# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=369 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 370 --- ## [Phrase query with collate with Elastic Java Client 8.4](https://discuss.elastic.co/t/phrase-query-with-collate-with-elastic-java-client-8-4/315218)
**Author:** [@Peter\_Strasser](https://discuss.elastic.co/u/Peter_Strasser)\ **Replies:** 6\ **Last updated:** [September 27, 2022, 8:59am UTC](https://discuss.elastic.co/t/phrase-query-with-collate-with-elastic-java-client-8-4/315218 "2022-09-27T08:59:51Z")
Hi Elastic Community, I am looking to run a phrase suggestion with the collate parameter in the Elastic Java Client Version 8.4., but I can not get any working example running. I currently encounter 2 problems: The … --- ## [Retrieving script field in elasticsearch for ML](https://discuss.elastic.co/t/retrieving-script-field-in-elasticsearch-for-ml/315165)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 2\ **Last updated:** [September 27, 2022, 8:56am UTC](https://discuss.elastic.co/t/retrieving-script-field-in-elasticsearch-for-ml/315165 "2022-09-27T08:56:43Z")
Hi Team I added this field recently and now i have to apply high function in this field using single metric ML. But this field is not showin , i know this is runtime field but is there any solution for this. --- ## [Conditional sorting by different text fields in Elastic Search Query](https://discuss.elastic.co/t/conditional-sorting-by-different-text-fields-in-elastic-search-query/315231)
**Author:** [@christianholsen](https://discuss.elastic.co/u/christianholsen)\ **Replies:** 0\ **Last updated:** [September 27, 2022, 5:58am UTC](https://discuss.elastic.co/t/conditional-sorting-by-different-text-fields-in-elastic-search-query/315231 "2022-09-27T05:58:11Z")
I have a problem sorting some data in an Elastic Search index. My data in ES are documents with a default name and possibly translation of the name can be found in a translations nested structure: \[ { "defaultName"… --- ## [A simple answer to QA question: how does Elasticsearch work?](https://discuss.elastic.co/t/a-simple-answer-to-qa-question-how-does-elasticsearch-work/315223)
**Author:** [@catmanjan](https://discuss.elastic.co/u/catmanjan)\ **Replies:** 12\ **Last updated:** [September 27, 2022, 5:26am UTC](https://discuss.elastic.co/t/a-simple-answer-to-qa-question-how-does-elasticsearch-work/315223 "2022-09-27T05:26:34Z")
Lets say I have a very simple Elasticsearch index, 100,000 documents with a single field called "text" which was indexed using the default text analyzer A QA engineer wants to know, when they type something in, what sho… --- ## [Deleted Elasticsearch http\_ca.crt](https://discuss.elastic.co/t/deleted-elasticsearch-http-ca-crt/315225)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 1\ **Last updated:** [September 27, 2022, 3:17am UTC](https://discuss.elastic.co/t/deleted-elasticsearch-http-ca-crt/315225 "2022-09-27T03:17:37Z")
A client, who has logstash and a elastic node in the same machine, was having problem indexing data with logstash, the cacert configuration in the logstash output was pointing to the elasticsearch directory where he h… --- ## [Restricting Elastic Cluster Access From Browser and unwanted Servers](https://discuss.elastic.co/t/restricting-elastic-cluster-access-from-browser-and-unwanted-servers/315208)
**Author:** [@sanjaykumr](https://discuss.elastic.co/u/sanjaykumr)\ **Replies:** 1\ **Last updated:** [September 27, 2022, 2:41am UTC](https://discuss.elastic.co/t/restricting-elastic-cluster-access-from-browser-and-unwanted-servers/315208 "2022-09-27T02:41:18Z")
We have 5 Node Cluster with 3 Master Nodes , 3 Coord nodes and 6 Data Nodes. Currently we can view the content of Elastic cluster via browser using the url \["" http://hostname:9200/\_cat/nodes""\] , we want access from th… --- ## [Skipping security auto configuration](https://discuss.elastic.co/t/skipping-security-auto-configuration/315173)
**Author:** [@cdy5159](https://discuss.elastic.co/u/cdy5159)\ **Replies:** 1\ **Last updated:** [September 27, 2022, 12:12am UTC](https://discuss.elastic.co/t/skipping-security-auto-configuration/315173 "2022-09-27T00:12:41Z")
I'm attempting to build a 3 node cluster with Elastic 8.2.3. I can build the first node as a single node cluster successfully and connect with kibana. My problem is adding nodes. On the first node, I've run the comman… --- ## [Full space /var/lib/elasticsearch](https://discuss.elastic.co/t/full-space-var-lib-elasticsearch/315197)
**Author:** [@Diego\_Santos](https://discuss.elastic.co/u/Diego_Santos)\ **Replies:** 3\ **Last updated:** [September 26, 2022, 10:13pm UTC](https://discuss.elastic.co/t/full-space-var-lib-elasticsearch/315197 "2022-09-26T22:13:08Z")
Hi everyone, I have my /var/lib/elasticsearch filesystem reached 100%. Could you please tell me what I can do? health status index uuid pri rep docs.count docs.del… --- ## [Create a POST body for a search](https://discuss.elastic.co/t/create-a-post-body-for-a-search/315201)
**Author:** [@Sergio\_vrijk](https://discuss.elastic.co/u/Sergio_vrijk)\ **Replies:** 0\ **Last updated:** [September 26, 2022, 6:38pm UTC](https://discuss.elastic.co/t/create-a-post-body-for-a-search/315201 "2022-09-26T18:38:20Z")
I would like some help on a query that I am trying. I have three fields in my JSON. The field1.key, field2.key and field3 which has a nest of data1,data2,data3. What I am trying to do is. Get per unique combination of th… --- ## [Primary Shard Allocation\_Failed](https://discuss.elastic.co/t/primary-shard-allocation-failed/315033)
**Author:** [@ivandbarria](https://discuss.elastic.co/u/ivandbarria)\ **Replies:** 4\ **Last updated:** [September 26, 2022, 9:32pm UTC](https://discuss.elastic.co/t/primary-shard-allocation-failed/315033 "2022-09-26T21:32:23Z")
Hello, Hope everyone is doing great. We had a power outage and our ES server went down. When the server went back online I noticed ES status on red: "cluster\_name" : "elasticsearch", "status" : "red", "timed\_out" : … --- ## [Logstash + datastreams](https://discuss.elastic.co/t/logstash-datastreams/315210)
**Author:** [@Zdeno\_Liska](https://discuss.elastic.co/u/Zdeno_Liska)\ **Replies:** 0\ **Last updated:** [September 26, 2022, 7:33pm UTC](https://discuss.elastic.co/t/logstash-datastreams/315210 "2022-09-26T19:33:46Z")
Hi, I have issue with configuration of Logstash and Datastreams with already defined ILM,index template here are details: Logstash pipeline config: elasticsearch { hosts =\> \["host1"\] data\_stream =\> "true" … --- ## [Cannot Find Answers to Prefix Queries and Max Expansion](https://discuss.elastic.co/t/cannot-find-answers-to-prefix-queries-and-max-expansion/315196)
**Author:** [@st11x](https://discuss.elastic.co/u/st11x)\ **Replies:** 0\ **Last updated:** [September 26, 2022, 5:49pm UTC](https://discuss.elastic.co/t/cannot-find-answers-to-prefix-queries-and-max-expansion/315196 "2022-09-26T17:49:10Z")
I have seen many posts asking the same question with elaborate examples and most never got answered and got closed by the bot. With a phrase query like "quick brown f" as in the example on Match phrase prefix query | El… --- ## [I can't access my elasticsearch , since it's already running in my terminal](https://discuss.elastic.co/t/i-cant-access-my-elasticsearch-since-its-already-running-in-my-terminal/315183)
**Author:** [@Vitoria\_De\_Lara](https://discuss.elastic.co/u/Vitoria_De_Lara)\ **Replies:** 0\ **Last updated:** [September 26, 2022, 3:04pm UTC](https://discuss.elastic.co/t/i-cant-access-my-elasticsearch-since-its-already-running-in-my-terminal/315183 "2022-09-26T15:04:50Z")
Good morning guys, I'm trying to access my elasticsearch but so far without success. I installed it on my centos8 virtual machine and it is already running. I gave a netstat -na to see and it says that I have to enable … --- ## [Does \_split actually splits data or just copies it across shards](https://discuss.elastic.co/t/does-split-actually-splits-data-or-just-copies-it-across-shards/315164)
**Author:** [@danskiyq](https://discuss.elastic.co/u/danskiyq)\ **Replies:** 4\ **Last updated:** [September 26, 2022, 3:50pm UTC](https://discuss.elastic.co/t/does-split-actually-splits-data-or-just-copies-it-across-shards/315164 "2022-09-26T15:50:13Z")
I want to create a new index with bigger amount of shards and copy my data across. \_reindex would probably be the best solution, but I expected split to do what I wanted. So I have 38gb 1shard index and I wanted to spli… --- ## [Watcher : parsing index to get values to be used in watchers](https://discuss.elastic.co/t/watcher-parsing-index-to-get-values-to-be-used-in-watchers/315041)
**Author:** [@JohnJ\_M](https://discuss.elastic.co/u/JohnJ_M)\ **Replies:** 2\ **Last updated:** [September 26, 2022, 3:49pm UTC](https://discuss.elastic.co/t/watcher-parsing-index-to-get-values-to-be-used-in-watchers/315041 "2022-09-26T15:49:50Z")
Hello the community, first post for me so please excuse my possible mistakes. Here is my issue: I am using the watcher in Elastic v7.13.4. I am using watcher to send mail to my customers to produce audit report on dif… --- ## [Unable to change JVM heap file in Elastic search 5.4.0](https://discuss.elastic.co/t/unable-to-change-jvm-heap-file-in-elastic-search-5-4-0/315186)
**Author:** [@TharinduK](https://discuss.elastic.co/u/TharinduK)\ **Replies:** 0\ **Last updated:** [September 26, 2022, 3:33pm UTC](https://discuss.elastic.co/t/unable-to-change-jvm-heap-file-in-elastic-search-5-4-0/315186 "2022-09-26T15:33:33Z")
5 Nodes 7 GB memory - 3.5 GB JVM heap file Indices - 62 Primary Shared 222 Replica Shared 157 We have been tried to change jvm.option file in /etc/elasticsearch but it is not reflecting in Kibana dashboard. --- ## [Using a must\_not filter on 'drone' returns a document containing 'drone'](https://discuss.elastic.co/t/using-a-must-not-filter-on-drone-returns-a-document-containing-drone/315150)
**Author:** [@cracanut](https://discuss.elastic.co/u/cracanut)\ **Replies:** 6\ **Last updated:** [September 26, 2022, 3:03pm UTC](https://discuss.elastic.co/t/using-a-must-not-filter-on-drone-returns-a-document-containing-drone/315150 "2022-09-26T15:03:26Z")
Using a must\_not filter on 'drone' returns a document containing 'drone': Cluster analyzer settings: "analysis": { "filter": { "english\_stemmer": { "type": "stemmer", "language": "engl… --- ## [Maintain confidentiality of agents and user in kibana](https://discuss.elastic.co/t/maintain-confidentiality-of-agents-and-user-in-kibana/315143)
**Author:** [@yahire](https://discuss.elastic.co/u/yahire)\ **Replies:** 2\ **Last updated:** [September 26, 2022, 2:02pm UTC](https://discuss.elastic.co/t/maintain-confidentiality-of-agents-and-user-in-kibana/315143 "2022-09-26T14:02:25Z")
Hi team, Please have a look at below screenshots. I wanted to implement Elasticsearch in such a way that we can have seperate users for seperate projects so that one user can not see the agent and traces of another … --- ## [Elastic reindex documents with new fields](https://discuss.elastic.co/t/elastic-reindex-documents-with-new-fields/315177)
**Author:** [@vee](https://discuss.elastic.co/u/vee)\ **Replies:** 0\ **Last updated:** [September 26, 2022, 2:00pm UTC](https://discuss.elastic.co/t/elastic-reindex-documents-with-new-fields/315177 "2022-09-26T14:00:57Z")
Hi - What's the best way to update an existing index with new field added to it? For eg: Current index has fields, firstName,lastName,streetNo,City,Zipcode. I would like to add one more field called FullAddress - which… --- ## [General guidance on data replication - Google Cloud](https://discuss.elastic.co/t/general-guidance-on-data-replication-google-cloud/315161)
**Author:** [@Lucien\_Perouze](https://discuss.elastic.co/u/Lucien_Perouze)\ **Replies:** 0\ **Last updated:** [September 26, 2022, 10:09am UTC](https://discuss.elastic.co/t/general-guidance-on-data-replication-google-cloud/315161 "2022-09-26T10:09:34Z")
I'm building a search engine for my app. For that i'm trying Elasticsearch for the first time. My app uses a Postgre SQL. As I understood I need to replicate datas from my Postgre to Elastic Search in order to perform RE… --- ## [Elasticsearch does not start](https://discuss.elastic.co/t/elasticsearch-does-not-start/315156)
**Author:** [@KermitSZ](https://discuss.elastic.co/u/KermitSZ)\ **Replies:** 1\ **Last updated:** [September 26, 2022, 10:07am UTC](https://discuss.elastic.co/t/elasticsearch-does-not-start/315156 "2022-09-26T10:07:22Z")
Hello community, We installed elasticsearch following this tutorial Install Elasticsearch with Debian Package | Elasticsearch Guide \[6.8\] | Elastic but the service crashes immediately after running the start command. T… --- ## [Oauth and token master](https://discuss.elastic.co/t/oauth-and-token-master/315146)
**Author:** [@yasin\_mohammed](https://discuss.elastic.co/u/yasin_mohammed)\ **Replies:** 2\ **Last updated:** [September 26, 2022, 9:12am UTC](https://discuss.elastic.co/t/oauth-and-token-master/315146 "2022-09-26T09:12:50Z")
Hi... We are using elastic stack basic license to begin with till we are able to prove the value of this software. for now we have enabled basic licensing and using local users and password. With the basic version can w… --- ## [Incremental snapshot after document update and segment](https://discuss.elastic.co/t/incremental-snapshot-after-document-update-and-segment/315139)
**Author:** [@bricevalenza](https://discuss.elastic.co/u/bricevalenza)\ **Replies:** 0\ **Last updated:** [September 26, 2022, 7:56am UTC](https://discuss.elastic.co/t/incremental-snapshot-after-document-update-and-segment/315139 "2022-09-26T07:56:29Z")
Hello, On a rather large architecture (about 32Tb of data x2 for the replica), we regularly update documents (need in terms of search engine so no regular ingestion, but rather updates of documents once a week). We mak… --- ## [Alphabetic to Basic Latin Unicode](https://discuss.elastic.co/t/alphabetic-to-basic-latin-unicode/315112)
**Author:** [@smkarnan](https://discuss.elastic.co/u/smkarnan)\ **Replies:** 5\ **Last updated:** [September 26, 2022, 7:36am UTC](https://discuss.elastic.co/t/alphabetic-to-basic-latin-unicode/315112 "2022-09-26T07:36:21Z")
How to Elasticsearch Basic Latin character using English Alphabetic Ex:- Francois to François - c also so to include ç Ex:- a also to included ā it's other way around of asciifolding --- ## [How to set Offset value using java api client for datHistogramAggregation](https://discuss.elastic.co/t/how-to-set-offset-value-using-java-api-client-for-dathistogramaggregation/315124)
**Author:** [@Raghunandan](https://discuss.elastic.co/u/Raghunandan)\ **Replies:** 0\ **Last updated:** [September 26, 2022, 6:07am UTC](https://discuss.elastic.co/t/how-to-set-offset-value-using-java-api-client-for-dathistogramaggregation/315124 "2022-09-26T06:07:18Z")
How to set Offset value using java api client for datHistogramAggregation along with calendarintervals --- ## [Unhealthy Deployment](https://discuss.elastic.co/t/unhealthy-deployment/315114)
**Author:** [@wijamw](https://discuss.elastic.co/u/wijamw)\ **Replies:** 3\ **Last updated:** [September 26, 2022, 2:41am UTC](https://discuss.elastic.co/t/unhealthy-deployment/315114 "2022-09-26T02:41:53Z")
Hi everyone, I have cloud deployment which today went unhealthy. But when I checked the cluster all is healthy. I have 1 Master, 2 Hot and 1 Warm. I checked the status of the index and it going through rollover … --- ## [Action \[indices:data/write/bulk\[s\]\] is unauthorized for API key id of user \[ \]](https://discuss.elastic.co/t/action-indices-data-write-bulk-s-is-unauthorized-for-api-key-id-of-user/313605)
**Author:** [@kgeographer](https://discuss.elastic.co/u/kgeographer)\ **Replies:** 3\ **Last updated:** [September 26, 2022, 1:59am UTC](https://discuss.elastic.co/t/action-indices-data-write-bulk-s-is-unauthorized-for-api-key-id-of-user/313605 "2022-09-26T01:59:32Z")
I have a 7.17 index I access routinely for reads and writes from a Django app with elasticsearch-py, performing snapshots to GCS, etc. This works fine with both the ES 7.17 on a Mac dev laptop against a copy of the prod … --- ## [How does Elasticsearch Splitting an Index Work?](https://discuss.elastic.co/t/how-does-elasticsearch-splitting-an-index-work/313319)
**Author:** [@Hao\_Yellow](https://discuss.elastic.co/u/Hao_Yellow)\ **Replies:** 17\ **Last updated:** [September 26, 2022, 1:37am UTC](https://discuss.elastic.co/t/how-does-elasticsearch-splitting-an-index-work/313319 "2022-09-26T01:37:54Z")
Hello, recently I've been working on splitting some indices with too large shards (not too many), so that the cluster's free disk space is more balanced among the multiple nodes. I read a discussion (see the discussion … --- ## [How to get ctx.payload.\_value size and apply condition on that](https://discuss.elastic.co/t/how-to-get-ctx-payload-value-size-and-apply-condition-on-that/315104)
**Author:** [@akhand\_1](https://discuss.elastic.co/u/akhand_1)\ **Replies:** 1\ **Last updated:** [September 25, 2022, 6:23pm UTC](https://discuss.elastic.co/t/how-to-get-ctx-payload-value-size-and-apply-condition-on-that/315104 "2022-09-25T18:23:17Z")
Hi team, @leandrojmp @stephenb @Badger I want to implement condition such that if the value to ctx.payload.\_value exceeds a certain number then only alerts need to be sent by watchers. Please suggest on this. --- ## [New user confused about odd @Timestamp](https://discuss.elastic.co/t/new-user-confused-about-odd-timestamp/315088)
**Author:** [@nfored](https://discuss.elastic.co/u/nfored)\ **Replies:** 4\ **Last updated:** [September 25, 2022, 5:30pm UTC](https://discuss.elastic.co/t/new-user-confused-about-odd-timestamp/315088 "2022-09-25T17:30:58Z")
I have 1 logs stash server that host 8 end points, outputs to elasticsearch 6 of the index correctly log @timestamp in UTC and life is lovely two index @timestamp is in the local timezone. This is the time stamp shown in… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=368) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=370)