# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=347 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 348 --- ## [Phrase\_slop does not affect query\_string](https://discuss.elastic.co/t/phrase-slop-does-not-affect-query-string/318345)
**Author:** [@MultiheadAttention](https://discuss.elastic.co/u/MultiheadAttention)\ **Replies:** 2\ **Last updated:** [November 7, 2022, 3:21pm UTC](https://discuss.elastic.co/t/phrase-slop-does-not-affect-query-string/318345 "2022-11-07T15:21:51Z")
My search query { "query\_string": {"query": 'foo bar', "phrase\_slop": 1, "default\_operator": "AND"} } returns the following results: 'foo bar' 'fo… --- ## [How to write a multi-lined script in C# / Nest?](https://discuss.elastic.co/t/how-to-write-a-multi-lined-script-in-c-nest/317907)
**Author:** [@Marcus\_Bullock](https://discuss.elastic.co/u/Marcus_Bullock)\ **Replies:** 2\ **Last updated:** [November 7, 2022, 2:51pm UTC](https://discuss.elastic.co/t/how-to-write-a-multi-lined-script-in-c-nest/317907 "2022-11-07T14:51:45Z")
Hi all, I am trying to write a statement like this but in Nest / C# object initializer syntax: GET /\_search { "query": { "bool": { "filter": { "script": { "script": """ double … --- ## ["best\_compression" not compressing the data](https://discuss.elastic.co/t/best-compression-not-compressing-the-data/318320)
**Author:** [@ashika](https://discuss.elastic.co/u/ashika)\ **Replies:** 2\ **Last updated:** [November 7, 2022, 2:27pm UTC](https://discuss.elastic.co/t/best-compression-not-compressing-the-data/318320 "2022-11-07T14:27:25Z")
Hello team, I was applying "best\_compression" compressing type to my existing elasticsearch indices, but I don't see any significant reduction happening in the indices size. The steps followed were : Close the indices … --- ## [At least one primary shard for the index \[.security-7\] is unavailable issue](https://discuss.elastic.co/t/at-least-one-primary-shard-for-the-index-security-7-is-unavailable-issue/316149)
**Author:** [@sahere37](https://discuss.elastic.co/u/sahere37)\ **Replies:** 8\ **Last updated:** [November 7, 2022, 12:31pm UTC](https://discuss.elastic.co/t/at-least-one-primary-shard-for-the-index-security-7-is-unavailable-issue/316149 "2022-11-07T12:31:23Z")
Hi I have a two-node cluster with IP "0.0.0.1" , "0.0.0.2". One of my VMs "0.0.0.2" suddenly stopped, and when I start it, the cluster health was RED. Then I restart both VMs again and below message has been found in th… --- ## [Can we tokenise emailid text along with split characters in elasticsearch and prefixes tokens?](https://discuss.elastic.co/t/can-we-tokenise-emailid-text-along-with-split-characters-in-elasticsearch-and-prefixes-tokens/318329)
**Author:** [@Karthik\_Amar](https://discuss.elastic.co/u/Karthik_Amar)\ **Replies:** 0\ **Last updated:** [November 7, 2022, 12:12pm UTC](https://discuss.elastic.co/t/can-we-tokenise-emailid-text-along-with-split-characters-in-elasticsearch-and-prefixes-tokens/318329 "2022-11-07T12:12:08Z")
I have a use case where i want to tokenise emailId with starts with filter along with punctuations. for example. email - ona.ki@gl.co I want to know whether the the following matches for the above is possible to achiev… --- ## [ElasticSearch deletes documents in an index automatically](https://discuss.elastic.co/t/elasticsearch-deletes-documents-in-an-index-automatically/318316)
**Author:** [@joanjanku2000](https://discuss.elastic.co/u/joanjanku2000)\ **Replies:** 19\ **Last updated:** [November 7, 2022, 11:51am UTC](https://discuss.elastic.co/t/elasticsearch-deletes-documents-in-an-index-automatically/318316 "2022-11-07T11:51:17Z")
I have configured an ELK Cluster with 5 nodes, one being master and the other slaves. I index logs in the cluster once a day using logstash. I use a CronJOB (script) to copy the log files to the configured logstash direc… --- ## [Fleet Server & ES Agent](https://discuss.elastic.co/t/fleet-server-es-agent/318259)
**Author:** [@EExisT](https://discuss.elastic.co/u/EExisT)\ **Replies:** 4\ **Last updated:** [November 7, 2022, 11:11am UTC](https://discuss.elastic.co/t/fleet-server-es-agent/318259 "2022-11-07T11:11:51Z")
Hello, when I try to install the fleet server on the machine I receive this error: sudo ./elastic-agent install \\--fleet-server-es=http://10.211.55.7:9200 \\--fleet-server-service-token=AAEAAWVsYXN0aWMvZmxlZXQtc2VydmVyL… --- ## [How to merge multiple ml job using watcher](https://discuss.elastic.co/t/how-to-merge-multiple-ml-job-using-watcher/318149)
**Author:** [@minkiyo](https://discuss.elastic.co/u/minkiyo)\ **Replies:** 1\ **Last updated:** [November 7, 2022, 10:49am UTC](https://discuss.elastic.co/t/how-to-merge-multiple-ml-job-using-watcher/318149 "2022-11-07T10:49:21Z")
Would you explain how to make alert merging multiple ml job using watcher?? I heared that it can be send alert to correlates multiple machine learning jobs to find the influencer. --- ## [Missing terms in rollup\_search terms aggregations](https://discuss.elastic.co/t/missing-terms-in-rollup-search-terms-aggregations/318314)
**Author:** [@sam.hession](https://discuss.elastic.co/u/sam.hession)\ **Replies:** 0\ **Last updated:** [November 7, 2022, 10:27am UTC](https://discuss.elastic.co/t/missing-terms-in-rollup-search-terms-aggregations/318314 "2022-11-07T10:27:09Z")
Hello, This is a request for a follow-up on a previously posted topic, also documented and acknowledged in an issue on the ElasticSearch repo. My team has encountered this known issue with rollup\_search terms aggregati… --- ## [Partial word search with free text search string in multiple fields](https://discuss.elastic.co/t/partial-word-search-with-free-text-search-string-in-multiple-fields/318311)
**Author:** [@Sagar\_Viradiya](https://discuss.elastic.co/u/Sagar_Viradiya)\ **Replies:** 0\ **Last updated:** [November 7, 2022, 10:02am UTC](https://discuss.elastic.co/t/partial-word-search-with-free-text-search-string-in-multiple-fields/318311 "2022-11-07T10:02:13Z")
Currently I am using multi\_match as below to search partial text string { "query": { "multi\_match": { "fields": \[ "model", "make", "year.keyword" … --- ## [ES 7.16 Rolling up multiple date fields](https://discuss.elastic.co/t/es-7-16-rolling-up-multiple-date-fields/316510)
**Author:** [@sam.hession](https://discuss.elastic.co/u/sam.hession)\ **Replies:** 1\ **Last updated:** [November 7, 2022, 9:53am UTC](https://discuss.elastic.co/t/es-7-16-rolling-up-multiple-date-fields/316510 "2022-11-07T09:53:27Z")
Hello Team, I'm currently working with rollup jobs in ES 7.16.2 and I'm looking to group on multiple date properties. It seems that this isn't currently possible with the API only supporting a single data\_histogram fiel… --- ## [Information about ml result index](https://discuss.elastic.co/t/information-about-ml-result-index/318288)
**Author:** [@minkiyo](https://discuss.elastic.co/u/minkiyo)\ **Replies:** 1\ **Last updated:** [November 7, 2022, 9:22am UTC](https://discuss.elastic.co/t/information-about-ml-result-index/318288 "2022-11-07T09:22:19Z")
When I make ML Job, I could find 3 type of ml index. Would you explain exactly what index is for?? .ml-anomalies-.write-ml\_oap\_bucket\_3\_advanced\_multi\_metric .ml-anomalies-ml\_oap\_bucket\_3\_advanced\_multi\_metric .ml-ano… --- ## [How big should an index be for 2x data node cluster](https://discuss.elastic.co/t/how-big-should-an-index-be-for-2x-data-node-cluster/317531)
**Author:** [@landychev](https://discuss.elastic.co/u/landychev)\ **Replies:** 5\ **Last updated:** [November 7, 2022, 9:00am UTC](https://discuss.elastic.co/t/how-big-should-an-index-be-for-2x-data-node-cluster/317531 "2022-11-07T09:00:14Z")
I did a query at my elastic nodes today. curl -X GET "http://$IP:9200/\_cat/indices?v" I did see that i have some index that are 80-90Gb and some are smaller. Is that normal or do i have some wrong settings ? Does the… --- ## [Elasticsearch - Attempted to resurrect connection to dead ES instance, but got an error](https://discuss.elastic.co/t/elasticsearch-attempted-to-resurrect-connection-to-dead-es-instance-but-got-an-error/318291)
**Author:** [@Zay\_Lin\_Htun](https://discuss.elastic.co/u/Zay_Lin_Htun)\ **Replies:** 5\ **Last updated:** [November 7, 2022, 8:49am UTC](https://discuss.elastic.co/t/elasticsearch-attempted-to-resurrect-connection-to-dead-es-instance-but-got-an-error/318291 "2022-11-07T08:49:19Z")
My Logstash can not connect to Elastic Search. My Logstash beats.conf config input { beats { port =\> 5044 } } output { elasticsearch { hosts =\> \["18.00.00.00:9200"\] } stdout { codec =\> rubydebug } } My Fil… --- ## [Remote Cluster](https://discuss.elastic.co/t/remote-cluster/317973)
**Author:** [@pankaj\_sharma1](https://discuss.elastic.co/u/pankaj_sharma1)\ **Replies:** 6\ **Last updated:** [November 7, 2022, 8:19am UTC](https://discuss.elastic.co/t/remote-cluster/317973 "2022-11-07T08:19:52Z")
HI all, after adding remote cluster in version of 8.2.2 . I'm getting list of remote cluster under the monitoring. --- ## [Important system indices](https://discuss.elastic.co/t/important-system-indices/318248)
**Author:** [@QuestBevan](https://discuss.elastic.co/u/QuestBevan)\ **Replies:** 1\ **Last updated:** [November 7, 2022, 3:40am UTC](https://discuss.elastic.co/t/important-system-indices/318248 "2022-11-07T03:40:32Z")
Hi All, Struggling to find a post detailing important system indices that should be backed up. Can someone provide a list of what should be backed up? My use case, is if our cluster was to corrupt, yes the data in it i… --- ## [Elaticsearch CCR \[Cross cluster replication\] Local setup](https://discuss.elastic.co/t/elaticsearch-ccr-cross-cluster-replication-local-setup/318190)
**Author:** [@Suraj\_Jannu](https://discuss.elastic.co/u/Suraj_Jannu)\ **Replies:** 1\ **Last updated:** [November 7, 2022, 3:30am UTC](https://discuss.elastic.co/t/elaticsearch-ccr-cross-cluster-replication-local-setup/318190 "2022-11-07T03:30:16Z")
Hello, I have two Elasticsearch instances running on my local machine with version \[7.5.1 and 8.4.3\]. Now I need to migrate the data from the old version instance to the new version instance. Question: Is CCR the co… --- ## [No name matching kunboy5240.tk found](https://discuss.elastic.co/t/no-name-matching-kunboy5240-tk-found/318103)
**Author:** [@a8840072](https://discuss.elastic.co/u/a8840072)\ **Replies:** 1\ **Last updated:** [November 7, 2022, 1:12am UTC](https://discuss.elastic.co/t/no-name-matching-kunboy5240-tk-found/318103 "2022-11-07T01:12:22Z")
I have configured the ssl certificate for my es, but when I want to reset the password, this exception occurs. I am sure that the"kunboy5240.tk" in the url I entered is my domain name used to generate the certificate , w… --- ## [ILM elasticsearch not working](https://discuss.elastic.co/t/ilm-elasticsearch-not-working/318263)
**Author:** [@alex\_96](https://discuss.elastic.co/u/alex_96)\ **Replies:** 2\ **Last updated:** [November 6, 2022, 4:06pm UTC](https://discuss.elastic.co/t/ilm-elasticsearch-not-working/318263 "2022-11-06T16:06:03Z")
Such a question, I read the manual and I seem to have done everything right, but I still get an error for indices, I use the wazuh template and add the following to it: { "order": 0, "index\_patterns": \[ "wazuh-a… --- ## [Alert index is not getting generated](https://discuss.elastic.co/t/alert-index-is-not-getting-generated/318240)
**Author:** [@breakingcode](https://discuss.elastic.co/u/breakingcode)\ **Replies:** 3\ **Last updated:** [November 6, 2022, 3:37pm UTC](https://discuss.elastic.co/t/alert-index-is-not-getting-generated/318240 "2022-11-06T15:37:02Z")
Hii, I am creating alerts for my data view. I configured the rule as if salary property in data view extends some value an document with alert info will be saved in alert index. But when I enable my rule no alert index i… --- ## [Flattened Data Type Sorting](https://discuss.elastic.co/t/flattened-data-type-sorting/318262)
**Author:** [@kailash\_lambe](https://discuss.elastic.co/u/kailash_lambe)\ **Replies:** 0\ **Last updated:** [November 6, 2022, 2:41pm UTC](https://discuss.elastic.co/t/flattened-data-type-sorting/318262 "2022-11-06T14:41:22Z")
Hi Team, I need your input for one of the tasks, I am working on one of the project where I need the different multiple price combinations for each product and since we do not have control over the number of combination… --- ## [Dev tools painless lab vs Watcher transform Context (Map Stream)](https://discuss.elastic.co/t/dev-tools-painless-lab-vs-watcher-transform-context-map-stream/318256)
**Author:** [@kelk](https://discuss.elastic.co/u/kelk)\ **Replies:** 0\ **Last updated:** [November 6, 2022, 11:05am UTC](https://discuss.elastic.co/t/dev-tools-painless-lab-vs-watcher-transform-context-map-stream/318256 "2022-11-06T11:05:35Z")
hi I could use below logic successfully in Watcher transforms def documents = ctx.payload.hits.hits.stream() .map(hit -\> \[ "sum\_other\_doc\_count": hit.\_source.event\_dataset.sum\_other\_doc\_count \]) .coll… --- ## [Wrong timestamp in Alert index](https://discuss.elastic.co/t/wrong-timestamp-in-alert-index/318247)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 0\ **Last updated:** [November 6, 2022, 5:51am UTC](https://discuss.elastic.co/t/wrong-timestamp-in-alert-index/318247 "2022-11-06T05:51:18Z")
Hi All, I have created an alert which will do send alert on a specified index. I have chosen elasticsearch query index. I have used metricbeat-\* index for monitoring system uptime if node goes down i will get the alert … --- ## [Relevance of results on multiple fields](https://discuss.elastic.co/t/relevance-of-results-on-multiple-fields/318245)
**Author:** [@ChristopherHS](https://discuss.elastic.co/u/ChristopherHS)\ **Replies:** 0\ **Last updated:** [November 5, 2022, 6:55pm UTC](https://discuss.elastic.co/t/relevance-of-results-on-multiple-fields/318245 "2022-11-05T18:55:20Z")
Hello, We are new to the use of Elasticsearch, we can't make a setting to display the results with the right relevance on the phrase in the search. To give an example, when we do a search with the phrase Facebook Data … --- ## [Correct understanding of "aliases" in elasticsearch](https://discuss.elastic.co/t/correct-understanding-of-aliases-in-elasticsearch/318126)
**Author:** [@alex\_96](https://discuss.elastic.co/u/alex_96)\ **Replies:** 3\ **Last updated:** [November 5, 2022, 5:09pm UTC](https://discuss.elastic.co/t/correct-understanding-of-aliases-in-elasticsearch/318126 "2022-11-05T17:09:11Z")
Hello everyone, the question may be stupid, but I want to clarify: aliases in elasticsearch are essentially like links to one or more indexes or data streams, but recently during the creation of the ILM, I saw an error -… --- ## [Inner\_hits in has parent giving error-"Couldn't find nested source for path currentCompany"](https://discuss.elastic.co/t/inner-hits-in-has-parent-giving-error-couldnt-find-nested-source-for-path-currentcompany/318232)
**Author:** [@Venkat\_Koushik](https://discuss.elastic.co/u/Venkat_Koushik)\ **Replies:** 0\ **Last updated:** [November 5, 2022, 10:18am UTC](https://discuss.elastic.co/t/inner-hits-in-has-parent-giving-error-couldnt-find-nested-source-for-path-currentcompany/318232 "2022-11-05T10:18:28Z")
Hello We are migrating to Elasticsearch 8 and when we are trying to fetch the data of parent document inner hits using has parent query it is returning exception but the reverse scenario is working good.Elasticsearch re… --- ## [Elasticsearch 7.17.3: \[parent\] Data too large, data for \[cluster:monitor/nodes/stats\[n\]\]](https://discuss.elastic.co/t/elasticsearch-7-17-3-parent-data-too-large-data-for-cluster-monitor-nodes-stats-n/317349)
**Author:** [@alecswan](https://discuss.elastic.co/u/alecswan)\ **Replies:** 12\ **Last updated:** [November 5, 2022, 12:22am UTC](https://discuss.elastic.co/t/elasticsearch-7-17-3-parent-data-too-large-data-for-cluster-monitor-nodes-stats-n/317349 "2022-11-05T00:22:43Z")
Hello, We recently upgraded from ES 7.9.2 to 7.17.3 (in preparation for the subsequent 8.x upgrade) and noticed that the cluster spends a lot more time in Yellow state than it used to. The root cause appears to be the "… --- ## [How can I add a ilm policy to an existing datastream index](https://discuss.elastic.co/t/how-can-i-add-a-ilm-policy-to-an-existing-datastream-index/316931)
**Author:** [@Russell\_Fulton](https://discuss.elastic.co/u/Russell_Fulton)\ **Replies:** 4\ **Last updated:** [November 4, 2022, 11:12pm UTC](https://discuss.elastic.co/t/how-can-i-add-a-ilm-policy-to-an-existing-datastream-index/316931 "2022-11-04T23:12:37Z")
Some how I have got an index (currently being written) in a data stream which does not have an ilm setting and therefore is not getting rolled over. It is unclear to me what I should do. When I tried to close the index… --- ## [Unable to query for exact term](https://discuss.elastic.co/t/unable-to-query-for-exact-term/318215)
**Author:** [@learningelastic](https://discuss.elastic.co/u/learningelastic)\ **Replies:** 1\ **Last updated:** [November 4, 2022, 9:08pm UTC](https://discuss.elastic.co/t/unable-to-query-for-exact-term/318215 "2022-11-04T21:08:51Z")
I'm still new to working with elasticsearch queries. I find that my query is returning too many results despite my attempts to request specific results. For example, if I run this query: GET /test-index/\_search { "que… --- ## [Specific Encyption at Rest Algorithm?](https://discuss.elastic.co/t/specific-encyption-at-rest-algorithm/318210)
**Author:** [@tensor](https://discuss.elastic.co/u/tensor)\ **Replies:** 1\ **Last updated:** [November 4, 2022, 7:26pm UTC](https://discuss.elastic.co/t/specific-encyption-at-rest-algorithm/318210 "2022-11-04T19:26:01Z")
Hi One of our customers is insisting we provide evidence of encryption used by our third party processors (which includes Elastic). I can find published statements that data is encrypted at rest in the SOC-3 compliance… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=346) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=348)