# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=373 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 374 --- ## [Adding new data nodes to busy ingesting cluster](https://discuss.elastic.co/t/adding-new-data-nodes-to-busy-ingesting-cluster/314614)
**Author:** [@Todd\_Lyons](https://discuss.elastic.co/u/Todd_Lyons)\ **Replies:** 2\ **Last updated:** [September 19, 2022, 12:26am UTC](https://discuss.elastic.co/t/adding-new-data-nodes-to-busy-ingesting-cluster/314614 "2022-09-19T00:26:10Z")
We have a 7.17.4 cluster with 10 data nodes. Our main index is 10 shards with 1 replica, and it rolls over at 500 GB. I added 2 data nodes, expecting the incoming shards to spread out over the 12 nodes, maybe 2 per new… --- ## [What's the cause of This Error and how to fix It?](https://discuss.elastic.co/t/whats-the-cause-of-this-error-and-how-to-fix-it/314507)
**Author:** [@morad\_della3](https://discuss.elastic.co/u/morad_della3)\ **Replies:** 1\ **Last updated:** [September 18, 2022, 11:15pm UTC](https://discuss.elastic.co/t/whats-the-cause-of-this-error-and-how-to-fix-it/314507 "2022-09-18T23:15:36Z")
I installed Elasticsearch and Kibana 8.4.1 in VM ubuntu 22.04 ad I give this VM 2G RAM, 50 G disk, and 2 CPU, i try in the first time to browze kibana , it's work i can access kibana GUI and relate it to elasticsearch bu… --- ## [What's the cause of this Eroor and how to fix it?](https://discuss.elastic.co/t/whats-the-cause-of-this-eroor-and-how-to-fix-it/314505)
**Author:** [@morad\_della3](https://discuss.elastic.co/u/morad_della3)\ **Replies:** 1\ **Last updated:** [September 18, 2022, 11:15pm UTC](https://discuss.elastic.co/t/whats-the-cause-of-this-eroor-and-how-to-fix-it/314505 "2022-09-18T23:15:12Z")
I installed elasticsearch and kibana 8.4.1 in VM ubuntu 22.04 ad i give to this VM 2G RAM , 50 G disk and 2 cpu Caused by: java.io.IOException: No space left on device elastic@elqstic:~$ sudo systemctl status elasticse… --- ## [Converting large fields during reindex ends with 429](https://discuss.elastic.co/t/converting-large-fields-during-reindex-ends-with-429/314568)
**Author:** [@lubosvr](https://discuss.elastic.co/u/lubosvr)\ **Replies:** 1\ **Last updated:** [September 18, 2022, 11:12pm UTC](https://discuss.elastic.co/t/converting-large-fields-during-reindex-ends-with-429/314568 "2022-09-18T23:12:48Z")
I'm trying to reindex a complex document into a simple one and I have troubles with embedded fields. I have a document like this: POST from/\_doc/1 { "systemMetadata" : { "a:b:c:searchContentHTML" : { "textV… --- ## [ERROR: Aborting enrolling to cluster. Could not communicate with the node on any of the addresses from the enrollment token. All of \[ip:9200\] were attempted](https://discuss.elastic.co/t/error-aborting-enrolling-to-cluster-could-not-communicate-with-the-node-on-any-of-the-addresses-from-the-enrollment-token-all-of-ip-9200-were-attempted/314651)
**Author:** [@hiruni.insyncit.net](https://discuss.elastic.co/u/hiruni.insyncit.net)\ **Replies:** 0\ **Last updated:** [September 18, 2022, 9:18pm UTC](https://discuss.elastic.co/t/error-aborting-enrolling-to-cluster-could-not-communicate-with-the-node-on-any-of-the-addresses-from-the-enrollment-token-all-of-ip-9200-were-attempted/314651 "2022-09-18T21:18:05Z")
Hi, I tried to join new node to existing Elastic cluster. I'm using Elasticsearch version 8.4.1 Tried steps for new node: sudo rpm --install elasticsearch-8.4.1-x86\_64.rpm /usr/share/elasticsearch/bin/elasticsearch-… --- ## [Elasticsearch: find closest/nearest docs in reference to one (calculated from known date)](https://discuss.elastic.co/t/elasticsearch-find-closest-nearest-docs-in-reference-to-one-calculated-from-known-date/314648)
**Author:** [@err](https://discuss.elastic.co/u/err)\ **Replies:** 0\ **Last updated:** [September 18, 2022, 4:52pm UTC](https://discuss.elastic.co/t/elasticsearch-find-closest-nearest-docs-in-reference-to-one-calculated-from-known-date/314648 "2022-09-18T16:52:14Z")
Is there a standard seach possibility to find closest docs to one reference doc by date criteria (if I don not know range yet) Example dataset index “person” - doc : name=\>Alice birthday=\>01.01.1991 - doc : name=\>Bob… --- ## [Best practice for integrating automated created\_at & updated\_at fields in Elasticsearch 8.4](https://discuss.elastic.co/t/best-practice-for-integrating-automated-created-at-updated-at-fields-in-elasticsearch-8-4/314634)
**Author:** [@Sabbir\_Talukdar](https://discuss.elastic.co/u/Sabbir_Talukdar)\ **Replies:** 5\ **Last updated:** [September 18, 2022, 4:47pm UTC](https://discuss.elastic.co/t/best-practice-for-integrating-automated-created-at-updated-at-fields-in-elasticsearch-8-4/314634 "2022-09-18T16:47:39Z")
Hello, this is my first transition from other DB (SQL / NOSQL based) to Elasticsearch. I am having troubles choosing the best practiced methods of integrating created\_at & updated\_at fields. I am familiar with ingest\_p… --- ## [Aggregations on \_routing](https://discuss.elastic.co/t/aggregations-on-routing/314640)
**Author:** [@Alexandr\_Maximov](https://discuss.elastic.co/u/Alexandr_Maximov)\ **Replies:** 0\ **Last updated:** [September 18, 2022, 11:24am UTC](https://discuss.elastic.co/t/aggregations-on-routing/314640 "2022-09-18T11:24:50Z")
Hey folks, is there any way how to aggregate on \_routing meta field? I'd like to do an aggregation on \_routing to make sure we don't have any stale data in our indices. --- ## [Very large index , delete and recreate replica](https://discuss.elastic.co/t/very-large-index-delete-and-recreate-replica/314608)
**Author:** [@Paul-Ayo](https://discuss.elastic.co/u/Paul-Ayo)\ **Replies:** 8\ **Last updated:** [September 18, 2022, 10:03am UTC](https://discuss.elastic.co/t/very-large-index-delete-and-recreate-replica/314608 "2022-09-18T10:03:26Z")
I have a huge index which i want to split or reindex , the index has one primary and one replica shard both 118gb . I need to create a new index from the current to be able to use ILM as the index name does not fulfill t… --- ## [Elastic security](https://discuss.elastic.co/t/elastic-security/314297)
**Author:** [@dockerdeploys](https://discuss.elastic.co/u/dockerdeploys)\ **Replies:** 2\ **Last updated:** [September 18, 2022, 3:39am UTC](https://discuss.elastic.co/t/elastic-security/314297 "2022-09-18T03:39:19Z")
Continuing the discussion from ERROR: Failed to set password for user \[apm\_system\] yet again: Hello good time I encountered the following security error in Elasticsearch Thank you for your guidance --- ## [ElasticSearch-6.8 - querying with hyphens in fields does not get results](https://discuss.elastic.co/t/elasticsearch-6-8-querying-with-hyphens-in-fields-does-not-get-results/314467)
**Author:** [@spp125](https://discuss.elastic.co/u/spp125)\ **Replies:** 7\ **Last updated:** [September 18, 2022, 2:08am UTC](https://discuss.elastic.co/t/elasticsearch-6-8-querying-with-hyphens-in-fields-does-not-get-results/314467 "2022-09-18T02:08:17Z")
I have a users index in that there is a field called groupName that have value like "ad-users" when I query to match how many users belong to "ad-users" groupName. Upon querying to match on groupName I got no results. He… --- ## [Can't index new docs due to type error; sending to old indices still works](https://discuss.elastic.co/t/cant-index-new-docs-due-to-type-error-sending-to-old-indices-still-works/314628)
**Author:** [@emw](https://discuss.elastic.co/u/emw)\ **Replies:** 2\ **Last updated:** [September 18, 2022, 12:23am UTC](https://discuss.elastic.co/t/cant-index-new-docs-due-to-type-error-sending-to-old-indices-still-works/314628 "2022-09-18T00:23:13Z")
In my ES 7.17 cluster, I'm using index templates to create a new weekly index where I send log data. The index names are generated by my application, not by ES; the template handles index patterns, field limits, and alia… --- ## [Looking for some assistance with rsyslog-\>ES adding custom field, solvee will get 50$ 100%](https://discuss.elastic.co/t/looking-for-some-assistance-with-rsyslog-es-adding-custom-field-solvee-will-get-50-100/314422)
**Author:** [@PlospRawrs](https://discuss.elastic.co/u/PlospRawrs)\ **Replies:** 2\ **Last updated:** [September 17, 2022, 4:35am UTC](https://discuss.elastic.co/t/looking-for-some-assistance-with-rsyslog-es-adding-custom-field-solvee-will-get-50-100/314422 "2022-09-17T04:35:00Z")
Hi All, Looking for some guidance, per the subject, I will give the solvee 50$ to show my appreciation. I will share solution on thread I don't care, but I will compensate. Setup: Rsyslog version 8.20 ES version 7.10 … --- ## [Elasticsearch won’t start after upgrade to 8.4.1](https://discuss.elastic.co/t/elasticsearch-won-t-start-after-upgrade-to-8-4-1/314583)
**Author:** [@Ubuxa](https://discuss.elastic.co/u/Ubuxa)\ **Replies:** 4\ **Last updated:** [September 17, 2022, 2:12am UTC](https://discuss.elastic.co/t/elasticsearch-won-t-start-after-upgrade-to-8-4-1/314583 "2022-09-17T02:12:40Z")
Similar issue, but this ticket has since been closed: I upgraded Elasticsearch from 7.17.5 to 8.4.1, and unfortunately I did not check for any incompatibilities. I am now unable to start Elasticsearch, and downgrading … --- ## [Mapping question](https://discuss.elastic.co/t/mapping-question/314528)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 10\ **Last updated:** [September 16, 2022, 9:35pm UTC](https://discuss.elastic.co/t/mapping-question/314528 "2022-09-16T21:35:30Z")
I have old index hundreds of them which has following in pattern. I have another index created on different test cluster. which had this place dynamically. What I want is to add this host.name.keyword in previous… --- ## [Xpack security troubles](https://discuss.elastic.co/t/xpack-security-troubles/314594)
**Author:** [@Mo\_the\_literate](https://discuss.elastic.co/u/Mo_the_literate)\ **Replies:** 0\ **Last updated:** [September 16, 2022, 5:30pm UTC](https://discuss.elastic.co/t/xpack-security-troubles/314594 "2022-09-16T17:30:58Z")
Hi guys, I have installed graylog-server 4.3.5-1 on Debian 11.4 as well as elasticsearch 7.17.5 When I run the setup without uncommenting #xpack.security.enabled: true I get these here warnings in logs: "Elasticsear… --- ## [How to handle inconsistent field types](https://discuss.elastic.co/t/how-to-handle-inconsistent-field-types/314064)
**Author:** [@elastimatic](https://discuss.elastic.co/u/elastimatic)\ **Replies:** 3\ **Last updated:** [September 16, 2022, 2:12pm UTC](https://discuss.elastic.co/t/how-to-handle-inconsistent-field-types/314064 "2022-09-16T14:12:51Z")
I am trying to index a JSON object (comes from Postgres) that has sometimes-inconsistent types that is tripping me up. an example would be: { "financials": { "amount": "100" } }, { "financials": { … --- ## [Custom API integration](https://discuss.elastic.co/t/custom-api-integration/314538)
**Author:** [@alextg](https://discuss.elastic.co/u/alextg)\ **Replies:** 1\ **Last updated:** [September 16, 2022, 11:51am UTC](https://discuss.elastic.co/t/custom-api-integration/314538 "2022-09-16T11:51:19Z")
Hello, I'm running into issues while implementing the Custom API integration which sends API get requests. I have setup successfully other integrations using the Custom Logs integration, however, the Custom API integrat… --- ## [Unable to acquire permit to use snapshot files during recovery](https://discuss.elastic.co/t/unable-to-acquire-permit-to-use-snapshot-files-during-recovery/313935)
**Author:** [@yuswanul](https://discuss.elastic.co/u/yuswanul)\ **Replies:** 10\ **Last updated:** [September 16, 2022, 12:14pm UTC](https://discuss.elastic.co/t/unable-to-acquire-permit-to-use-snapshot-files-during-recovery/313935 "2022-09-16T12:14:28Z")
Hello there, i want to ask something about this. i haven't made any changes and i just wanted to check my cluster but suddenly one of my data node was offline and my cluster state from green to yellow. i found much log … --- ## [Spring + ES 8 server, can't make it compatible](https://discuss.elastic.co/t/spring-es-8-server-cant-make-it-compatible/314557)
**Author:** [@lhberg](https://discuss.elastic.co/u/lhberg)\ **Replies:** 0\ **Last updated:** [September 16, 2022, 8:16am UTC](https://discuss.elastic.co/t/spring-es-8-server-cant-make-it-compatible/314557 "2022-09-16T08:16:36Z")
Hi! So, I'm new to ES and been running ES locally through docker on ES 7.17.3 with RestHighLevelClient, Spring Data ES and running queries with QueryBuilders etc. Now I've been hosting Elastic Search through your/their… --- ## [Nodes do not release RAM when idle](https://discuss.elastic.co/t/nodes-do-not-release-ram-when-idle/314321)
**Author:** [@Thijsvdp](https://discuss.elastic.co/u/Thijsvdp)\ **Replies:** 17\ **Last updated:** [September 16, 2022, 6:17am UTC](https://discuss.elastic.co/t/nodes-do-not-release-ram-when-idle/314321 "2022-09-16T06:17:51Z")
Hi all, I have experienced some weird behavior on my development cluster while reading an index using the Elasticsearch-Hadoop connector. I am benchmarking the read performance, by running some scripts that read the ful… --- ## [How elastic bulk data](https://discuss.elastic.co/t/how-elastic-bulk-data/314513)
**Author:** [@avnere](https://discuss.elastic.co/u/avnere)\ **Replies:** 3\ **Last updated:** [September 16, 2022, 12:30am UTC](https://discuss.elastic.co/t/how-elastic-bulk-data/314513 "2022-09-16T00:30:00Z")
How Java client send the data source to the cluster? bulkRequest.add(new IndexRequest().source(object)); client.bulk(\_bulkRequest, RequestOptions.DEFAULT); What exactly it does after converting the data to JSON? Does… --- ## [Issues with outside certificate provider - nodes not connecting](https://discuss.elastic.co/t/issues-with-outside-certificate-provider-nodes-not-connecting/312307)
**Author:** [@jamesp](https://discuss.elastic.co/u/jamesp)\ **Replies:** 7\ **Last updated:** [September 15, 2022, 10:02pm UTC](https://discuss.elastic.co/t/issues-with-outside-certificate-provider-nodes-not-connecting/312307 "2022-09-15T22:02:50Z")
Hello, I set up a test instance of elasticsearch 7.11.1 on a Windows VM and created the certificates for SSL encryption following the processes in the documentation, which worked without an issue. I then created CSR's … --- ## [Match filter queries with OR instead of AND](https://discuss.elastic.co/t/match-filter-queries-with-or-instead-of-and/314533)
**Author:** [@mattshubs](https://discuss.elastic.co/u/mattshubs)\ **Replies:** 0\ **Last updated:** [September 15, 2022, 7:15pm UTC](https://discuss.elastic.co/t/match-filter-queries-with-or-instead-of-and/314533 "2022-09-15T19:15:01Z")
Hi, I am setting up alerting off of kibana logs search. Was not able to find documention for my desired use case. Is there a way to match multiple queries under a filter with OR instead of AND? This is \*.yml file. Examp… --- ## [RequestOption](https://discuss.elastic.co/t/requestoption/314516)
**Author:** [@avnere](https://discuss.elastic.co/u/avnere)\ **Replies:** 1\ **Last updated:** [September 15, 2022, 2:39pm UTC](https://discuss.elastic.co/t/requestoption/314516 "2022-09-15T14:39:32Z")
What does RequestOptions means? When we need to custom it? client.bulk(\_bulkRequest, RequestOptions.DEFAULT); --- ## [Ways to build Json doc in ES8 Java API client](https://discuss.elastic.co/t/ways-to-build-json-doc-in-es8-java-api-client/314459)
**Author:** [@ijaxahmed](https://discuss.elastic.co/u/ijaxahmed)\ **Replies:** 1\ **Last updated:** [September 15, 2022, 2:22pm UTC](https://discuss.elastic.co/t/ways-to-build-json-doc-in-es8-java-api-client/314459 "2022-09-15T14:22:09Z")
How to build Json document In Elasticsearch 8 API client , as In older Client APIs its possible to build using XContentBuilder like XContentBuilder builder = jsonBuilder() .startObject() .field("firstName", … --- ## [Has support for percolating multiple EXISTING documents been added?](https://discuss.elastic.co/t/has-support-for-percolating-multiple-existing-documents-been-added/314450)
**Author:** [@fedreg](https://discuss.elastic.co/u/fedreg)\ **Replies:** 2\ **Last updated:** [September 15, 2022, 1:52pm UTC](https://discuss.elastic.co/t/has-support-for-percolating-multiple-existing-documents-been-added/314450 "2022-09-15T13:52:49Z")
Hello! Question about Percolator Queries in ES 8.x... Wondering if the ability to query multiple EXISTING docs has been added to the API? I know I can query multiple raw documents such as GET /my-index-000001/\_search… --- ## [Elasticsearch cut strings with forward slash](https://discuss.elastic.co/t/elasticsearch-cut-strings-with-forward-slash/314355)
**Author:** [@abolinhas](https://discuss.elastic.co/u/abolinhas)\ **Replies:** 1\ **Last updated:** [September 15, 2022, 12:43pm UTC](https://discuss.elastic.co/t/elasticsearch-cut-strings-with-forward-slash/314355 "2022-09-15T12:43:43Z")
I have configured my squid proxy to send the logs to Elasticsearch 7.17.6, everything is working fine, except the USER mapping. The string expect is DOMAIN/USER, the ELK recieves it correctly on original message but the… --- ## [Rang query with format](https://discuss.elastic.co/t/rang-query-with-format/314495)
**Author:** [@casterQ](https://discuss.elastic.co/u/casterQ)\ **Replies:** 0\ **Last updated:** [September 15, 2022, 9:59am UTC](https://discuss.elastic.co/t/rang-query-with-format/314495 "2022-09-15T09:59:51Z")
This DSL works: POST xxxxx/\_search?size=1 { "profile": "true", "query": { "range": { "date\_createdAt": { "gte": "2005W161", "lt": "2005W171", "format": "basic\_week\_date" } … --- ## [Best practice of using volumes across a cluster](https://discuss.elastic.co/t/best-practice-of-using-volumes-across-a-cluster/314483)
**Author:** [@Dmitry\_Kulik](https://discuss.elastic.co/u/Dmitry_Kulik)\ **Replies:** 4\ **Last updated:** [September 15, 2022, 9:51am UTC](https://discuss.elastic.co/t/best-practice-of-using-volumes-across-a-cluster/314483 "2022-09-15T09:51:10Z")
Hi all. Wanted to ask you, what is the best approach for using volumes within a cluster? So basically I have a cluster with 3 master/data nodes (combined, not separate). And I want to increase this cluster and not lose … [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=372) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=374)