecte… --- ## [Three Node Elastic Cluster balance issue](https://discuss.elastic.co/t/three-node-elastic-cluster-balance-issue/318680)
**Author:** [@alex\_sws](https://discuss.elastic.co/u/alex_sws)\ **Replies:** 6\ **Last updated:** [November 10, 2022, 10:08pm UTC](https://discuss.elastic.co/t/three-node-elastic-cluster-balance-issue/318680 "2022-11-10T22:08:58Z")
I have a 3 node elastic cluster with each node having equal disk space (250 Gb) but for some reason two of the nodes have significant more data usage then the others. When reviewing the servers, all the data usage is tie… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=343) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=345)