# Elasticsearch

**URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=361

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 362

---

## [Collapse not working with search\_after with single sort field and PIT](https://discuss.elastic.co/t/collapse-not-working-with-search-after-with-single-sort-field-and-pit/316165)

<div class="topic-metadata">

**Author:** [@Reese\_Allison](https://discuss.elastic.co/u/Reese_Allison)\
**Replies:** 1\
**Last updated:** [October 11, 2022, 3:30pm UTC](https://discuss.elastic.co/t/collapse-not-working-with-search-after-with-single-sort-field-and-pit/316165 "2022-10-11T15:30:06Z")

</div>

I have an Elastic query that initially returns results. When I attempt the query again using search\_after for paging, I am getting the error: Cannot use \[collapse\] in conjunction with \[search\_after\] unless the search is …

---

## [Reindex specific documents](https://discuss.elastic.co/t/reindex-specific-documents/316333)

<div class="topic-metadata">

**Author:** [@spike83](https://discuss.elastic.co/u/spike83)\
**Replies:** 1\
**Last updated:** [October 11, 2022, 2:28pm UTC](https://discuss.elastic.co/t/reindex-specific-documents/316333 "2022-10-11T14:28:41Z")

</div>

Hi, I have accidentally mixed docs into an index (not going to go into how lets just call it a silly config mistake) I have luckily tagged the docs and would like to reindex all docs that meet a specific tag. Could an…

---

## [Document level security not behaving as expected](https://discuss.elastic.co/t/document-level-security-not-behaving-as-expected/316320)

<div class="topic-metadata">

**Author:** [@iaata](https://discuss.elastic.co/u/iaata)\
**Replies:** 2\
**Last updated:** [October 11, 2022, 11:16am UTC](https://discuss.elastic.co/t/document-level-security-not-behaving-as-expected/316320 "2022-10-11T11:16:42Z")

</div>

Hello. I am trying to setup document level security for a single index. My goal is to restrict access to documents in a way, where users only have access to the documents where their username match a field in the docum…

---

## [LDAP User Authentication Multiple Users](https://discuss.elastic.co/t/ldap-user-authentication-multiple-users/316319)

<div class="topic-metadata">

**Author:** [@Tarah](https://discuss.elastic.co/u/Tarah)\
**Replies:** 0\
**Last updated:** [October 11, 2022, 10:47am UTC](https://discuss.elastic.co/t/ldap-user-authentication-multiple-users/316319 "2022-10-11T10:47:29Z")

</div>

Hi Elastic Team, I'm still new on configuring LDAP User Auth. Just wanted to ask if it's possible to use the password value in LDAP directly as the bind password? Because what I have done today was only 1 user and just …

---

## [Field mapping: "ignore\_above" and "index" settings](https://discuss.elastic.co/t/field-mapping-ignore-above-and-index-settings/316235)

<div class="topic-metadata">

**Author:** [@gdd](https://discuss.elastic.co/u/gdd)\
**Replies:** 0\
**Last updated:** [October 10, 2022, 2:24pm UTC](https://discuss.elastic.co/t/field-mapping-ignore-above-and-index-settings/316235 "2022-10-10T14:24:36Z")

</div>

I experienced bulks by logstash returning some errors, The template contained this mapping for event.original field: {"index": false, "type": "keyword", "doc\_values": false } The unexpected solution has been the intro…

---

## [ES upgrade from 6 to 8 - How to?](https://discuss.elastic.co/t/es-upgrade-from-6-to-8-how-to/316290)

<div class="topic-metadata">

**Author:** [@Eduardo\_Montes](https://discuss.elastic.co/u/Eduardo_Montes)\
**Replies:** 0\
**Last updated:** [October 11, 2022, 8:40am UTC](https://discuss.elastic.co/t/es-upgrade-from-6-to-8-how-to/316290 "2022-10-11T08:40:35Z")

</div>

Hi, I tried to make the ES upgrade from 6.2.4 to 8.4. I found out that there are many not supported features in 8 version. E.g. missing tree a precision attributes in geo\_shape data type, not supported possibility to d…

---

## [Point In Time for multi threaded queries / slices](https://discuss.elastic.co/t/point-in-time-for-multi-threaded-queries-slices/316243)

<div class="topic-metadata">

**Author:** [@str8y](https://discuss.elastic.co/u/str8y)\
**Replies:** 0\
**Last updated:** [October 10, 2022, 3:51pm UTC](https://discuss.elastic.co/t/point-in-time-for-multi-threaded-queries-slices/316243 "2022-10-10T15:51:19Z")

</div>

Hi, I read in the documentation that every result could contain an updated id for the pit I created, which I have to use in subsequent search requests. How does that behave in scenarios where I'm using multiple searche…

---

## [Delete actual config of snapshot](https://discuss.elastic.co/t/delete-actual-config-of-snapshot/316295)

<div class="topic-metadata">

**Author:** [@abkrim](https://discuss.elastic.co/u/abkrim)\
**Replies:** 0\
**Last updated:** [October 11, 2022, 9:05am UTC](https://discuss.elastic.co/t/delete-actual-config-of-snapshot/316295 "2022-10-11T09:05:35Z")

</div>

After working for a while in test mode, I wanted to start using NFS as a mount point for snapshots. I had a configuration in the elasticsearch.yml file \`path.repo:/snapshot\_elk I remember creating the snapshot with Kib…

---

## [Polygon storage failed](https://discuss.elastic.co/t/polygon-storage-failed/316162)

<div class="topic-metadata">

**Author:** [@baiwenbo1997](https://discuss.elastic.co/u/baiwenbo1997)\
**Replies:** 12\
**Last updated:** [October 11, 2022, 8:42am UTC](https://discuss.elastic.co/t/polygon-storage-failed/316162 "2022-10-11T08:42:40Z")

</div>

POLYGON((38591455.29279993 3341853.182999084,38591450.89579993 3341845.826799084,38591447.82339992 3341841.763499084,38591444.25549993 3341839.186599084,38591438.30899993 3341835.420499084,38591431.17329992 3341830.66319…

---

## [CCS results sorting](https://discuss.elastic.co/t/ccs-results-sorting/316285)

<div class="topic-metadata">

**Author:** [@Ong](https://discuss.elastic.co/u/Ong)\
**Replies:** 0\
**Last updated:** [October 11, 2022, 8:29am UTC](https://discuss.elastic.co/t/ccs-results-sorting/316285 "2022-10-11T08:29:35Z")

</div>

I am setting up CCS with a remote cluster that contains 2 indexes using Kibana's data (kibana\_sample\_data\_ecommerce and kibana\_sample\_data\_flights). When performing a search across these 2 indexes, I noticed that the da…

---

## [Scripted metric not working inside transform](https://discuss.elastic.co/t/scripted-metric-not-working-inside-transform/316061)

<div class="topic-metadata">

**Author:** [@Hemabh\_Ravee\_Fox](https://discuss.elastic.co/u/Hemabh_Ravee_Fox)\
**Replies:** 2\
**Last updated:** [October 11, 2022, 8:06am UTC](https://discuss.elastic.co/t/scripted-metric-not-working-inside-transform/316061 "2022-10-11T08:06:52Z")

</div>

Hi, I have an index which contains events as documents and I'm trying to aggregate them by sessionId. I created the following transform and so far I have been able to generate the startTime, endTime, and sessionDuration,…

---

## [Cannot connect to Elasticsearch cluster using cloud\_id](https://discuss.elastic.co/t/cannot-connect-to-elasticsearch-cluster-using-cloud-id/316203)

<div class="topic-metadata">

**Author:** [@h.allaoui](https://discuss.elastic.co/u/h.allaoui)\
**Replies:** 8\
**Last updated:** [October 11, 2022, 7:57am UTC](https://discuss.elastic.co/t/cannot-connect-to-elasticsearch-cluster-using-cloud-id/316203 "2022-10-11T07:57:00Z")

</div>

Hi All, I have an issue, I cannot to connect to my Elasticsearch cluster from python client using its cloud\_id. I am getting following error: File "D:\\Data\\Hamid\\Workspace\\Python\\MyTools\\venv\\lib\\site-packages\\elast…

---

## [Trying to build index template from dynamicly generated template](https://discuss.elastic.co/t/trying-to-build-index-template-from-dynamicly-generated-template/315943)

<div class="topic-metadata">

**Author:** [@fribse](https://discuss.elastic.co/u/fribse)\
**Replies:** 2\
**Last updated:** [October 11, 2022, 7:52am UTC](https://discuss.elastic.co/t/trying-to-build-index-template-from-dynamicly-generated-template/315943 "2022-10-11T07:52:15Z")

</div>

I want to apply lifecycle policy on some of the indexes. So I think I need to create an index template, otherwise I will have to contiunally apply the policy to newly created indexes. I pulled an index template from a …

---

## [Aggregate + sort + paginate on nested documents](https://discuss.elastic.co/t/aggregate-sort-paginate-on-nested-documents/314715)

<div class="topic-metadata">

**Author:** [@t0mer](https://discuss.elastic.co/u/t0mer)\
**Replies:** 1\
**Last updated:** [October 11, 2022, 7:44am UTC](https://discuss.elastic.co/t/aggregate-sort-paginate-on-nested-documents/314715 "2022-10-11T07:44:19Z")

</div>

Hi, I'm managing a product index, with product sales and other KPIs under a nested field. Trying to sort based on nested aggregation, and paginate - with no success. Below is a simplified version of my mapping, for th…

---

## [Elasticsearch 7.17.4 crashes without an error message, while indexing large chunks of data on Windows](https://discuss.elastic.co/t/elasticsearch-7-17-4-crashes-without-an-error-message-while-indexing-large-chunks-of-data-on-windows/314690)

<div class="topic-metadata">

**Author:** [@simon137](https://discuss.elastic.co/u/simon137)\
**Replies:** 7\
**Last updated:** [October 11, 2022, 7:38am UTC](https://discuss.elastic.co/t/elasticsearch-7-17-4-crashes-without-an-error-message-while-indexing-large-chunks-of-data-on-windows/314690 "2022-10-11T07:38:34Z")

</div>

Hello, I tried multiple java heap configurations for both logstash and elasticsearch, and also using a persisted queue (with space up to 40gb) instead of a memory queue, but it's always the same: If I take a large chun…

---

## [Alert: Large shard size](https://discuss.elastic.co/t/alert-large-shard-size/316184)

<div class="topic-metadata">

**Author:** [@Michele\_De\_Benedet](https://discuss.elastic.co/u/Michele_De_Benedet)\
**Replies:** 3\
**Last updated:** [October 11, 2022, 6:18am UTC](https://discuss.elastic.co/t/alert-large-shard-size/316184 "2022-10-11T06:18:39Z")

</div>

Hi, I am using Logstash to feed an index. Current index size is 60GB and I'm expecting it to grow to at most 100GB, so I set it to use 6 shards. Elasticsearch is ran on a single node. The status of the index in Kibana …

---

## [Bootstrap check failure](https://discuss.elastic.co/t/bootstrap-check-failure/316025)

<div class="topic-metadata">

**Author:** [@rt\_888](https://discuss.elastic.co/u/rt_888)\
**Replies:** 4\
**Last updated:** [October 11, 2022, 3:46am UTC](https://discuss.elastic.co/t/bootstrap-check-failure/316025 "2022-10-11T03:46:54Z")

</div>

I tried using ES on AWS server of ubutu image, and modify the elasticsearch.yml file of node, discovery.seed\_hosts, master node . But got error with bootstrap node validation exception and it shows "at least one of \[dis…

---

## [How to search for username that logged in to install a specific app](https://discuss.elastic.co/t/how-to-search-for-username-that-logged-in-to-install-a-specific-app/316249)

<div class="topic-metadata">

**Author:** [@BabyElkUser](https://discuss.elastic.co/u/BabyElkUser)\
**Replies:** 1\
**Last updated:** [October 11, 2022, 12:20am UTC](https://discuss.elastic.co/t/how-to-search-for-username-that-logged-in-to-install-a-specific-app/316249 "2022-10-11T00:20:51Z")

</div>

Hi folks, I'm very new to Elk and am attempting to help our Information Security office with a few tasks. Per our Information Security Office, applications must be approved prior to being installed on a computer. Unfort…

---

## [Uptime in Cross-Cluster Search](https://discuss.elastic.co/t/uptime-in-cross-cluster-search/316256)

<div class="topic-metadata">

**Author:** [@Tim\_Mobley](https://discuss.elastic.co/u/Tim_Mobley)\
**Replies:** 1\
**Last updated:** [October 11, 2022, 12:02am UTC](https://discuss.elastic.co/t/uptime-in-cross-cluster-search/316256 "2022-10-11T00:02:46Z")

</div>

We recently set-up Heartbeat for two ES clusters (everything running version 8.3.2). However, data from these clusters are viewed from a Cross-Cluster Search (CCS) instance. When I view Uptime from the local cluster Kiba…

---

## [Best security pratice for elastich search?](https://discuss.elastic.co/t/best-security-pratice-for-elastich-search/316251)

<div class="topic-metadata">

**Author:** [@Nikolas1306](https://discuss.elastic.co/u/Nikolas1306)\
**Replies:** 1\
**Last updated:** [October 10, 2022, 11:47pm UTC](https://discuss.elastic.co/t/best-security-pratice-for-elastich-search/316251 "2022-10-10T23:47:16Z")

</div>

hello what is best security pratice for elk?

---

## [Elastic docker restart](https://discuss.elastic.co/t/elastic-docker-restart/314582)

<div class="topic-metadata">

**Author:** [@Isekai](https://discuss.elastic.co/u/Isekai)\
**Replies:** 3\
**Last updated:** [October 10, 2022, 10:29pm UTC](https://discuss.elastic.co/t/elastic-docker-restart/314582 "2022-10-10T22:29:14Z")

</div>

Hi everyone, We have an elastic instance that we feed data from CI jobs. It is single node instance. Maybe some data from the cluster: "cluster\_name" : "docker-cluster", "status" : "yellow", "timed\_out" : false…

---

## [Cross Cluster Replication between AWS Opensearch and Elastic Cloud it is possibile?](https://discuss.elastic.co/t/cross-cluster-replication-between-aws-opensearch-and-elastic-cloud-it-is-possibile/315947)

<div class="topic-metadata">

**Author:** [@yago82](https://discuss.elastic.co/u/yago82)\
**Replies:** 3\
**Last updated:** [October 10, 2022, 10:20pm UTC](https://discuss.elastic.co/t/cross-cluster-replication-between-aws-opensearch-and-elastic-cloud-it-is-possibile/315947 "2022-10-10T22:20:18Z")

</div>

Hi, as already mentioned in the title, is it possibile to use Cross Cluster Replication between AWS Opensearch and Elastic Cloud. My goal is to migrate from AWS OpenSearch to Elastic Cloud using CCR, and then dismiss t…

---

## [Question regarding backup](https://discuss.elastic.co/t/question-regarding-backup/316254)

<div class="topic-metadata">

**Author:** [@linkerc](https://discuss.elastic.co/u/linkerc)\
**Replies:** 1\
**Last updated:** [October 10, 2022, 9:27pm UTC](https://discuss.elastic.co/t/question-regarding-backup/316254 "2022-10-10T21:27:24Z")

</div>

Supposed I am running a backup everyday for my entire cluster. I understand that ES does incremental backup, so the first backup would be huge, but subsequent ones would be small. Let's say I have one month worth of ba…

---

## [Elasticsearch Upgrade 7.9.1 to 8.4](https://discuss.elastic.co/t/elasticsearch-upgrade-7-9-1-to-8-4/316229)

<div class="topic-metadata">

**Author:** [@jacknino](https://discuss.elastic.co/u/jacknino)\
**Replies:** 2\
**Last updated:** [October 10, 2022, 8:10pm UTC](https://discuss.elastic.co/t/elasticsearch-upgrade-7-9-1-to-8-4/316229 "2022-10-10T20:10:47Z")

</div>

Hi Channel, We are planning to upgrade Elasticsearch opensource 7.9.1 to 8.4. while upgrading we noticed multiple data disk path deprecation warning . Could anyone help us how we can proceed further. FYI, Elasticsearc…

---

## [Permissions for ES\_KEYSTORE\_PASSPHRASE\_FILE](https://discuss.elastic.co/t/permissions-for-es-keystore-passphrase-file/314219)

<div class="topic-metadata">

**Author:** [@tepus](https://discuss.elastic.co/u/tepus)\
**Replies:** 2\
**Last updated:** [October 10, 2022, 7:06pm UTC](https://discuss.elastic.co/t/permissions-for-es-keystore-passphrase-file/314219 "2022-10-10T19:06:26Z")

</div>

Dear Community, our Keystore is protected with a password. In order to provide the password to the cluster and start it, we created the file /etc/elasticsearch/my\_pwd\_file.tmp under root:elasticsearch containing the pas…

---

## [Painless script - counting equal values in a field](https://discuss.elastic.co/t/painless-script-counting-equal-values-in-a-field/316252)

<div class="topic-metadata">

**Author:** [@Aleksei](https://discuss.elastic.co/u/Aleksei)\
**Replies:** 0\
**Last updated:** [October 10, 2022, 6:06pm UTC](https://discuss.elastic.co/t/painless-script-counting-equal-values-in-a-field/316252 "2022-10-10T18:06:31Z")

</div>

Hi. I'm not good with pineless syntax. Please tell me by painless script. How to count the same values in a field ? For example, in the field 1 = 111 three times. How to count duplicates ?

---

## [Elastic password generate error](https://discuss.elastic.co/t/elastic-password-generate-error/316239)

<div class="topic-metadata">

**Author:** [@Nikolas1306](https://discuss.elastic.co/u/Nikolas1306)\
**Replies:** 2\
**Last updated:** [October 10, 2022, 5:49pm UTC](https://discuss.elastic.co/t/elastic-password-generate-error/316239 "2022-10-10T17:49:06Z")

</div>

sudo ./elasticsearch-setup-passwords auto warning: ignoring JAVA\_HOME=/usr/lib/jvm/java-11-openjdk-amd64; using bundled JDK 14:42:41.915 \[main\] WARN org.elasticsearch.common.ssl.DiagnosticTrustManager - failed to estab…

---

## [Choosing tracks that contain long-running tasks](https://discuss.elastic.co/t/choosing-tracks-that-contain-long-running-tasks/316193)

<div class="topic-metadata">

**Author:** [@Sunt-ing](https://discuss.elastic.co/u/Sunt-ing)\
**Replies:** 2\
**Last updated:** [October 10, 2022, 3:34pm UTC](https://discuss.elastic.co/t/choosing-tracks-that-contain-long-running-tasks/316193 "2022-10-10T15:34:44Z")

</div>

Hi all! I need to benchmark on a track that contains some long-running (such as larger than 10s) tasks. Benchmarking one track after another is definitely an approach and I'm working on that, but there are so many tracks…

---

## [Updating elastic search document by id is not working](https://discuss.elastic.co/t/updating-elastic-search-document-by-id-is-not-working/316240)

<div class="topic-metadata">

**Author:** [@Atul\_Joshi1](https://discuss.elastic.co/u/Atul_Joshi1)\
**Replies:** 1\
**Last updated:** [October 10, 2022, 3:26pm UTC](https://discuss.elastic.co/t/updating-elastic-search-document-by-id-is-not-working/316240 "2022-10-10T15:26:05Z")

</div>

I have document structure as below stored in Elasticsearch - { "\_index" : "testIndex", "\_type" : "\_doc", "\_id" : "6ZR6soMBLkXUqNwMnccZ", "\_score" : 3.4454321, "\_source" : { …

---

## [New Java client how to estimate size of BulkRequest](https://discuss.elastic.co/t/new-java-client-how-to-estimate-size-of-bulkrequest/316211)

<div class="topic-metadata">

**Author:** [@fabian-froehlich](https://discuss.elastic.co/u/fabian-froehlich)\
**Replies:** 0\
**Last updated:** [October 10, 2022, 11:32am UTC](https://discuss.elastic.co/t/new-java-client-how-to-estimate-size-of-bulkrequest/316211 "2022-10-10T11:32:00Z")

</div>

Is there a efferent way to estimate the size of the bulk request in the new ElasticsearchClient ? Currently our in the HighLevelRest-Client we use the method bulkRequest.estimatedSizeInBytes() to check whether another …

[Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=360)

[Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=362)
