# Elasticsearch

**URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=404

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 405

---

## [Phrase\_query for multiple should and must](https://discuss.elastic.co/t/phrase-query-for-multiple-should-and-must/309998)

<div class="topic-metadata">

**Author:** [@puff2fakie](https://discuss.elastic.co/u/puff2fakie)\
**Replies:** 0\
**Last updated:** [July 19, 2022, 9:44am UTC](https://discuss.elastic.co/t/phrase-query-for-multiple-should-and-must/309998 "2022-07-19T09:44:57Z")

</div>

I've indexed my documents as follows: doc = { "\_index": index\_name, "\_source": { "field": "bm25", "passage": passage, "passage\_id": pid, "level1": level1, "level2": level2…

---

## [Upgrading elasticsearch from 5.6 to 6.7 error: The Upgrade API must be run for 6.x nodes to join the cluster](https://discuss.elastic.co/t/upgrading-elasticsearch-from-5-6-to-6-7-error-the-upgrade-api-must-be-run-for-6-x-nodes-to-join-the-cluster/309667)

<div class="topic-metadata">

**Author:** [@Gerardo\_Padierna](https://discuss.elastic.co/u/Gerardo_Padierna)\
**Replies:** 2\
**Last updated:** [July 19, 2022, 9:41am UTC](https://discuss.elastic.co/t/upgrading-elasticsearch-from-5-6-to-6-7-error-the-upgrade-api-must-be-run-for-6-x-nodes-to-join-the-cluster/309667 "2022-07-19T09:41:05Z")

</div>

Hello, I'm following the instructions to run an rolling update from a 3-node cluster (elasticsearch, logstash & kibana) as described here. I had just 1 index that was in version 2.3.3 and I have reindexed that one befo…

---

## [Facing Issue while running queries on ElasticSearch](https://discuss.elastic.co/t/facing-issue-while-running-queries-on-elasticsearch/309997)

<div class="topic-metadata">

**Author:** [@painless\_elastic](https://discuss.elastic.co/u/painless_elastic)\
**Replies:** 0\
**Last updated:** [July 19, 2022, 9:37am UTC](https://discuss.elastic.co/t/facing-issue-while-running-queries-on-elasticsearch/309997 "2022-07-19T09:37:26Z")

</div>

Hi All, When we are making 100TPS queries to elastic and parallelly documents are getting indexed, the response time is good. But when the query rate to our elastic is close to zero and documents are getting indexed pa…

---

## [New Elasticsearch Java API: Source is null when search is execute](https://discuss.elastic.co/t/new-elasticsearch-java-api-source-is-null-when-search-is-execute/309980)

<div class="topic-metadata">

**Author:** [@ALX\_DM](https://discuss.elastic.co/u/ALX_DM)\
**Replies:** 2\
**Last updated:** [July 19, 2022, 7:30am UTC](https://discuss.elastic.co/t/new-elasticsearch-java-api-source-is-null-when-search-is-execute/309980 "2022-07-19T07:30:56Z")

</div>

I want to implement this command using the new ES Java API client but the result shows source as null POST /test\_event\_202207/\_search?typed\_keys=true { "sort":\[{"time":{"order":"desc"}}\] } If I excecute this in Kiban…

---

## [How to pin elasticsearch version using “ec” Terraform provider?](https://discuss.elastic.co/t/how-to-pin-elasticsearch-version-using-ec-terraform-provider/307812)

<div class="topic-metadata">

**Author:** [@amruth](https://discuss.elastic.co/u/amruth)\
**Replies:** 1\
**Last updated:** [July 19, 2022, 6:41am UTC](https://discuss.elastic.co/t/how-to-pin-elasticsearch-version-using-ec-terraform-provider/307812 "2022-07-19T06:41:47Z")

</div>

Hello Everyone, how to pin elasticsearch version using “ec” Terraform provider? I am using the following data "ec\_stack" "latest" { version\_regex = "8.2.1" region = var.region } but it throws “Error: failed…

---

## [Transform aggregation creates flattened record](https://discuss.elastic.co/t/transform-aggregation-creates-flattened-record/309657)

<div class="topic-metadata">

**Author:** [@dimuskin](https://discuss.elastic.co/u/dimuskin)\
**Replies:** 4\
**Last updated:** [July 19, 2022, 6:09am UTC](https://discuss.elastic.co/t/transform-aggregation-creates-flattened-record/309657 "2022-07-19T06:09:31Z")

</div>

I use transformation for data preprocessing, in my case every second rps are created for each host { "id": "appgw-rps-host", "source": { "index": \[ "logs-azure.platformlogs-default" \] }, "dest": { …

---

## [More like this query using an existing document, but I don't know its ID](https://discuss.elastic.co/t/more-like-this-query-using-an-existing-document-but-i-dont-know-its-id/309843)

<div class="topic-metadata">

**Author:** [@catmanjan](https://discuss.elastic.co/u/catmanjan)\
**Replies:** 4\
**Last updated:** [July 19, 2022, 5:29am UTC](https://discuss.elastic.co/t/more-like-this-query-using-an-existing-document-but-i-dont-know-its-id/309843 "2022-07-19T05:29:39Z")

</div>

I want to do a more like this query to return similar documents to a document that already exists in my index. I don't know the documents ID ahead of time, but I do know a term value that I can use to look it up (also, …

---

## [Elasticsearch ILM Policy](https://discuss.elastic.co/t/elasticsearch-ilm-policy/309974)

<div class="topic-metadata">

**Author:** [@dharminfadia](https://discuss.elastic.co/u/dharminfadia)\
**Replies:** 1\
**Last updated:** [July 19, 2022, 5:26am UTC](https://discuss.elastic.co/t/elasticsearch-ilm-policy/309974 "2022-07-19T05:26:42Z")

</div>

Hello Every One I have one elasticsearch cluster and Version is 7.10.2 I want to setup some of the index delete after week and after month automatically can you suggest how we can setup this cluster design is there are …

---

## [Indexes cannot be referenced after cluster configuration](https://discuss.elastic.co/t/indexes-cannot-be-referenced-after-cluster-configuration/309970)

<div class="topic-metadata">

**Author:** [@its-ogawa](https://discuss.elastic.co/u/its-ogawa)\
**Replies:** 12\
**Last updated:** [July 19, 2022, 5:15am UTC](https://discuss.elastic.co/t/indexes-cannot-be-referenced-after-cluster-configuration/309970 "2022-07-19T05:15:08Z")

</div>

I am creating an Elasticsearch cluster. I am deleting the Elasticsearch node configuration that was already running on a single node and configuring a cluster with two newly created Elasticsearch nodes. Here, the clust…

---

## [Elasticsearch complaining about space issues when there is plenty of space available](https://discuss.elastic.co/t/elasticsearch-complaining-about-space-issues-when-there-is-plenty-of-space-available/309844)

<div class="topic-metadata">

**Author:** [@pushshift](https://discuss.elastic.co/u/pushshift)\
**Replies:** 7\
**Last updated:** [July 19, 2022, 5:11am UTC](https://discuss.elastic.co/t/elasticsearch-complaining-about-space-issues-when-there-is-plenty-of-space-available/309844 "2022-07-19T05:11:09Z")

</div>

I received the following error this evening while indexing a large dataset: WARNING:root:{'create': {'\_index': 'fh\_hot\_en\_2021-05-05', '\_id': '1390039787566821378', 'status': 429, 'error': {'type': 'cluster\_block\_except…

---

## [Checked Exception "reference to termsQuery is ambiguous \[ERROR\]"](https://discuss.elastic.co/t/checked-exception-reference-to-termsquery-is-ambiguous-error/309969)

<div class="topic-metadata">

**Author:** [@willowHB](https://discuss.elastic.co/u/willowHB)\
**Replies:** 0\
**Last updated:** [July 19, 2022, 3:17am UTC](https://discuss.elastic.co/t/checked-exception-reference-to-termsquery-is-ambiguous-error/309969 "2022-07-19T03:17:03Z")

</div>

version：elasticsearch-7.15.2.jar 1、I think this is an api method error.When you use “QueryBuilders.termsQuery("status", 3,4)” query, an error “reference to termsQuery is ambiguous \[ERROR\] both method termsQuery(java.…

---

## [Sort by time received instead of timestamp](https://discuss.elastic.co/t/sort-by-time-received-instead-of-timestamp/308992)

<div class="topic-metadata">

**Author:** [@MADxHAWK](https://discuss.elastic.co/u/MADxHAWK)\
**Replies:** 7\
**Last updated:** [July 19, 2022, 2:16am UTC](https://discuss.elastic.co/t/sort-by-time-received-instead-of-timestamp/308992 "2022-07-19T02:16:59Z")

</div>

Hello, im using ELK-Stack to search through Cisco logs received by filebeat from our loghost. the problem is, i only can sort the discover by Timestamp from Elasticsearch and not by the timestamp the message was receiv…

---

## [Is there a section in the documentation that breaks down all available subcommands for a command?](https://discuss.elastic.co/t/is-there-a-section-in-the-documentation-that-breaks-down-all-available-subcommands-for-a-command/309601)

<div class="topic-metadata">

**Author:** [@pushshift](https://discuss.elastic.co/u/pushshift)\
**Replies:** 1\
**Last updated:** [July 19, 2022, 2:08am UTC](https://discuss.elastic.co/t/is-there-a-section-in-the-documentation-that-breaks-down-all-available-subcommands-for-a-command/309601 "2022-07-19T02:08:00Z")

</div>

When you do: curl -XGET https://localhost:9200/\_cat/ You get a nice little directory of available subcommands beneath \_cat. However, when I try to do the same for other sections like "\_cluster", I get the following: c…

---

## [ElasticSearch-Service install is not working](https://discuss.elastic.co/t/elasticsearch-service-install-is-not-working/309676)

<div class="topic-metadata">

**Author:** [@Muhammad\_Umair\_Sheik](https://discuss.elastic.co/u/Muhammad_Umair_Sheik)\
**Replies:** 1\
**Last updated:** [July 19, 2022, 2:04am UTC](https://discuss.elastic.co/t/elasticsearch-service-install-is-not-working/309676 "2022-07-19T02:04:45Z")

</div>

I am not able to install elastic as a windows service when there is space in the path. Without space, it is working fine. In the past, I was using version 6 which was working perfectly fine with both options. I have att…

---

## [Trying to run all tests on my app yields "too many open files" error](https://discuss.elastic.co/t/trying-to-run-all-tests-on-my-app-yields-too-many-open-files-error/309759)

<div class="topic-metadata">

**Author:** [@juno](https://discuss.elastic.co/u/juno)\
**Replies:** 1\
**Last updated:** [July 19, 2022, 2:01am UTC](https://discuss.elastic.co/t/trying-to-run-all-tests-on-my-app-yields-too-many-open-files-error/309759 "2022-07-19T02:01:22Z")

</div>

I'm building a reasonably small web app in Clojure and trying to run all the tests in order to get code coverage, but if I try to run them all, I get "too many open files" errors from elasticsearch. I have already tried…

---

## [Possible to scroll call ES v. 1.7 - how? I get errors](https://discuss.elastic.co/t/possible-to-scroll-call-es-v-1-7-how-i-get-errors/309653)

<div class="topic-metadata">

**Author:** [@johand\_erst](https://discuss.elastic.co/u/johand_erst)\
**Replies:** 2\
**Last updated:** [July 19, 2022, 1:54am UTC](https://discuss.elastic.co/t/possible-to-scroll-call-es-v-1-7-how-i-get-errors/309653 "2022-07-19T01:54:12Z")

</div>

Can someone help me what to do to call ES v. 1.7 with \_scroll\_id, please? According to the documentation it should be possible. Currently, I get one of these errors trying to pass \_scroll\_id in the payload: I write in…

---

## [Resolve Indices API: Missing documentation for params \`allow\_no\_indices\`, \`ignore\_unavailable\` and target \`\_all\`](https://discuss.elastic.co/t/resolve-indices-api-missing-documentation-for-params-allow-no-indices-ignore-unavailable-and-target-all/309964)

<div class="topic-metadata">

**Author:** [@pavan02](https://discuss.elastic.co/u/pavan02)\
**Replies:** 0\
**Last updated:** [July 19, 2022, 1:38am UTC](https://discuss.elastic.co/t/resolve-indices-api-missing-documentation-for-params-allow-no-indices-ignore-unavailable-and-target-all/309964 "2022-07-19T01:38:11Z")

</div>

Resolve index API | Elasticsearch Guide \[8.3\] | Elastic documentation doesn't describe params allow\_no\_indices, ignore\_unavailable and \_all target. However, those params and target is actually working. Does resolve API …

---

## [Installing ELK...Stuck in Elasticsearch not able to get Token and username password on windows 10 pro10](https://discuss.elastic.co/t/installing-elk-stuck-in-elasticsearch-not-able-to-get-token-and-username-password-on-windows-10-pro10/309776)

<div class="topic-metadata">

**Author:** [@sarvesh\_singh](https://discuss.elastic.co/u/sarvesh_singh)\
**Replies:** 1\
**Last updated:** [July 19, 2022, 1:27am UTC](https://discuss.elastic.co/t/installing-elk-stuck-in-elasticsearch-not-able-to-get-token-and-username-password-on-windows-10-pro10/309776 "2022-07-19T01:27:39Z")

</div>

\[2022-07-16T04:10:17,949\]\[INFO \]\[o.e.g.GatewayService \] \[DESKTOP-MJL6HRR\] recovered \[1\] indices into cluster\_state \[2022-07-16T04:10:18,325\]\[ERROR\]\[o.e.i.g.GeoIpDownloader \] \[DESKTOP-MJL6HRR\] exception during geoip…

---

## [Multi-Tier Architecture, best configuration for Elasticsearch.output](https://discuss.elastic.co/t/multi-tier-architecture-best-configuration-for-elasticsearch-output/309862)

<div class="topic-metadata">

**Author:** [@A\_Abdellah](https://discuss.elastic.co/u/A_Abdellah)\
**Replies:** 1\
**Last updated:** [July 19, 2022, 1:25am UTC](https://discuss.elastic.co/t/multi-tier-architecture-best-configuration-for-elasticsearch-output/309862 "2022-07-19T01:25:23Z")

</div>

Hello, I hope you are having a good day, I'm trying to migrate to a multi-tier architecture, and I'm confused what should the Elasticsearch.output configuration in beats and Elastic Agent be: Should I configure beats…

---

## [How to safely disable XPack security features](https://discuss.elastic.co/t/how-to-safely-disable-xpack-security-features/309725)

<div class="topic-metadata">

**Author:** [@yeziblo](https://discuss.elastic.co/u/yeziblo)\
**Replies:** 3\
**Last updated:** [July 19, 2022, 1:24am UTC](https://discuss.elastic.co/t/how-to-safely-disable-xpack-security-features/309725 "2022-07-19T01:24:41Z")

</div>

Hi everyone, I need help. In the near future, we plan to enable X-PACK security for our ES cluster，both transport and https. What we need to consider is: once there is a problem in the production environment, we need t…

---

## [Better to have more indices or more shards per index?](https://discuss.elastic.co/t/better-to-have-more-indices-or-more-shards-per-index/309937)

<div class="topic-metadata">

**Author:** [@Jeremy\_Andrews](https://discuss.elastic.co/u/Jeremy_Andrews)\
**Replies:** 2\
**Last updated:** [July 18, 2022, 6:58pm UTC](https://discuss.elastic.co/t/better-to-have-more-indices-or-more-shards-per-index/309937 "2022-07-18T18:58:35Z")

</div>

Let's say I have 200 GB of data and I'll split it between 4 shards of 50 GB each. Is there a difference in terms of performance whether I have 4 indices with 1 shard each, versus having one index with 4 primary shards?

---

## [Unable to deploy elastic agent on kubernetes as daemonset](https://discuss.elastic.co/t/unable-to-deploy-elastic-agent-on-kubernetes-as-daemonset/309931)

<div class="topic-metadata">

**Author:** [@Samuel\_Ho](https://discuss.elastic.co/u/Samuel_Ho)\
**Replies:** 0\
**Last updated:** [July 18, 2022, 5:20pm UTC](https://discuss.elastic.co/t/unable-to-deploy-elastic-agent-on-kubernetes-as-daemonset/309931 "2022-07-18T17:20:38Z")

</div>

Hi, I'm having some issue trying to deploy elastic agent to monitor kubernetes as a daemonset. Please see logs from the pod as following. Greatly appreciate some guidance. {"log.level":"warn","@timestamp":"2022-07-18T1…

---

## [Implementing Search After to fetch hits greater than 10000](https://discuss.elastic.co/t/implementing-search-after-to-fetch-hits-greater-than-10000/309913)

<div class="topic-metadata">

**Author:** [@Namita\_Jaokar](https://discuss.elastic.co/u/Namita_Jaokar)\
**Replies:** 1\
**Last updated:** [July 18, 2022, 2:59pm UTC](https://discuss.elastic.co/t/implementing-search-after-to-fetch-hits-greater-than-10000/309913 "2022-07-18T14:59:18Z")

</div>

Hi team, I am using elasticsearch in java to query hits that are greater than maximum default of 10000. For the same I came across using search after along with sort. I tried the query by sorting it on the basis of @ti…

---

## [Searching on aggregated nested fields](https://discuss.elastic.co/t/searching-on-aggregated-nested-fields/309909)

<div class="topic-metadata">

**Author:** [@Robina\_Dhingra1](https://discuss.elastic.co/u/Robina_Dhingra1)\
**Replies:** 0\
**Last updated:** [July 18, 2022, 1:57pm UTC](https://discuss.elastic.co/t/searching-on-aggregated-nested-fields/309909 "2022-07-18T13:57:23Z")

</div>

Hi Team Elastic, We have a requirement where we created continuous transform to keep track of field status of our trades data. The transform aggregates the data and produces documents in this form - { "\_index":…

---

## [First filter then run nested query](https://discuss.elastic.co/t/first-filter-then-run-nested-query/309905)

<div class="topic-metadata">

**Author:** [@Michal\_Bogusz](https://discuss.elastic.co/u/Michal_Bogusz)\
**Replies:** 2\
**Last updated:** [July 18, 2022, 1:51pm UTC](https://discuss.elastic.co/t/first-filter-then-run-nested-query/309905 "2022-07-18T13:51:03Z")

</div>

I have document with mapping: { "properties": { "title": {"type": "text"}, "added": {"type": "date"}, "pdf\_url": {"type": "text"}, "blocks": {"type": "nested"} } } I plan to have…

---

## [Query Time Dynamic synonym](https://discuss.elastic.co/t/query-time-dynamic-synonym/309898)

<div class="topic-metadata">

**Author:** [@pavithra\_arul](https://discuss.elastic.co/u/pavithra_arul)\
**Replies:** 0\
**Last updated:** [July 18, 2022, 12:38pm UTC](https://discuss.elastic.co/t/query-time-dynamic-synonym/309898 "2022-07-18T12:38:38Z")

</div>

Hi Team, Trying to achieve dynamic synonym expansion at Query time using Rest API call Trying to update the synonym.txt file dynamically using Rest API. (or) updating the synonyms list via Rest call without even creat…

---

## [How to "reindex" a field with "source" disabled and "store: true"?](https://discuss.elastic.co/t/how-to-reindex-a-field-with-source-disabled-and-store-true/309817)

<div class="topic-metadata">

**Author:** [@huuyafwww](https://discuss.elastic.co/u/huuyafwww)\
**Replies:** 4\
**Last updated:** [July 18, 2022, 12:52pm UTC](https://discuss.elastic.co/t/how-to-reindex-a-field-with-source-disabled-and-store-true/309817 "2022-07-18T12:52:15Z")

</div>

I am currently looking to optimize the performance of indexing and search on fields with very large text in them. And I have already read the following articles and previous forum posts. Searching in a large text fiel…

---

## [Aggregate sum till specific threshold reached](https://discuss.elastic.co/t/aggregate-sum-till-specific-threshold-reached/309897)

<div class="topic-metadata">

**Author:** [@brampurnot](https://discuss.elastic.co/u/brampurnot)\
**Replies:** 0\
**Last updated:** [July 18, 2022, 12:27pm UTC](https://discuss.elastic.co/t/aggregate-sum-till-specific-threshold-reached/309897 "2022-07-18T12:27:16Z")

</div>

Hi all, We are storing products in an index. Each product has a price and a specific quantity. Now we want to get the list of cheapest products up till a maximum quantity of 100. The total quantity should be a sum aggr…

---

## [Elastic v8.3 Install Errors MacOS](https://discuss.elastic.co/t/elastic-v8-3-install-errors-macos/308690)

<div class="topic-metadata">

**Author:** [@Sameer\_Malik](https://discuss.elastic.co/u/Sameer_Malik)\
**Replies:** 3\
**Last updated:** [July 18, 2022, 11:59am UTC](https://discuss.elastic.co/t/elastic-v8-3-install-errors-macos/308690 "2022-07-18T11:59:24Z")

</div>

Elasticsearch Version 8.3.1 OS Version macOS 12.3.1 Problem Description I'm very new to Elasticsearch. I'm trying to install ES v8.3.1 on my Mac by following the instructions on the download website. However, once I ru…

---

## [Group by date with aggr and apply sub aggr with group by date in elastic search](https://discuss.elastic.co/t/group-by-date-with-aggr-and-apply-sub-aggr-with-group-by-date-in-elastic-search/309894)

<div class="topic-metadata">

**Author:** [@surendrakandira](https://discuss.elastic.co/u/surendrakandira)\
**Replies:** 0\
**Last updated:** [July 18, 2022, 11:49am UTC](https://discuss.elastic.co/t/group-by-date-with-aggr-and-apply-sub-aggr-with-group-by-date-in-elastic-search/309894 "2022-07-18T11:49:37Z")

</div>

How to implement below C# entity logic in Elasticsearch var queryable1 = queryable.GroupBy(g =\> g.Date).Select(x =\> new GroupChartDto() { DailyPnL = x.Sum(s =\> s.DailyPnL), Date = x.Key, AggregateSum = queryable.Whe…

[Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=403)

[Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=405)
