# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=365 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 366 --- ## [Elasticsearch cluster \[6.8\] becomes unresponsive for a small duration when one of the nodes in the cluster does not respond to any requests & is not part of the cluster. Is this the expected behaviour?](https://discuss.elastic.co/t/elasticsearch-cluster-6-8-becomes-unresponsive-for-a-small-duration-when-one-of-the-nodes-in-the-cluster-does-not-respond-to-any-requests-is-not-part-of-the-cluster-is-this-the-expected-behaviour/315421)
**Author:** [@srivatsa](https://discuss.elastic.co/u/srivatsa)\ **Replies:** 4\ **Last updated:** [October 4, 2022, 11:54am UTC](https://discuss.elastic.co/t/elasticsearch-cluster-6-8-becomes-unresponsive-for-a-small-duration-when-one-of-the-nodes-in-the-cluster-does-not-respond-to-any-requests-is-not-part-of-the-cluster-is-this-the-expected-behaviour/315421 "2022-10-04T11:54:19Z")
Hi Folks, The observation in our ES cluster (6.8 version) consisting of 40 nodes is that when any one of the nodes becomes unresponsive, especially in scenarios where the thread pools on the machine are full & rejection… --- ## [Help on getting query to count avg, min and max nestings](https://discuss.elastic.co/t/help-on-getting-query-to-count-avg-min-and-max-nestings/315768)
**Author:** [@sreekanth](https://discuss.elastic.co/u/sreekanth)\ **Replies:** 0\ **Last updated:** [October 4, 2022, 11:10am UTC](https://discuss.elastic.co/t/help-on-getting-query-to-count-avg-min-and-max-nestings/315768 "2022-10-04T11:10:04Z")
I have an index with one nested field. Some docs have 10 nested docs and a few may have thousands of nested docs. I want to find the average/min and max count of nested items count across the index. Sample data: in thi… --- ## [Sort performance since elastic 7.16](https://discuss.elastic.co/t/sort-performance-since-elastic-7-16/315740)
**Author:** [@vjgorla](https://discuss.elastic.co/u/vjgorla)\ **Replies:** 0\ **Last updated:** [October 4, 2022, 6:51am UTC](https://discuss.elastic.co/t/sort-performance-since-elastic-7-16/315740 "2022-10-04T06:51:43Z")
A query that sorts by a keyword field that we have been using on elastic 7.13.2 now performs quite badly on 8.4.1. There is no change to the query or mappings. Only change is the elastic version. This query is crucial i… --- ## [Data management](https://discuss.elastic.co/t/data-management/315371)
**Author:** [@Juanfer](https://discuss.elastic.co/u/Juanfer)\ **Replies:** 2\ **Last updated:** [October 4, 2022, 8:27am UTC](https://discuss.elastic.co/t/data-management/315371 "2022-10-04T08:27:12Z")
Hi there, I have a question regarding the organization in Kibana. Since I am a beginner I want to understand the scope and best practices for my data storage in there. I will have 3 datasets which at some point I will li… --- ## [Elasticsearch Group By](https://discuss.elastic.co/t/elasticsearch-group-by/315360)
**Author:** [@Ashish\_Grover](https://discuss.elastic.co/u/Ashish_Grover)\ **Replies:** 4\ **Last updated:** [October 4, 2022, 7:48am UTC](https://discuss.elastic.co/t/elasticsearch-group-by/315360 "2022-10-04T07:48:19Z")
Hi i want to convert this sql query to elasticsearch " Select field1,field2,field3,field4 From myTable Group By field1; " I want group by on field1 and on the basis of this i want field2, field3, and field4 --- ## [Date diff elasticsearch wrong?](https://discuss.elastic.co/t/date-diff-elasticsearch-wrong/315745)
**Author:** [@robocon20x](https://discuss.elastic.co/u/robocon20x)\ **Replies:** 0\ **Last updated:** [October 4, 2022, 7:18am UTC](https://discuss.elastic.co/t/date-diff-elasticsearch-wrong/315745 "2022-10-04T07:18:36Z")
Hi everyone, i found a different between datediff function on my ES and phoenix,trino. when use SQL below my ES return 4 while phoenix and trino return 5. How this different could happened? POST \_sql?format=json { … --- ## [Method with @async annotation, not getting logged in APM for errors for spring application](https://discuss.elastic.co/t/method-with-async-annotation-not-getting-logged-in-apm-for-errors-for-spring-application/315741)
**Author:** [@Jawed-Aquib](https://discuss.elastic.co/u/Jawed-Aquib)\ **Replies:** 1\ **Last updated:** [October 4, 2022, 7:00am UTC](https://discuss.elastic.co/t/method-with-async-annotation-not-getting-logged-in-apm-for-errors-for-spring-application/315741 "2022-10-04T07:00:52Z")
I have configured the java APM agent through the elastic.apm.service\_name config for my springboot application. When there is any error occurring for my method annotated with @Async the error form this isn't availble… --- ## [Field level security based on the value of another field in the document](https://discuss.elastic.co/t/field-level-security-based-on-the-value-of-another-field-in-the-document/315356)
**Author:** [@Ram\_Rana](https://discuss.elastic.co/u/Ram_Rana)\ **Replies:** 4\ **Last updated:** [October 4, 2022, 5:58am UTC](https://discuss.elastic.co/t/field-level-security-based-on-the-value-of-another-field-in-the-document/315356 "2022-10-04T05:58:46Z")
We have one use case where we need to put some field level security based on another field in the document. We have some documents, each document contain one field called type and based on that type we want to put restr… --- ## [How does the GET API function internally in real time?](https://discuss.elastic.co/t/how-does-the-get-api-function-internally-in-real-time/315734)
**Author:** [@bhavya](https://discuss.elastic.co/u/bhavya)\ **Replies:** 0\ **Last updated:** [October 4, 2022, 5:54am UTC](https://discuss.elastic.co/t/how-does-the-get-api-function-internally-in-real-time/315734 "2022-10-04T05:54:46Z")
Under the hood of the most recent operation, Elasticsearch records the value of the \_version meta field, primary term, and sequence number. We may use the GET API to obtain these meta field values and add them to the sea… --- ## [Elasticsearch do not shows passwords and token when start](https://discuss.elastic.co/t/elasticsearch-do-not-shows-passwords-and-token-when-start/315338)
**Author:** [@Kostyantyn\_Dobriohlo](https://discuss.elastic.co/u/Kostyantyn_Dobriohlo)\ **Replies:** 1\ **Last updated:** [October 4, 2022, 5:41am UTC](https://discuss.elastic.co/t/elasticsearch-do-not-shows-passwords-and-token-when-start/315338 "2022-10-04T05:41:14Z")
I am starting ELK with enabled xpack.security, and as I know elasticsearch shoud display passwords, enrollment token for kibana and other nodes and sha fingerprint. But there is no such information in logs. I am sure of … --- ## [Writing to two data streams](https://discuss.elastic.co/t/writing-to-two-data-streams/315493)
**Author:** [@Ulrik](https://discuss.elastic.co/u/Ulrik)\ **Replies:** 1\ **Last updated:** [October 4, 2022, 5:19am UTC](https://discuss.elastic.co/t/writing-to-two-data-streams/315493 "2022-10-04T05:19:02Z")
We are collecting logs and uses fleet with agents. I would like to configure some agents to write data in two data streams instead of just one. As far as I can understand you specify the data stream to use in the integ… --- ## [503 Service Unavailable in Docker kibana (ELK Stack)](https://discuss.elastic.co/t/503-service-unavailable-in-docker-kibana-elk-stack/315268)
**Author:** [@MdRashid](https://discuss.elastic.co/u/MdRashid)\ **Replies:** 1\ **Last updated:** [October 4, 2022, 5:17am UTC](https://discuss.elastic.co/t/503-service-unavailable-in-docker-kibana-elk-stack/315268 "2022-10-04T05:17:26Z")
Hi, Need help not able to access kibana in browser All container is running kibana, elasticsearch and logstash as ELK Stack docker logs KIBANA-CONTAINER {"type":"log","@timestamp":"2022-09-27T13:52:24Z","tags":\["info… --- ## [Watcher webhook issue with call include triple double quote](https://discuss.elastic.co/t/watcher-webhook-issue-with-call-include-triple-double-quote/315387)
**Author:** [@JohnJ\_M](https://discuss.elastic.co/u/JohnJ_M)\ **Replies:** 0\ **Last updated:** [September 28, 2022, 3:43pm UTC](https://discuss.elastic.co/t/watcher-webhook-issue-with-call-include-triple-double-quote/315387 "2022-09-28T15:43:03Z")
I am working on a watcher that create watcher depending an index. I use for that a weebhook call in the watcher. Problem: the webhook call need the use of """ for the body part: "webhook": { "scheme": "h… --- ## [Problem with integration fleet server](https://discuss.elastic.co/t/problem-with-integration-fleet-server/315433)
**Author:** [@sultan2224](https://discuss.elastic.co/u/sultan2224)\ **Replies:** 1\ **Last updated:** [October 4, 2022, 5:13am UTC](https://discuss.elastic.co/t/problem-with-integration-fleet-server/315433 "2022-10-04T05:13:22Z")
problem with integration fleet server and I can't take logs --- ## [Update All by changing data of a field using a function](https://discuss.elastic.co/t/update-all-by-changing-data-of-a-field-using-a-function/315476)
**Author:** [@sadiki-dev](https://discuss.elastic.co/u/sadiki-dev)\ **Replies:** 0\ **Last updated:** [September 29, 2022, 4:05pm UTC](https://discuss.elastic.co/t/update-all-by-changing-data-of-a-field-using-a-function/315476 "2022-09-29T16:05:49Z")
I have some data in an index for example called products. the data stored has structure like this : \[ { "name" : " product A ", "price": 1000, "quantity": 10 }, { "name" : " product B ", "price": 2000, "qua… --- ## [Use Elastic APM without search.allow\_expensive\_queries config](https://discuss.elastic.co/t/use-elastic-apm-without-search-allow-expensive-queries-config/315499)
**Author:** [@Leonardo\_Henrique](https://discuss.elastic.co/u/Leonardo_Henrique)\ **Replies:** 0\ **Last updated:** [September 29, 2022, 7:58pm UTC](https://discuss.elastic.co/t/use-elastic-apm-without-search-allow-expensive-queries-config/315499 "2022-09-29T19:58:46Z")
Hello, everyone! How have you been? I recently updated a Elastic cluster from 7.9.3 to 8.3.2 (intermediate upgrade to 7.17.5). When I updated the APM Server to 8.3.2 I got the error referred to the APM Integration not … --- ## [How to restore security snapshots?](https://discuss.elastic.co/t/how-to-restore-security-snapshots/315636)
**Author:** [@Siavash\_Fazli](https://discuss.elastic.co/u/Siavash_Fazli)\ **Replies:** 0\ **Last updated:** [October 2, 2022, 2:52pm UTC](https://discuss.elastic.co/t/how-to-restore-security-snapshots/315636 "2022-10-02T14:52:52Z")
Hi Guys. I upgraded my ELK stack version 7.16.2 to 8.4.2. I need to restore my security settings (users, roles,...) In the last step of restoring I got this message: Unable to restore snapshot \[es.sec\_daily\_2022.09.… --- ## [Monthly rolling index with custom routing](https://discuss.elastic.co/t/monthly-rolling-index-with-custom-routing/315706)
**Author:** [@PV2000](https://discuss.elastic.co/u/PV2000)\ **Replies:** 1\ **Last updated:** [October 4, 2022, 5:02am UTC](https://discuss.elastic.co/t/monthly-rolling-index-with-custom-routing/315706 "2022-10-04T05:02:55Z")
Hi, I am trying to figure out the how to create a monthly rolling index with custom routing (multi-tenancy scenario) , with these requirements : WRITE flow : Each document will have a timestamp and the document shoul… --- ## [Got error in elastic search](https://discuss.elastic.co/t/got-error-in-elastic-search/315718)
**Author:** [@Rahul1300](https://discuss.elastic.co/u/Rahul1300)\ **Replies:** 1\ **Last updated:** [October 4, 2022, 5:01am UTC](https://discuss.elastic.co/t/got-error-in-elastic-search/315718 "2022-10-04T05:01:09Z")
i started new cluster i got this error plz help me to resolve this address \[127.0.0.1:9302\], node \[null\], requesting \[false\] discovery result: \[127.0.0.1:9302\] connect\_exception: Connection refused: /127.0.0.1:9302: Con… --- ## [Renaming Nodes and Clusters in Elastic Cloud](https://discuss.elastic.co/t/renaming-nodes-and-clusters-in-elastic-cloud/315729)
**Author:** [@mpky](https://discuss.elastic.co/u/mpky)\ **Replies:** 4\ **Last updated:** [October 4, 2022, 4:59am UTC](https://discuss.elastic.co/t/renaming-nodes-and-clusters-in-elastic-cloud/315729 "2022-10-04T04:59:05Z")
How do you go about renaming nodes and clusters in Elastic Cloud since there is no YML file to edit? I tried in the deployment settings but was getting errors and am wondering if there's a way to do this in Dev Tools? --- ## [Primary term and sequence number VS \_version meta field](https://discuss.elastic.co/t/primary-term-and-sequence-number-vs-version-meta-field/315733)
**Author:** [@bhavya](https://discuss.elastic.co/u/bhavya)\ **Replies:** 1\ **Last updated:** [October 4, 2022, 4:58am UTC](https://discuss.elastic.co/t/primary-term-and-sequence-number-vs-version-meta-field/315733 "2022-10-04T04:58:50Z")
Consider that there are three primary shards in my index. For indexing and update requests, the primary shards are used. Elasticsearch can distribute incoming requests (such as massive bulk requests) to various primary s… --- ## [Nested Aggregation with AND always return 0 match](https://discuss.elastic.co/t/nested-aggregation-with-and-always-return-0-match/315722)
**Author:** [@chattes](https://discuss.elastic.co/u/chattes)\ **Replies:** 3\ **Last updated:** [October 4, 2022, 1:26am UTC](https://discuss.elastic.co/t/nested-aggregation-with-and-always-return-0-match/315722 "2022-10-04T01:26:03Z")
Mapping { "example-profiles" : { "mappings" : { "dynamic" : "false", "properties" : { "organization" : { "properties" : { "enabled" : { "type" : "boolean" … --- ## [Java client put logstash pipeline last\_modified error](https://discuss.elastic.co/t/java-client-put-logstash-pipeline-last-modified-error/313425)
**Author:** [@Alain\_Bod](https://discuss.elastic.co/u/Alain_Bod)\ **Replies:** 5\ **Last updated:** [October 3, 2022, 8:39pm UTC](https://discuss.elastic.co/t/java-client-put-logstash-pipeline-last-modified-error/313425 "2022-10-03T20:39:33Z")
Hi, I'm using the new Java elasticsearch client to PUT a logstash pipeline (client version 8.4.1, server 8.4.1) client.logstash().putPipeline(b -\> b .id(id) .pipeline(p -\>… --- ## [Unable to use msearch with curl](https://discuss.elastic.co/t/unable-to-use-msearch-with-curl/315713)
**Author:** [@Guilherme\_Mello](https://discuss.elastic.co/u/Guilherme_Mello)\ **Replies:** 4\ **Last updated:** [October 3, 2022, 8:25pm UTC](https://discuss.elastic.co/t/unable-to-use-msearch-with-curl/315713 "2022-10-03T20:25:59Z")
I'm trying to use \_msearch like this: curl -XGET "https://host.com/index/\_msearch" -H "Content-Type: application/json" -d' { } {"query" : {"match" : { "title": "vestido"}}, "from":0,"size":2 } ' But I get t… --- ## [Getting two intervals in the result for fixed\_interval](https://discuss.elastic.co/t/getting-two-intervals-in-the-result-for-fixed-interval/314754)
**Author:** [@Divin](https://discuss.elastic.co/u/Divin)\ **Replies:** 7\ **Last updated:** [October 3, 2022, 6:05pm UTC](https://discuss.elastic.co/t/getting-two-intervals-in-the-result-for-fixed-interval/314754 "2022-10-03T18:05:22Z")
I have an ES query that search for 2 set of strings and calculating percentage based on the results of the match. This is expected to have work on fixed\_interval \[5 min\]on date histogram. But when I am getting the result… --- ## [Upgrade from ELK 7.7.1 to ELK 8.4.1](https://discuss.elastic.co/t/upgrade-from-elk-7-7-1-to-elk-8-4-1/315423)
**Author:** [@Ravi\_S1](https://discuss.elastic.co/u/Ravi_S1)\ **Replies:** 3\ **Last updated:** [October 3, 2022, 5:46pm UTC](https://discuss.elastic.co/t/upgrade-from-elk-7-7-1-to-elk-8-4-1/315423 "2022-10-03T17:46:24Z")
I upgraded recently ELK 7.7.1 to ELK 8.4.1. I am looking out the logs of ELK 8.4.1, finds the below logs. Is there any view point from these logs. {"@timestamp":"2022-09-15T16:17:36.167Z", "log.level": "WARN", "message… --- ## [Update By Query - status counts do not add up to total](https://discuss.elastic.co/t/update-by-query-status-counts-do-not-add-up-to-total/315709)
**Author:** [@BobH](https://discuss.elastic.co/u/BobH)\ **Replies:** 0\ **Last updated:** [October 3, 2022, 5:15pm UTC](https://discuss.elastic.co/t/update-by-query-status-counts-do-not-add-up-to-total/315709 "2022-10-03T17:15:44Z")
I'm running ES 7.17.3 with an index with 2.1M documents. I executed an update-by-query request with a script to clean up some data (there was no query, so it ran against all documents in the index). The script sets ctx.o… --- ## [Elasticsearch certificate error when access with public ip](https://discuss.elastic.co/t/elasticsearch-certificate-error-when-access-with-public-ip/315213)
**Author:** [@jay.annapureddy](https://discuss.elastic.co/u/jay.annapureddy)\ **Replies:** 13\ **Last updated:** [October 3, 2022, 4:26pm UTC](https://discuss.elastic.co/t/elasticsearch-certificate-error-when-access-with-public-ip/315213 "2022-10-03T16:26:49Z")
Hi, Problem: Elasticsearch cluster url having a certificate error, needed this to configure on beats on other vm. I am experimenting it on Azure VM with ubuntu operating system. Followed this official guide to install… --- ## [Parent/Child vs Nested. The real Performance difference](https://discuss.elastic.co/t/parent-child-vs-nested-the-real-performance-difference/315698)
**Author:** [@amirm](https://discuss.elastic.co/u/amirm)\ **Replies:** 0\ **Last updated:** [October 3, 2022, 3:11pm UTC](https://discuss.elastic.co/t/parent-child-vs-nested-the-real-performance-difference/315698 "2022-10-03T15:11:01Z")
Greeting. We all know that Elasticsearch is basically a NoSQL database. it means there is no relation between data and documents that need to be denormalized and flattened to index properly. In spite of all these thing… --- ## [Question regarding index stats - warmer](https://discuss.elastic.co/t/question-regarding-index-stats-warmer/315696)
**Author:** [@robbe482](https://discuss.elastic.co/u/robbe482)\ **Replies:** 0\ **Last updated:** [October 3, 2022, 3:03pm UTC](https://discuss.elastic.co/t/question-regarding-index-stats-warmer/315696 "2022-10-03T15:03:20Z")
Hello, we are running Elasticsearch 6.8.23. For one of our indices we are having performance problems. When checking the stats on that index one thing stands out, very high total\_time under the warmer section. Reading … [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=364) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=366)