# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=392 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 393 --- ## [Process\_cluster\_event\_timeout\_exception error on put-mapping in test environment](https://discuss.elastic.co/t/process-cluster-event-timeout-exception-error-on-put-mapping-in-test-environment/311567)
**Author:** [@diegomarcet](https://discuss.elastic.co/u/diegomarcet)\ **Replies:** 5\ **Last updated:** [August 10, 2022, 2:18pm UTC](https://discuss.elastic.co/t/process-cluster-event-timeout-exception-error-on-put-mapping-in-test-environment/311567 "2022-08-10T14:18:43Z")
Hello, I'm using the docker.elastic.co/elasticsearch/elasticsearch:7.17.5 docker image for running our tests in the CI server on a single node configuration. We're frequently getting the following error while running t… --- ## [Nested search works not as expected](https://discuss.elastic.co/t/nested-search-works-not-as-expected/311841)
**Author:** [@wegad61878](https://discuss.elastic.co/u/wegad61878)\ **Replies:** 0\ **Last updated:** [August 10, 2022, 2:17pm UTC](https://discuss.elastic.co/t/nested-search-works-not-as-expected/311841 "2022-08-10T14:17:57Z")
Hello, I have the following documents \[ { "id": "Car#1", "accessories": \[ { "type": "Turbo", "price": 20 }, { "type": "Supercharger", "price": 30 } … --- ## [Security on index level](https://discuss.elastic.co/t/security-on-index-level/311831)
**Author:** [@Casper\_Thrane](https://discuss.elastic.co/u/Casper_Thrane)\ **Replies:** 3\ **Last updated:** [August 10, 2022, 2:16pm UTC](https://discuss.elastic.co/t/security-on-index-level/311831 "2022-08-10T14:16:33Z")
Hi Is it possible to create security on index level, so access to an index is role based controlled, instead of setting security on all documents in an index? /Casper --- ## [Elastic Search Queries](https://discuss.elastic.co/t/elastic-search-queries/311764)
**Author:** [@Aravind1](https://discuss.elastic.co/u/Aravind1)\ **Replies:** 3\ **Last updated:** [August 10, 2022, 1:51pm UTC](https://discuss.elastic.co/t/elastic-search-queries/311764 "2022-08-10T13:51:29Z")
Hi, We are having a few queries on Elasticsearch logs optimization, We want to see the breakup of logs in each running resource also we have quires on how to analyze the logs based on the storage utilization and how man… --- ## [Can dynamic mapping templates block a particular field from being mapped?](https://discuss.elastic.co/t/can-dynamic-mapping-templates-block-a-particular-field-from-being-mapped/311837)
**Author:** [@nisow95612](https://discuss.elastic.co/u/nisow95612)\ **Replies:** 0\ **Last updated:** [August 10, 2022, 1:45pm UTC](https://discuss.elastic.co/t/can-dynamic-mapping-templates-block-a-particular-field-from-being-mapped/311837 "2022-08-10T13:45:41Z")
I have an index template set to "dynamic": "enable", which causes all fields to be added into the mapping. But what if there are fields that I explicitely do not want to be mapped? I know that dynamic templates can chan… --- ## [Elastic cluster nodes in different subnet](https://discuss.elastic.co/t/elastic-cluster-nodes-in-different-subnet/311771)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 3\ **Last updated:** [August 10, 2022, 1:40pm UTC](https://discuss.elastic.co/t/elastic-cluster-nodes-in-different-subnet/311771 "2022-08-10T13:40:38Z")
If I setup data node in X network subnet and master in Y subnet will it give me grief? all systems will have 10x2 = 20gig bonded network. They are not in different zone. Same datacenter just different subnet. --- ## [Shard allocation filtering for replications](https://discuss.elastic.co/t/shard-allocation-filtering-for-replications/311813)
**Author:** [@Pieter\_Agenbag](https://discuss.elastic.co/u/Pieter_Agenbag)\ **Replies:** 2\ **Last updated:** [August 10, 2022, 1:37pm UTC](https://discuss.elastic.co/t/shard-allocation-filtering-for-replications/311813 "2022-08-10T13:37:36Z")
Hi i was wondering if there was a way to route replicas to specific nodes in a cluster in the same way you can do shards with the allocation filtering. ?? My scenario is : I have a server with two blades in - each blad… --- ## [Cannot cast def \[java.lang.String\] to boolean](https://discuss.elastic.co/t/cannot-cast-def-java-lang-string-to-boolean/311824)
**Author:** [@Sourabh\_Korde](https://discuss.elastic.co/u/Sourabh_Korde)\ **Replies:** 2\ **Last updated:** [August 10, 2022, 1:12pm UTC](https://discuss.elastic.co/t/cannot-cast-def-java-lang-string-to-boolean/311824 "2022-08-10T13:12:18Z")
Dear All, I am simply trying to update documents using ingest pipeline with below script. But facing subjected error. Please suggest.... { "script": { "lang": "painless", "source": """ if(ctx.customer\_gender = "MAL… --- ## [Substract two time fields in index pattern](https://discuss.elastic.co/t/substract-two-time-fields-in-index-pattern/311580)
**Author:** [@Farid\_N](https://discuss.elastic.co/u/Farid_N)\ **Replies:** 2\ **Last updated:** [August 10, 2022, 12:15pm UTC](https://discuss.elastic.co/t/substract-two-time-fields-in-index-pattern/311580 "2022-08-10T12:15:38Z")
Hello dears I have an instance of heartbeat that check all of certificates of my websites. every log looks like this: { "\_index": "heartbeat-7.16.2-2022.08.01-000001", "\_type": "\_doc", "\_score": 1, "\_source": {… --- ## [Unable to update the index.mapping.total\_fields.limit value](https://discuss.elastic.co/t/unable-to-update-the-index-mapping-total-fields-limit-value/311795)
**Author:** [@Maruthappan\_Muthu](https://discuss.elastic.co/u/Maruthappan_Muthu)\ **Replies:** 4\ **Last updated:** [August 10, 2022, 10:22am UTC](https://discuss.elastic.co/t/unable-to-update-the-index-mapping-total-fields-limit-value/311795 "2022-08-10T10:22:37Z")
We are trying to poll the data from a device (PDU) through SNMP Input Plugin. The device MIB file has been imported to ELK logstash, as per SNMP input plugin | Logstash Reference \[8.3\] | Elastic. When executing the snmp… --- ## [Out of mem on during moving data from warm to cold tier](https://discuss.elastic.co/t/out-of-mem-on-during-moving-data-from-warm-to-cold-tier/311769)
**Author:** [@INS](https://discuss.elastic.co/u/INS)\ **Replies:** 6\ **Last updated:** [August 10, 2022, 9:27am UTC](https://discuss.elastic.co/t/out-of-mem-on-during-moving-data-from-warm-to-cold-tier/311769 "2022-08-10T09:27:54Z")
I'm facing a few times data nodes crash under moving data index from data warm tier to data cold tier. My memory config on data warm tier is 8GB which is implies 4GB of heap size due to Elasticsearch auto config but on… --- ## [Why does the must\_not query work if you place it before a nested query but not if you place it inside the nested query?](https://discuss.elastic.co/t/why-does-the-must-not-query-work-if-you-place-it-before-a-nested-query-but-not-if-you-place-it-inside-the-nested-query/311748)
**Author:** [@Vincent92](https://discuss.elastic.co/u/Vincent92)\ **Replies:** 0\ **Last updated:** [August 9, 2022, 2:34pm UTC](https://discuss.elastic.co/t/why-does-the-must-not-query-work-if-you-place-it-before-a-nested-query-but-not-if-you-place-it-inside-the-nested-query/311748 "2022-08-09T14:34:32Z")
Hello, I'm writing an application to search for logs in the elastic of my organization and the user can search for nested queries of this form: pathName:{ field1: "value1" AND field2: "value2" OR field3: "value3" } I … --- ## [Field was not found](https://discuss.elastic.co/t/field-was-not-found/311487)
**Author:** [@Dreinale](https://discuss.elastic.co/u/Dreinale)\ **Replies:** 10\ **Last updated:** [August 10, 2022, 7:54am UTC](https://discuss.elastic.co/t/field-was-not-found/311487 "2022-08-10T07:54:48Z")
Hi, I try to install & configure elk 8.3.3 without security on the docker "host" and filebeat on another docker. All works, i have the live logs, i imported my dashboards, but i have this: and the problem is because… --- ## [How to use aggregation fields in Watcher action body (with foreach loop)?](https://discuss.elastic.co/t/how-to-use-aggregation-fields-in-watcher-action-body-with-foreach-loop/310758)
**Author:** [@111238](https://discuss.elastic.co/u/111238)\ **Replies:** 1\ **Last updated:** [August 10, 2022, 8:20am UTC](https://discuss.elastic.co/t/how-to-use-aggregation-fields-in-watcher-action-body-with-foreach-loop/310758 "2022-08-10T08:20:17Z")
Hi there. I'm currently trying to create a watcher with foreach loop (per aggregation bucket). The actual loop works fine. Though, I have a problem accessing "ctx.payload.aggregations." to include a specific field from… --- ## [Elasticsearch returns two documents with same ID but different versions](https://discuss.elastic.co/t/elasticsearch-returns-two-documents-with-same-id-but-different-versions/311802)
**Author:** [@Andrey\_Tyutyunov](https://discuss.elastic.co/u/Andrey_Tyutyunov)\ **Replies:** 11\ **Last updated:** [August 10, 2022, 8:13am UTC](https://discuss.elastic.co/t/elasticsearch-returns-two-documents-with-same-id-but-different-versions/311802 "2022-08-10T08:13:59Z")
ES version: 5.3.1 Some documents returns twice, updated and previous version rq /purchases/payments/\_search?q=\_id:AYKCmqWVUjd1dFdxujwy&version=true Why it happens? How to fix it? --- ## [System index responsible for \_cat/shards](https://discuss.elastic.co/t/system-index-responsible-for-cat-shards/311678)
**Author:** [@kossde](https://discuss.elastic.co/u/kossde)\ **Replies:** 7\ **Last updated:** [August 10, 2022, 7:36am UTC](https://discuss.elastic.co/t/system-index-responsible-for-cat-shards/311678 "2022-08-10T07:36:36Z")
Can anyone tell me which indices are responsible for the data pulled in when using the \_cat/shards API? --- ## [Do i have to make user and role in kibana?](https://discuss.elastic.co/t/do-i-have-to-make-user-and-role-in-kibana/311801)
**Author:** [@hellocomputer](https://discuss.elastic.co/u/hellocomputer)\ **Replies:** 0\ **Last updated:** [August 10, 2022, 7:23am UTC](https://discuss.elastic.co/t/do-i-have-to-make-user-and-role-in-kibana/311801 "2022-08-10T07:23:09Z")
Hello! I'm using ELK stack 8.3.2 version and ubuntu20.04 version. I want to know that I have to make user in kibana? First, I tried to https SSL security in elasticsearch, kibana. But I couldn't make trusted cert fil… --- ## [Missing authentication credentials for REST request](https://discuss.elastic.co/t/missing-authentication-credentials-for-rest-request/311338)
**Author:** [@Medel](https://discuss.elastic.co/u/Medel)\ **Replies:** 4\ **Last updated:** [August 10, 2022, 12:53am UTC](https://discuss.elastic.co/t/missing-authentication-credentials-for-rest-request/311338 "2022-08-10T00:53:33Z")
Hello Elastic Users, I am trying to check if my Elasticsearch is working fine and I got the following problem: and Im trying to change elastic super-user password, I got this error : root@Master-node:/usr/share/ela… --- ## [Remove elasticSearch 6.5.4. in docker](https://discuss.elastic.co/t/remove-elasticsearch-6-5-4-in-docker/311776)
**Author:** [@Boodle](https://discuss.elastic.co/u/Boodle)\ **Replies:** 2\ **Last updated:** [August 9, 2022, 10:18pm UTC](https://discuss.elastic.co/t/remove-elasticsearch-6-5-4-in-docker/311776 "2022-08-09T22:18:45Z")
Would like to remove Elasticsearch 6.5.4 containers (installed by a vendor many years ago) but stopping or killing these container/s using stop/kill commands doesn’t exits its status, hence can't remove. There seems to b… --- ## [Data node calculation based on "Number of shards per node below 20 per GB heap it has configured"](https://discuss.elastic.co/t/data-node-calculation-based-on-number-of-shards-per-node-below-20-per-gb-heap-it-has-configured/311534)
**Author:** [@sree\_sk](https://discuss.elastic.co/u/sree_sk)\ **Replies:** 7\ **Last updated:** [August 9, 2022, 7:17pm UTC](https://discuss.elastic.co/t/data-node-calculation-based-on-number-of-shards-per-node-below-20-per-gb-heap-it-has-configured/311534 "2022-08-09T19:17:46Z")
I have the following scenario where, Data volume of an index is 85GB/day with a daily index rotation and retention of 90 days. Similarly I have 14 other indices with the same data volume per day. I have a system which… --- ## [Create alert for long running query from the logs in Kibana alert](https://discuss.elastic.co/t/create-alert-for-long-running-query-from-the-logs-in-kibana-alert/311736)
**Author:** [@skathir29](https://discuss.elastic.co/u/skathir29)\ **Replies:** 0\ **Last updated:** [August 9, 2022, 1:30pm UTC](https://discuss.elastic.co/t/create-alert-for-long-running-query-from-the-logs-in-kibana-alert/311736 "2022-08-09T13:30:17Z")
Need to get alerted if the time difference between these below two log event is more than 10 mins, Kindly provide some hint to do this Alerts / watcher in Kibana. @timestamp DatabaseName UserName ServerName Duration … --- ## [Docker elastic-logging-plugin disable SSL certificate validation](https://discuss.elastic.co/t/docker-elastic-logging-plugin-disable-ssl-certificate-validation/311690)
**Author:** [@amandradzhiyski](https://discuss.elastic.co/u/amandradzhiyski)\ **Replies:** 0\ **Last updated:** [August 9, 2022, 7:38am UTC](https://discuss.elastic.co/t/docker-elastic-logging-plugin-disable-ssl-certificate-validation/311690 "2022-08-09T07:38:46Z")
Hello, Is it possible to disable SSL certificate validation when elastic-logging-plugin docker plugin communicate with elasticsearch by HTTPS and server's certificate is selfsigned or untrusted? Or is it possible to tr… --- ## [Writing OR-Query with Wildcards using Query DSL](https://discuss.elastic.co/t/writing-or-query-with-wildcards-using-query-dsl/311726)
**Author:** [@MStrauch](https://discuss.elastic.co/u/MStrauch)\ **Replies:** 1\ **Last updated:** [August 9, 2022, 1:07pm UTC](https://discuss.elastic.co/t/writing-or-query-with-wildcards-using-query-dsl/311726 "2022-08-09T13:07:48Z")
Hi, I want to create a DSL query that applies wildcard syntax for multiple values that are OR connected. How can I do this in ES? By using a terms query I can connect different values as OR for the same field. By using… --- ## [Terraform - Elasticstack provider features and roadmap](https://discuss.elastic.co/t/terraform-elasticstack-provider-features-and-roadmap/309623)
**Author:** [@Swissmountain](https://discuss.elastic.co/u/Swissmountain)\ **Replies:** 3\ **Last updated:** [August 9, 2022, 12:10pm UTC](https://discuss.elastic.co/t/terraform-elasticstack-provider-features-and-roadmap/309623 "2022-08-09T12:10:19Z")
We are managing our assets using the terraform elastickstack provider for multiple stacks deployed on elastic cloud: Releases · elastic/terraform-provider-elasticstack · GitHub. We are expecting many new features to be… --- ## [Elasticsearch discovery issues kubernetes](https://discuss.elastic.co/t/elasticsearch-discovery-issues-kubernetes/311465)
**Author:** [@willsc](https://discuss.elastic.co/u/willsc)\ **Replies:** 17\ **Last updated:** [August 9, 2022, 10:43am UTC](https://discuss.elastic.co/t/elasticsearch-discovery-issues-kubernetes/311465 "2022-08-09T10:43:58Z")
Deploying elasticsearch 7.17.4 into kubernetes {rancher}, and have noticed that elastic doesn't form a cluster, it partitions into 3 separate master nodes. How do i increase the level of debugging on the masters, as all… --- ## [Multiple ilm and template for multiple index in filebeat directly to elasticsearch](https://discuss.elastic.co/t/multiple-ilm-and-template-for-multiple-index-in-filebeat-directly-to-elasticsearch/311716)
**Author:** [@Zahraa\_Dehghan](https://discuss.elastic.co/u/Zahraa_Dehghan)\ **Replies:** 0\ **Last updated:** [August 9, 2022, 11:17am UTC](https://discuss.elastic.co/t/multiple-ilm-and-template-for-multiple-index-in-filebeat-directly-to-elasticsearch/311716 "2022-08-09T11:17:33Z")
Hi , I am gathering log from multiple containers and I want to send them to multiple index with multiple ilm and template , here is my config: filebeat.autodiscover: providers: - type: kubernete… --- ## [Ingress controller logs directly from filebeat to elasticsearch](https://discuss.elastic.co/t/ingress-controller-logs-directly-from-filebeat-to-elasticsearch/310675)
**Author:** [@Zahraa\_Dehghan](https://discuss.elastic.co/u/Zahraa_Dehghan)\ **Replies:** 2\ **Last updated:** [August 9, 2022, 11:09am UTC](https://discuss.elastic.co/t/ingress-controller-logs-directly-from-filebeat-to-elasticsearch/310675 "2022-08-09T11:09:08Z")
hi , I want to ship ingress controllers log directly to elasticsearch via filebeat. Here is my log format for ingress {\\"remote\_ip\\": \\"%{GREEDYDATA:remote\_ip}\\",\\"method\\": \\"%{GREEDYDATA:method}\\", \\"host\\": \\"%{GREE… --- ## [ElasticSearch Query containing equal and not equal](https://discuss.elastic.co/t/elasticsearch-query-containing-equal-and-not-equal/311713)
**Author:** [@usman1](https://discuss.elastic.co/u/usman1)\ **Replies:** 0\ **Last updated:** [August 9, 2022, 10:53am UTC](https://discuss.elastic.co/t/elasticsearch-query-containing-equal-and-not-equal/311713 "2022-08-09T10:53:17Z")
Hi, Is there a way to use equal and not equal in a query for Elasticsearch? My data looks something like this: ID = 2 FLAG = ""Start" Date = 2022-08-08 Data = \<\> ID = 2 FLAG = "End" Date = 2022-08-08 Data = \<\> ID = 4… --- ## [Elastic transform](https://discuss.elastic.co/t/elastic-transform/311701)
**Author:** [@Amol](https://discuss.elastic.co/u/Amol)\ **Replies:** 1\ **Last updated:** [August 9, 2022, 10:15am UTC](https://discuss.elastic.co/t/elastic-transform/311701 "2022-08-09T10:15:34Z")
Hello Team, I'm able to create index through Transform with the help of Dev tool. But to avoid or over-write documents with same unique ID, I need to pass Document ID in transform, but I'm not able to add it. Kindly a… --- ## [Facing an \`SSLHandshakeException\` when first ran elasticsearch after installation](https://discuss.elastic.co/t/facing-an-sslhandshakeexception-when-first-ran-elasticsearch-after-installation/311706)
**Author:** [@hend](https://discuss.elastic.co/u/hend)\ **Replies:** 0\ **Last updated:** [August 9, 2022, 10:02am UTC](https://discuss.elastic.co/t/facing-an-sslhandshakeexception-when-first-ran-elasticsearch-after-installation/311706 "2022-08-09T10:02:11Z")
Hey, I'm very new to Elasticsearch and was following the installation steps, when I tried running it I get this error. not sure which certificate is missing and where/how to get it. Any help? \[2022-08-09T12:45:29,496\]\[… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=391) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=393)