# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=364 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 365 --- ## [Index routing allocation require does not work and throws confusing explain](https://discuss.elastic.co/t/index-routing-allocation-require-does-not-work-and-throws-confusing-explain/315873)
**Author:** [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Replies:** 0\ **Last updated:** [October 5, 2022, 12:18pm UTC](https://discuss.elastic.co/t/index-routing-allocation-require-does-not-work-and-throws-confusing-explain/315873 "2022-10-05T12:18:24Z")
Hello, I have a cluster on version 7.17 where I'm using a node attribute called node\_type with the values hot and warm to allocate shards and move between node type with ILM, all indices have an index.routing.allocatio… --- ## [Best way to form a cluster](https://discuss.elastic.co/t/best-way-to-form-a-cluster/315680)
**Author:** [@FredericB](https://discuss.elastic.co/u/FredericB)\ **Replies:** 5\ **Last updated:** [October 5, 2022, 11:19am UTC](https://discuss.elastic.co/t/best-way-to-form-a-cluster/315680 "2022-10-05T11:19:30Z")
Hi there, i'm new to ELK and also read lot of documentations from elastic.co I've tested many combinations to form a cluster and wondering can't find the best way to form it: 1-Creating the 1st Node (that is also a clu… --- ## [Sort data based on a field value](https://discuss.elastic.co/t/sort-data-based-on-a-field-value/315857)
**Author:** [@HadiKhai](https://discuss.elastic.co/u/HadiKhai)\ **Replies:** 0\ **Last updated:** [October 5, 2022, 10:14am UTC](https://discuss.elastic.co/t/sort-data-based-on-a-field-value/315857 "2022-10-05T10:14:59Z")
Hello, I am saving priority inside the data and I am looking for a way to boost the score based on the priority. "userA":{ "specialities": \[ { "speciality\_priority": 3, "sp… --- ## [Unable to search for flattened (nested) field existence](https://discuss.elastic.co/t/unable-to-search-for-flattened-nested-field-existence/315863)
**Author:** [@ruslaniv](https://discuss.elastic.co/u/ruslaniv)\ **Replies:** 0\ **Last updated:** [October 5, 2022, 10:47am UTC](https://discuss.elastic.co/t/unable-to-search-for-flattened-nested-field-existence/315863 "2022-10-05T10:47:51Z")
I'm storing an arbitrary nested object as a flattened field "\_meta" which contains various information related to a product. Here is the mapping for that field: "mappings": { "dynamic": "strict", "prope… --- ## [How to get doc\_count in terms aggregation?](https://discuss.elastic.co/t/how-to-get-doc-count-in-terms-aggregation/315855)
**Author:** [@Be-poz](https://discuss.elastic.co/u/Be-poz)\ **Replies:** 0\ **Last updated:** [October 5, 2022, 10:10am UTC](https://discuss.elastic.co/t/how-to-get-doc-count-in-terms-aggregation/315855 "2022-10-05T10:10:37Z")
Hi i'd like to get doc\_count when i did terms aggregation. here is example i used. PUT sample { "mappings": { "properties": { "updateType": {"type": "keyword"}, "date": {"type": "date", "format": "epoc… --- ## [Date\_histogram breakdown](https://discuss.elastic.co/t/date-histogram-breakdown/315846)
**Author:** [@aa09](https://discuss.elastic.co/u/aa09)\ **Replies:** 2\ **Last updated:** [October 5, 2022, 10:04am UTC](https://discuss.elastic.co/t/date-histogram-breakdown/315846 "2022-10-05T10:04:12Z")
I want to be able to break down my data by year and then further by month, im pretty sure this is possible but cant see exactly how. I am using the following at the moment to get a yearly breakdown: 'by\_year'… --- ## [Elasticsearch v8 Java API client search with filter (not postFilter)](https://discuss.elastic.co/t/elasticsearch-v8-java-api-client-search-with-filter-not-postfilter/315823)
**Author:** [@ijaxahmed](https://discuss.elastic.co/u/ijaxahmed)\ **Replies:** 2\ **Last updated:** [October 5, 2022, 10:02am UTC](https://discuss.elastic.co/t/elasticsearch-v8-java-api-client-search-with-filter-not-postfilter/315823 "2022-10-05T10:02:25Z")
I wanted to replace postFilter with filter in the search, but not sure how to because Query has "query.postFilter(postFilters) " method but nothing as ".filter(filters) " . Current implementations is like , Creating Que… --- ## [Enrichment Policy does not match the values of an array/object](https://discuss.elastic.co/t/enrichment-policy-does-not-match-the-values-of-an-array-object/315562)
**Author:** [@hanna](https://discuss.elastic.co/u/hanna)\ **Replies:** 4\ **Last updated:** [October 5, 2022, 8:59am UTC](https://discuss.elastic.co/t/enrichment-policy-does-not-match-the-values-of-an-array-object/315562 "2022-10-05T08:59:36Z")
Hi, i have the following enrichmentpolicy that i cant get to work. The targetfield cveintel from the enrichmentpolicy is never created. Any help is appreciated. \> PUT \_enrich/policy/cve\_enrichment\_policy \> { \> "matc… --- ## [Cannot read configured \[PKCS12\] keystore (as a truststore)](https://discuss.elastic.co/t/cannot-read-configured-pkcs12-keystore-as-a-truststore/315849)
**Author:** [@diegz](https://discuss.elastic.co/u/diegz)\ **Replies:** 0\ **Last updated:** [October 5, 2022, 8:33am UTC](https://discuss.elastic.co/t/cannot-read-configured-pkcs12-keystore-as-a-truststore/315849 "2022-10-05T08:33:05Z")
Hello, I configure TLS on all 5 nodes of my cluster. I followed this documentation: https://www.elastic.co/guide/en/elasticsearch/reference/8.0/security-basic-setup.html#encrypt-internode-communication I generated a C… --- ## [FSCrawler && SSL && SANs](https://discuss.elastic.co/t/fscrawler-ssl-sans/314263)
**Author:** [@cheshirecat](https://discuss.elastic.co/u/cheshirecat)\ **Replies:** 28\ **Last updated:** [October 5, 2022, 8:27am UTC](https://discuss.elastic.co/t/fscrawler-ssl-sans/314263 "2022-10-05T08:27:52Z")
Hello There! I am trying to set up a FSCrawler. This is my \_settings.yaml file: --- name: "test-job" fs: url: "/tmp/es" update\_rate: "15m" excludes: - "\*/~\*" json\_support: false filename\_as\_id: false add… --- ## [FSCrawler and frozen indicies](https://discuss.elastic.co/t/fscrawler-and-frozen-indicies/314997)
**Author:** [@cheshirecat](https://discuss.elastic.co/u/cheshirecat)\ **Replies:** 13\ **Last updated:** [October 5, 2022, 8:27am UTC](https://discuss.elastic.co/t/fscrawler-and-frozen-indicies/314997 "2022-10-05T08:27:21Z")
Hello There! I have downloaded ans successfully started FSCrawler for my Elasticsearch cluster. This is how I start an instance: 08:11:23,753 INFO \[f.p.e.c.f.c.BootstrapChecks\] Memory \[Free/Total=Percent\]: HEAP \[83.3… --- ## [Automatically increase number of shards](https://discuss.elastic.co/t/automatically-increase-number-of-shards/315749)
**Author:** [@MaVa](https://discuss.elastic.co/u/MaVa)\ **Replies:** 5\ **Last updated:** [October 5, 2022, 6:43am UTC](https://discuss.elastic.co/t/automatically-increase-number-of-shards/315749 "2022-10-05T06:43:07Z")
Hi! I have few indices where all the data is equally relevant no matter how old it is. Over time these indices will increase in size (from 5-10MB to 1000GB). I want to optimize the number of shards in these indices, and … --- ## [Snapshot failed for a shard](https://discuss.elastic.co/t/snapshot-failed-for-a-shard/315794)
**Author:** [@DineshNaik](https://discuss.elastic.co/u/DineshNaik)\ **Replies:** 2\ **Last updated:** [October 5, 2022, 6:32am UTC](https://discuss.elastic.co/t/snapshot-failed-for-a-shard/315794 "2022-10-05T06:32:23Z")
Hi all, I am trying to take a one time backup and was planning to restore it to other cluster. During snapshot , i see one failed shard , is there a way to handle this ? { "snapshots" : \[ { "snapshot" : "s… --- ## [Role Mapping via App Role in Azure SSO](https://discuss.elastic.co/t/role-mapping-via-app-role-in-azure-sso/315831)
**Author:** [@Zesty\_Lemon](https://discuss.elastic.co/u/Zesty_Lemon)\ **Replies:** 3\ **Last updated:** [October 5, 2022, 5:35am UTC](https://discuss.elastic.co/t/role-mapping-via-app-role-in-azure-sso/315831 "2022-10-05T05:35:57Z")
Hi, New to Elastic here; seeking information on how to use a App Role on the Enterprise Application for Elastic SSO to assign a user to a particular role mapping; We are using instructions; I can see in the SAML resp… --- ## [Adding a node to cluster](https://discuss.elastic.co/t/adding-a-node-to-cluster/315239)
**Author:** [@rahulgupta18](https://discuss.elastic.co/u/rahulgupta18)\ **Replies:** 1\ **Last updated:** [October 5, 2022, 5:24am UTC](https://discuss.elastic.co/t/adding-a-node-to-cluster/315239 "2022-10-05T05:24:15Z")
Hi , I am looking to add one more node to our existing 2-node ELK cluster running in production. We're running version 8.1. I was looking at the elasticsearch documents, for 8.1, it says just to add the cluster name a… --- ## [Restoring snapshots of observability indexes](https://discuss.elastic.co/t/restoring-snapshots-of-observability-indexes/315813)
**Author:** [@matt.snyder](https://discuss.elastic.co/u/matt.snyder)\ **Replies:** 1\ **Last updated:** [October 5, 2022, 3:46am UTC](https://discuss.elastic.co/t/restoring-snapshots-of-observability-indexes/315813 "2022-10-05T03:46:06Z")
I have a snapshot profile created with defaults, which, for observability indexes, results in one snapshot per index, so I have about 100 snapshots from the same minute, each containing one index. If I want to use these… --- ## [Hot Nodes + Shards/Node assignment + Routing](https://discuss.elastic.co/t/hot-nodes-shards-node-assignment-routing/315721)
**Author:** [@jc\_es](https://discuss.elastic.co/u/jc_es)\ **Replies:** 6\ **Last updated:** [October 4, 2022, 10:39pm UTC](https://discuss.elastic.co/t/hot-nodes-shards-node-assignment-routing/315721 "2022-10-04T22:39:15Z")
I have a log ingestion use-case and I'm dealing with high JVM heap on 3 out of 24 data nodes in a cluster. Indices are Monthly, with new indices created through the month as indices hit a size threshold, e.g. logs-YYYY-… --- ## [Skipped records with Search/SearchAfter query](https://discuss.elastic.co/t/skipped-records-with-search-searchafter-query/314205)
**Author:** [@kuhu.88](https://discuss.elastic.co/u/kuhu.88)\ **Replies:** 1\ **Last updated:** [October 4, 2022, 9:54pm UTC](https://discuss.elastic.co/t/skipped-records-with-search-searchafter-query/314205 "2022-10-04T21:54:41Z")
Hello folks, Using a non-unique key for sort (in this example - timestamp) can skip over records in a subsequent request when the 10,000 is reached on a previous run and timestamps carry on beyond that cutoff. Take the… --- ## [Plugins on multi-node cluster](https://discuss.elastic.co/t/plugins-on-multi-node-cluster/315821)
**Author:** [@danskiyq](https://discuss.elastic.co/u/danskiyq)\ **Replies:** 1\ **Last updated:** [October 4, 2022, 8:38pm UTC](https://discuss.elastic.co/t/plugins-on-multi-node-cluster/315821 "2022-10-04T20:38:39Z")
If I want to upgrade or push custom plugins on multi node cluster, eg. 1 master, 3 data/inject nodes. Do I have to do it on one of the nodes using bin/opensearch-plugins and it will synchronise automatically or I have to… --- ## [Elastic Search Update Operation not working when using nodejs client](https://discuss.elastic.co/t/elastic-search-update-operation-not-working-when-using-nodejs-client/315811)
**Author:** [@Atul\_Joshi1](https://discuss.elastic.co/u/Atul_Joshi1)\ **Replies:** 2\ **Last updated:** [October 4, 2022, 7:17pm UTC](https://discuss.elastic.co/t/elastic-search-update-operation-not-working-when-using-nodejs-client/315811 "2022-10-04T19:17:33Z")
I am updating the existing document in Elasticsearch by below update query. const result = await client.update({ index, id, body: { script: { lang: "painless", … --- ## [Rollover "Transform" indices](https://discuss.elastic.co/t/rollover-transform-indices/315799)
**Author:** [@Otto\_F](https://discuss.elastic.co/u/Otto_F)\ **Replies:** 1\ **Last updated:** [October 4, 2022, 4:29pm UTC](https://discuss.elastic.co/t/rollover-transform-indices/315799 "2022-10-04T16:29:56Z")
Hi all, Is any way to rollover for "Transform" indices? If I use ILM policy, I'm getting error: "illegal\_argument\_exception: index.lifecycle.rollover\_alias \[test-summary\] does not point to index \[test-summary\]". Templa… --- ## [NoClassDef org.apache.lucene.util.Version](https://discuss.elastic.co/t/noclassdef-org-apache-lucene-util-version/315787)
**Author:** [@aaron-mcgrath](https://discuss.elastic.co/u/aaron-mcgrath)\ **Replies:** 6\ **Last updated:** [October 4, 2022, 3:22pm UTC](https://discuss.elastic.co/t/noclassdef-org-apache-lucene-util-version/315787 "2022-10-04T15:22:28Z")
I'm using the java client 7.17.6, with gradle to build the project; implementation ("co.elastic.clients:elasticsearch-java:$elasticVersion") implementation ("org.elasticsearch:elasticsearch-x-content:$elasticVersion") G… --- ## [Log4j2.properties doubt](https://discuss.elastic.co/t/log4j2-properties-doubt/315796)
**Author:** [@S-elk](https://discuss.elastic.co/u/S-elk)\ **Replies:** 1\ **Last updated:** [October 4, 2022, 3:11pm UTC](https://discuss.elastic.co/t/log4j2-properties-doubt/315796 "2022-10-04T15:11:54Z")
Hello! does elasticsearch keep any change in log4j2.properties until a restart ? im changing Logging to delete the logs by time not by size: appender.rolling.strategy.action.condition.nested\_condition.type = IfLastMod… --- ## [Shipping Logs out of Elasticsearch](https://discuss.elastic.co/t/shipping-logs-out-of-elasticsearch/315786)
**Author:** [@secopsgeek](https://discuss.elastic.co/u/secopsgeek)\ **Replies:** 4\ **Last updated:** [October 4, 2022, 3:09pm UTC](https://discuss.elastic.co/t/shipping-logs-out-of-elasticsearch/315786 "2022-10-04T15:09:06Z")
Morning, I am trying to figure out a way to ship my elasticseach logs from one location to another syslog system. Is there a way for me to configure Elastic to handle shipping out a certain Index of log to another syslo… --- ## [Handling unmapped fields with Suggest feature](https://discuss.elastic.co/t/handling-unmapped-fields-with-suggest-feature/314937)
**Author:** [@schawla](https://discuss.elastic.co/u/schawla)\ **Replies:** 3\ **Last updated:** [October 4, 2022, 2:36pm UTC](https://discuss.elastic.co/t/handling-unmapped-fields-with-suggest-feature/314937 "2022-10-04T14:36:45Z")
I am trying to implement suggest feature - Suggest Usage | Elasticsearch .NET Client \[8.4\] | Elastic for handling misspelled words in my search implementation. My search query is executed across multiple indices but whi… --- ## [Sql query with like in "elasticSearch Sql" bugs?](https://discuss.elastic.co/t/sql-query-with-like-in-elasticsearch-sql-bugs/315621)
**Author:** [@Nikolas1306](https://discuss.elastic.co/u/Nikolas1306)\ **Replies:** 17\ **Last updated:** [October 4, 2022, 2:22pm UTC](https://discuss.elastic.co/t/sql-query-with-like-in-elasticsearch-sql-bugs/315621 "2022-10-04T14:22:41Z")
i' ve simple query but not have resulset with SELECT \* FROM "errors\_prima\*" where message like '%fiscal%' (sorry is closed on test not is the problem) but if use SELECT \* FROM "errors\_prima\*" where message like '%… --- ## [Body size limitation for webhook in watcher](https://discuss.elastic.co/t/body-size-limitation-for-webhook-in-watcher/315779)
**Author:** [@JohnJ\_M](https://discuss.elastic.co/u/JohnJ_M)\ **Replies:** 0\ **Last updated:** [October 4, 2022, 1:45pm UTC](https://discuss.elastic.co/t/body-size-limitation-for-webhook-in-watcher/315779 "2022-10-04T13:45:09Z")
I have seen a similar request in the forum but without answers so I try my luck: Where can we found the size limitation of the body in the Webhook action of a watcher. I noticed that it seems 1900 char or so on our inst… --- ## [Using scroll for very large indices](https://discuss.elastic.co/t/using-scroll-for-very-large-indices/315776)
**Author:** [@SFarhanizade](https://discuss.elastic.co/u/SFarhanizade)\ **Replies:** 0\ **Last updated:** [October 4, 2022, 1:20pm UTC](https://discuss.elastic.co/t/using-scroll-for-very-large-indices/315776 "2022-10-04T13:20:25Z")
Hi. There is an index having arround 200 million documents. I want to scroll over all its documents, so I prefered to use sliced scroll to do so, but every time I use scroll for this index, after some minutes of getting … --- ## [How to get a single count only per document when using nested term aggregation?](https://discuss.elastic.co/t/how-to-get-a-single-count-only-per-document-when-using-nested-term-aggregation/315774)
**Author:** [@binoiii](https://discuss.elastic.co/u/binoiii)\ **Replies:** 0\ **Last updated:** [October 4, 2022, 12:59pm UTC](https://discuss.elastic.co/t/how-to-get-a-single-count-only-per-document-when-using-nested-term-aggregation/315774 "2022-10-04T12:59:17Z")
Mapping "work\_rights": { "type": "nested", "properties": { "country\_tid": { "type": "keyword" }, "work\_right\_type": { "properties": { "tid": { "type": "keyword" } … --- ## [Amazon\_s3\_exception when trying to create repo, even though it still creates test folder](https://discuss.elastic.co/t/amazon-s3-exception-when-trying-to-create-repo-even-though-it-still-creates-test-folder/315728)
**Author:** [@javadevmtl](https://discuss.elastic.co/u/javadevmtl)\ **Replies:** 2\ **Last updated:** [October 4, 2022, 12:23pm UTC](https://discuss.elastic.co/t/amazon-s3-exception-when-trying-to-create-repo-even-though-it-still-creates-test-folder/315728 "2022-10-04T12:23:42Z")
Hi getting the below error, but the funny thing is there's a test folder created in the bucker. For example: tests--v15dKjeS5uBICtqKNVEdg/ and the master.dat file is inside. { "type": "s3", "settings": { "bucket… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=363) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=365)