# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=381 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 382 --- ## [Log4j2.properties configuration for elasticsearch](https://discuss.elastic.co/t/log4j2-properties-configuration-for-elasticsearch/313443)
**Author:** [@irivas95](https://discuss.elastic.co/u/irivas95)\ **Replies:** 0\ **Last updated:** [September 1, 2022, 12:24pm UTC](https://discuss.elastic.co/t/log4j2-properties-configuration-for-elasticsearch/313443 "2022-09-01T12:24:34Z")
Hi, I am trying to configure a log policy based on the IfAccumulatedFileSize property reducing the default 2GB to 50MB because I already have too many logs in my folder. I have seen that the folder where I have the logs… --- ## [Ingest pipeline buffer for incoming documents](https://discuss.elastic.co/t/ingest-pipeline-buffer-for-incoming-documents/313438)
**Author:** [@chapmantrain](https://discuss.elastic.co/u/chapmantrain)\ **Replies:** 2\ **Last updated:** [September 1, 2022, 11:59am UTC](https://discuss.elastic.co/t/ingest-pipeline-buffer-for-incoming-documents/313438 "2022-09-01T11:59:14Z")
I am investigating using an ingest pipeline for one type of document for my cluster. I am wondering if I have a maintenance or upgrade window or even an unplanned outage does the ingest pipeline have a buffer for that do… --- ## [Start Service in Terminal](https://discuss.elastic.co/t/start-service-in-terminal/313429)
**Author:** [@Irwan\_Kurniawan](https://discuss.elastic.co/u/Irwan_Kurniawan)\ **Replies:** 1\ **Last updated:** [September 1, 2022, 11:57am UTC](https://discuss.elastic.co/t/start-service-in-terminal/313429 "2022-09-01T11:57:56Z")
When I installed elasticsearch in server and started it, it always shown this one. I already tried to reinstalled it and still happen. systemd-entrypoint\[1067640\]: /usr/share/elasticsearch/bin/systemd-entrypoint: 7: can… --- ## [ElasticSearch not starting - Main ERROR Null object returned for RollingFile in Appenders](https://discuss.elastic.co/t/elasticsearch-not-starting-main-error-null-object-returned-for-rollingfile-in-appenders/313437)
**Author:** [@afernandes](https://discuss.elastic.co/u/afernandes)\ **Replies:** 0\ **Last updated:** [September 1, 2022, 11:43am UTC](https://discuss.elastic.co/t/elasticsearch-not-starting-main-error-null-object-returned-for-rollingfile-in-appenders/313437 "2022-09-01T11:43:58Z")
Hi, I had installed Elasticsearch on a cluster of three Redhat 7.9 servers, but the service failed to start. When I check the elasticsearch status it's displayed several errors main ERROR Null object returned for Roll… --- ## [Should I merge my many indices into 1 and use ILM?](https://discuss.elastic.co/t/should-i-merge-my-many-indices-into-1-and-use-ilm/313421)
**Author:** [@kk123](https://discuss.elastic.co/u/kk123)\ **Replies:** 2\ **Last updated:** [September 1, 2022, 11:18am UTC](https://discuss.elastic.co/t/should-i-merge-my-many-indices-into-1-and-use-ilm/313421 "2022-09-01T11:18:18Z")
Hi, this question follows on from previous issues I've had Shards per node, Heap, 100% CPU....help please I have since updated to 7.15 and have reduced the number of shard per index to 2 (from 5) with 1 replica. The clu… --- ## [Template priority explanation](https://discuss.elastic.co/t/template-priority-explanation/311443)
**Author:** [@pestevao](https://discuss.elastic.co/u/pestevao)\ **Replies:** 3\ **Last updated:** [September 1, 2022, 11:11am UTC](https://discuss.elastic.co/t/template-priority-explanation/311443 "2022-09-01T11:11:10Z")
Hi all, I'm trying to change the number\_of\_replicas of some indexes, applying a loosely index\_patterns but... I'm struggling with priority. If I make a change on number\_of\_replicas and define a priority 1 on my new tem… --- ## [APM Event Logger does not read Flask parameters](https://discuss.elastic.co/t/apm-event-logger-does-not-read-flask-parameters/313433)
**Author:** [@papers\_hive](https://discuss.elastic.co/u/papers_hive)\ **Replies:** 0\ **Last updated:** [September 1, 2022, 10:49am UTC](https://discuss.elastic.co/t/apm-event-logger-does-not-read-flask-parameters/313433 "2022-09-01T10:49:07Z")
I am running a flask application with apm as an agent. I have configured my app as the following initially: app = Flask(\_\_name\_\_) APM\_DICTIONARY = { 'SERVICE\_NAME': 'MY\_SERVICE\_NAME' , 'SERVER\_U… --- ## [Roles with different access to index'ss](https://discuss.elastic.co/t/roles-with-different-access-to-indexss/312272)
**Author:** [@Barca88](https://discuss.elastic.co/u/Barca88)\ **Replies:** 2\ **Last updated:** [September 1, 2022, 10:07am UTC](https://discuss.elastic.co/t/roles-with-different-access-to-indexss/312272 "2022-09-01T10:07:19Z")
I am newbie with elastic and after watching some tutorials I started digging around and fund this: Is it possible with the free and open subscription, having different roles that can only access to a specific index a… --- ## [Ingest pipeline - format error](https://discuss.elastic.co/t/ingest-pipeline-format-error/313419)
**Author:** [@elkuser1234](https://discuss.elastic.co/u/elkuser1234)\ **Replies:** 0\ **Last updated:** [September 1, 2022, 8:14am UTC](https://discuss.elastic.co/t/ingest-pipeline-format-error/313419 "2022-09-01T08:14:58Z")
Hello I create ingest pipeline, i have an error: Field \[event.created\] of type \[keyword\] doesn't support formats. My log: - 10.10.10.11 - \[01/Sep/2022:07:48:00 +0100\] "- - " 100 - "-" "-" My ingest: \[ { "pip… --- ## [Failed to create query: Score function should not be null](https://discuss.elastic.co/t/failed-to-create-query-score-function-should-not-be-null/313268)
**Author:** [@Sarit\_Ghosh](https://discuss.elastic.co/u/Sarit_Ghosh)\ **Replies:** 1\ **Last updated:** [September 1, 2022, 9:09am UTC](https://discuss.elastic.co/t/failed-to-create-query-score-function-should-not-be-null/313268 "2022-09-01T09:09:59Z")
We are trying to move from ES 6.8 to ES 7.17. On an ES query we are getting the following error (the same query was working fine in ES 6.8): When I try Kibana also, I get the same error: "root\_cause": \[ { "type": "qu… --- ## [Elasticsearch error after upgrade "can not run elasticsearch as root"](https://discuss.elastic.co/t/elasticsearch-error-after-upgrade-can-not-run-elasticsearch-as-root/312632)
**Author:** [@mangeshmj1992](https://discuss.elastic.co/u/mangeshmj1992)\ **Replies:** 3\ **Last updated:** [September 1, 2022, 7:48am UTC](https://discuss.elastic.co/t/elasticsearch-error-after-upgrade-can-not-run-elasticsearch-as-root/312632 "2022-09-01T07:48:43Z")
Hello team, I have update my elasticsearch data node from 7,16,3 to 7.17.5. But it is through below error. Can you please help on same.. All files running as root.elasticsearch \[2022-08-22T18:26:40,213\]\[ERROR\]\[o.e.b… --- ## [Elasticsearch\_1 exited with code 1](https://discuss.elastic.co/t/elasticsearch-1-exited-with-code-1/313416)
**Author:** [@boot4root](https://discuss.elastic.co/u/boot4root)\ **Replies:** 1\ **Last updated:** [September 1, 2022, 7:43am UTC](https://discuss.elastic.co/t/elasticsearch-1-exited-with-code-1/313416 "2022-09-01T07:43:46Z")
Hello, when I try to run elasticsearch and kibana through docker-compose, I get the following error. Elasticsearch\_1 exited with code 1 Here is manual with this settings. Elastiflow I tried different versions, I also… --- ## [Monitor kibana using metricbeat](https://discuss.elastic.co/t/monitor-kibana-using-metricbeat/313384)
**Author:** [@tahseen\_fatima](https://discuss.elastic.co/u/tahseen_fatima)\ **Replies:** 4\ **Last updated:** [September 1, 2022, 7:37am UTC](https://discuss.elastic.co/t/monitor-kibana-using-metricbeat/313384 "2022-09-01T07:37:32Z")
Hi Experts, I using ELK 7.16.2v. I am doing a cluster stack monitoring using metricbeat. I have installed metricbeat on kibana server and enable the kibana-xpack module , disbale the system module. Confgure kibana-xpa… --- ## [Preloading all documents to filesystem cache](https://discuss.elastic.co/t/preloading-all-documents-to-filesystem-cache/313381)
**Author:** [@9guar1](https://discuss.elastic.co/u/9guar1)\ **Replies:** 2\ **Last updated:** [September 1, 2022, 6:51am UTC](https://discuss.elastic.co/t/preloading-all-documents-to-filesystem-cache/313381 "2022-09-01T06:51:12Z")
Hi community, Is there any possibility to preload all documents to the filesystem cache using 'index.store.preload' to increase search perfomance of the fetch phase? Search query is below: POST /structure/\_search?type… --- ## [Get the latest index of a certain form in elasticsearch](https://discuss.elastic.co/t/get-the-latest-index-of-a-certain-form-in-elasticsearch/313379)
**Author:** [@kosmylo](https://discuss.elastic.co/u/kosmylo)\ **Replies:** 1\ **Last updated:** [August 31, 2022, 9:22pm UTC](https://discuss.elastic.co/t/get-the-latest-index-of-a-certain-form-in-elasticsearch/313379 "2022-08-31T21:22:15Z")
I am periodically training an anomaly detection model and I am saving it in elasticsearch index of the form 'anomaly\_detection\_model-' + date\_model\_trained. This means that I am ending up with indices of the form: anomal… --- ## [Using a single Life Cycle Policy for many Index Templates](https://discuss.elastic.co/t/using-a-single-life-cycle-policy-for-many-index-templates/311236)
**Author:** [@dturner](https://discuss.elastic.co/u/dturner)\ **Replies:** 4\ **Last updated:** [August 31, 2022, 8:03pm UTC](https://discuss.elastic.co/t/using-a-single-life-cycle-policy-for-many-index-templates/311236 "2022-08-31T20:03:55Z")
Hello, We are using Elastic agent with different policies for different integrations. This has created many index templates for these different data sources. Each one of these index templates is using a different index … --- ## [Switching from cert-util to cert-manager](https://discuss.elastic.co/t/switching-from-cert-util-to-cert-manager/312195)
**Author:** [@danksim](https://discuss.elastic.co/u/danksim)\ **Replies:** 1\ **Last updated:** [August 31, 2022, 7:52pm UTC](https://discuss.elastic.co/t/switching-from-cert-util-to-cert-manager/312195 "2022-08-31T19:52:50Z")
Elasticsearch version: 7.6.2 Running it with Helm on AWS EKS Old setup (v1): cert-util is run manually (some makefile/script) before helm install in CI. Not using InitContainers Current setup (v2): helm chart now crea… --- ## [Failed to connect to localhost port 9200: Connection refused](https://discuss.elastic.co/t/failed-to-connect-to-localhost-port-9200-connection-refused/312954)
**Author:** [@ishan.abhinit](https://discuss.elastic.co/u/ishan.abhinit)\ **Replies:** 14\ **Last updated:** [August 31, 2022, 5:17pm UTC](https://discuss.elastic.co/t/failed-to-connect-to-localhost-port-9200-connection-refused/312954 "2022-08-31T17:17:08Z")
I am trying to install Elasticsearch 8.4.0 and kibana on Rocky Linux 8.6 using this article. Both elasticsearch and kibana are active and running but running this cmd: curl -X GET 'http://localhost:9200' I get curl: … --- ## [How to reset Fleet Server default output configuration?](https://discuss.elastic.co/t/how-to-reset-fleet-server-default-output-configuration/313178)
**Author:** [@GustavoPires](https://discuss.elastic.co/u/GustavoPires)\ **Replies:** 7\ **Last updated:** [August 31, 2022, 4:34pm UTC](https://discuss.elastic.co/t/how-to-reset-fleet-server-default-output-configuration/313178 "2022-08-31T16:34:55Z")
Hello, I am trying to change default output fleet server configuration, It is possible? I don't want to reinstall all my elasticsearch again. --- ## [Best way to implement a daily based time series, where current day data is being refreshed](https://discuss.elastic.co/t/best-way-to-implement-a-daily-based-time-series-where-current-day-data-is-being-refreshed/313377)
**Author:** [@dashiad](https://discuss.elastic.co/u/dashiad)\ **Replies:** 0\ **Last updated:** [August 31, 2022, 4:11pm UTC](https://discuss.elastic.co/t/best-way-to-implement-a-daily-based-time-series-where-current-day-data-is-being-refreshed/313377 "2022-08-31T16:11:00Z")
We're trying to find which would be the best way to handle this case: We are storing daily data from a remote source. This remote source updates the data several times per day, so we'd need to refresh the index too, for… --- ## [How to create users for file based auth and deploy using Helm Chart](https://discuss.elastic.co/t/how-to-create-users-for-file-based-auth-and-deploy-using-helm-chart/313374)
**Author:** [@Rohit\_Shrivastava](https://discuss.elastic.co/u/Rohit_Shrivastava)\ **Replies:** 0\ **Last updated:** [August 31, 2022, 3:38pm UTC](https://discuss.elastic.co/t/how-to-create-users-for-file-based-auth-and-deploy-using-helm-chart/313374 "2022-08-31T15:38:24Z")
Hi I wanted to know how should I automate the users file creation (file based authentication) with helm chart. Docs suggests to use elasticsearch-users cli, should I run an init container and run the script? Should I g… --- ## [Cross Cluster Search(CCS) or Cross Cluster Replication?](https://discuss.elastic.co/t/cross-cluster-search-ccs-or-cross-cluster-replication/313031)
**Author:** [@lcui\_dxc](https://discuss.elastic.co/u/lcui_dxc)\ **Replies:** 2\ **Last updated:** [August 31, 2022, 3:19pm UTC](https://discuss.elastic.co/t/cross-cluster-search-ccs-or-cross-cluster-replication/313031 "2022-08-31T15:19:47Z")
Hi there: We have a client, they sell goods over the world. They wanted to build a search engine so anyone over the world would be able to use the search engine to find their needs. The database for their goods informat… --- ## [New Install - error setting certificate location](https://discuss.elastic.co/t/new-install-error-setting-certificate-location/313373)
**Author:** [@dci-sigh](https://discuss.elastic.co/u/dci-sigh)\ **Replies:** 0\ **Last updated:** [August 31, 2022, 3:19pm UTC](https://discuss.elastic.co/t/new-install-error-setting-certificate-location/313373 "2022-08-31T15:19:26Z")
the issue in the link is marked as closed due to inactivity, but I am still having this issue - curl error 77 when doing a fresh elasticsearch 8.4 install (see link above). Below is a workaround. Any updates on this i… --- ## [Keyword field type keep getting Mapped as a Multifield](https://discuss.elastic.co/t/keyword-field-type-keep-getting-mapped-as-a-multifield/313267)
**Author:** [@xef](https://discuss.elastic.co/u/xef)\ **Replies:** 2\ **Last updated:** [August 31, 2022, 2:47pm UTC](https://discuss.elastic.co/t/keyword-field-type-keep-getting-mapped-as-a-multifield/313267 "2022-08-31T14:47:51Z")
Hi We are tryoing to create an index with a field of type Keyowrd, but elasticsearch keeps creating a mapping for a multifield even though we have specified the field as a keyowrd. i..e 2 fields one with field and one w… --- ## [Disable geoip](https://discuss.elastic.co/t/disable-geoip/313366)
**Author:** [@Jonas\_S](https://discuss.elastic.co/u/Jonas_S)\ **Replies:** 1\ **Last updated:** [August 31, 2022, 2:40pm UTC](https://discuss.elastic.co/t/disable-geoip/313366 "2022-08-31T14:40:51Z")
Hello, i have a logstash pipeline creating elasticsearch indices. Everytime a new index is created, geoip fields are already in the mappings. I do not use them and they never get filled with data. How do i stop them fro… --- ## [XML or Json into elasticasearch](https://discuss.elastic.co/t/xml-or-json-into-elasticasearch/311931)
**Author:** [@kim\_frederiksen](https://discuss.elastic.co/u/kim_frederiksen)\ **Replies:** 3\ **Last updated:** [August 31, 2022, 2:01pm UTC](https://discuss.elastic.co/t/xml-or-json-into-elasticasearch/311931 "2022-08-31T14:01:39Z")
Hi everybody, I think we are doing something wrong here and I really need your help because we are stuck. We have several systems where we pass documents(xml/json) through. We want pass these document on to ELK so we c… --- ## [Highlighting not working after upgrade](https://discuss.elastic.co/t/highlighting-not-working-after-upgrade/312095)
**Author:** [@henke71](https://discuss.elastic.co/u/henke71)\ **Replies:** 1\ **Last updated:** [August 31, 2022, 1:17pm UTC](https://discuss.elastic.co/t/highlighting-not-working-after-upgrade/312095 "2022-08-31T13:17:35Z")
Highlighting has stopped working after upgrade from 7.16 to 8.3.3 This is when using must\_not. Steps to reproduce Create index PUT /test { "mappings": { "properties": { "Name": { "type": "text" }, "… --- ## [Field \[content\] not present as part of path \[content\] when update\_by\_query](https://discuss.elastic.co/t/field-content-not-present-as-part-of-path-content-when-update-by-query/313336)
**Author:** [@sherry\_cs](https://discuss.elastic.co/u/sherry_cs)\ **Replies:** 0\ **Last updated:** [August 31, 2022, 9:01am UTC](https://discuss.elastic.co/t/field-content-not-present-as-part-of-path-content-when-update-by-query/313336 "2022-08-31T09:01:00Z")
Hi, guys. I created an index with a pipeline which extracted field from the file attachments. It works well except the partial update. I tried the request : POST test\_know/\_update/G3LH2oIBXGHwpDNidXe9 { "doc": { … --- ## [Query\_string search on Date type returns incorrect results](https://discuss.elastic.co/t/query-string-search-on-date-type-returns-incorrect-results/313204)
**Author:** [@Miguel\_Rios](https://discuss.elastic.co/u/Miguel_Rios)\ **Replies:** 3\ **Last updated:** [August 31, 2022, 1:12pm UTC](https://discuss.elastic.co/t/query-string-search-on-date-type-returns-incorrect-results/313204 "2022-08-31T13:12:20Z")
We made a pretty big leap recently in elasticsearch versions and one issue we've run into is that when using query\_string's on Date fields we get items which are outside the range of the deadline date. I have the follow… --- ## [ERROR: Failed to determine the health of the cluster](https://discuss.elastic.co/t/error-failed-to-determine-the-health-of-the-cluster/313242)
**Author:** [@morad\_della3](https://discuss.elastic.co/u/morad_della3)\ **Replies:** 1\ **Last updated:** [August 31, 2022, 12:12pm UTC](https://discuss.elastic.co/t/error-failed-to-determine-the-health-of-the-cluster/313242 "2022-08-31T12:12:14Z")
when i try to create a password to kibana interface i get this problem root@kibana:/home/kibana# /usr/share/elasticsearch/bin/elasticsearch-reset-password -i -u elastic --url http://192.168.43.157:9200 ERROR: Failed t… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=380) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=382)