# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=417 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 418 --- ## [Certificate invalid](https://discuss.elastic.co/t/certificate-invalid/306875)
**Author:** [@ftayyab](https://discuss.elastic.co/u/ftayyab)\ **Replies:** 4\ **Last updated:** [June 27, 2022, 5:53pm UTC](https://discuss.elastic.co/t/certificate-invalid/306875 "2022-06-27T17:53:42Z")
Hello, I am running Elasticsearch locally with default configuration out of the box. When I try to browse to https://localhost:9200, I get Privacy error in chrome, saying that connection is not private. I know that duri… --- ## [Increment date field watcher](https://discuss.elastic.co/t/increment-date-field-watcher/308190)
**Author:** [@Cheroufa](https://discuss.elastic.co/u/Cheroufa)\ **Replies:** 5\ **Last updated:** [June 27, 2022, 2:39pm UTC](https://discuss.elastic.co/t/increment-date-field-watcher/308190 "2022-06-27T14:39:40Z")
hello team, i want to increment date field """ {{ctx.payload.second.time}} + 30m """ in watcher but i don't know how to do it, any idea ? my code : "input": { "chain": { "inputs": \[ { "first": { "search": { "req… --- ## [Elasticsearch (NO log stash) - Keys starting with dot in JSON field](https://discuss.elastic.co/t/elasticsearch-no-log-stash-keys-starting-with-dot-in-json-field/307570)
**Author:** [@M2r12n0](https://discuss.elastic.co/u/M2r12n0)\ **Replies:** 2\ **Last updated:** [June 27, 2022, 1:35pm UTC](https://discuss.elastic.co/t/elasticsearch-no-log-stash-keys-starting-with-dot-in-json-field/307570 "2022-06-27T13:35:43Z")
Hi, Sorry for bothering with this, but I can not resolve it yet. I need to ingest a JSON type field but some of the keys starts with dots, something like this: { '.house.door' : 'nice', '.car.window' : 'blue' } I … --- ## [Delete vs deletebyquery](https://discuss.elastic.co/t/delete-vs-deletebyquery/308183)
**Author:** [@avnere](https://discuss.elastic.co/u/avnere)\ **Replies:** 7\ **Last updated:** [June 27, 2022, 11:54am UTC](https://discuss.elastic.co/t/delete-vs-deletebyquery/308183 "2022-06-27T11:54:59Z")
Hi, I want to delete over 10 million documents. Which approach is better and faster? Loop and delete each document with DELETE //\_doc/\<\_id\> OR perform deletebyquery? Thanks... --- ## [Transform with fixed time interval and different sync delay](https://discuss.elastic.co/t/transform-with-fixed-time-interval-and-different-sync-delay/308075)
**Author:** [@Avarjana](https://discuss.elastic.co/u/Avarjana)\ **Replies:** 2\ **Last updated:** [June 27, 2022, 11:37am UTC](https://discuss.elastic.co/t/transform-with-fixed-time-interval-and-different-sync-delay/308075 "2022-06-27T11:37:51Z")
I have a transform to identify anomaly and trigger alert in one of my index. Following are the details of the behavior. Expected behavior For each minute, aggregate last 5 minutes data and check for alerts. … --- ## [Delete by query and date range causes unexpected "version\_conflict\_engine\_exception", 409 response](https://discuss.elastic.co/t/delete-by-query-and-date-range-causes-unexpected-version-conflict-engine-exception-409-response/308227)
**Author:** [@bizmate](https://discuss.elastic.co/u/bizmate)\ **Replies:** 0\ **Last updated:** [June 27, 2022, 9:49am UTC](https://discuss.elastic.co/t/delete-by-query-and-date-range-causes-unexpected-version-conflict-engine-exception-409-response/308227 "2022-06-27T09:49:22Z")
I am running a query to delete certain logs/entries before a certain date with a log level of "Debug" as shown here, notice the wildcard in the index name POST /my\_index\_prod\*/\_delete\_by\_query { "query": { "bool":… --- ## [Error Enroll agent Centos](https://discuss.elastic.co/t/error-enroll-agent-centos/308218)
**Author:** [@alipujaistopo](https://discuss.elastic.co/u/alipujaistopo)\ **Replies:** 0\ **Last updated:** [June 27, 2022, 8:11am UTC](https://discuss.elastic.co/t/error-enroll-agent-centos/308218 "2022-06-27T08:11:23Z")
hi guys, i have many centos server. but why in my other centos is failed to enroll agent Error: could not read configuration file /var/lib/elastic-agent/elastic-agent.yml: open /var/lib/elastic-agent/elastic-agent.yml: … --- ## [Graphs not showing](https://discuss.elastic.co/t/graphs-not-showing/308085)
**Author:** [@aryamishra](https://discuss.elastic.co/u/aryamishra)\ **Replies:** 7\ **Last updated:** [June 27, 2022, 7:46am UTC](https://discuss.elastic.co/t/graphs-not-showing/308085 "2022-06-27T07:46:00Z")
I have taken reboot of of my kibana cluster, post reboot the graphs are not showing neither for 15mins or any orher timeline.Earlier it was showing exceptions of \[2\] total shards, but this cluster currently has \[3902\]/\[… --- ## [Strange results when trying to run an aggregration query](https://discuss.elastic.co/t/strange-results-when-trying-to-run-an-aggregration-query/308100)
**Author:** [@gep13](https://discuss.elastic.co/u/gep13)\ **Replies:** 2\ **Last updated:** [June 27, 2022, 7:20am UTC](https://discuss.elastic.co/t/strange-results-when-trying-to-run-an-aggregration-query/308100 "2022-06-27T07:20:41Z")
Hello, I am trying to run a query similar to the following: "aggs": { "authors": { "terms": { "field": "packageAuthors.keyword" } } } Initially, this seems to be working exactly as I wo… --- ## [Default retention policy](https://discuss.elastic.co/t/default-retention-policy/308088)
**Author:** [@patriczek](https://discuss.elastic.co/u/patriczek)\ **Replies:** 2\ **Last updated:** [June 27, 2022, 5:56am UTC](https://discuss.elastic.co/t/default-retention-policy/308088 "2022-06-27T05:56:29Z")
Hi, do we have any way to set up a default retention policy that doesn't affect system indices? --- ## [Hive into es err \[HEAD\] on \[pon\_ihgu\_sp\_day\_ln20220627\] failed; server\[10.204.172.64:9200\] returned \[503|Service Unavailable:\]](https://discuss.elastic.co/t/hive-into-es-err-head-on-pon-ihgu-sp-day-ln20220627-failed-server-10-204-172-64-9200-returned-503-service-unavailable/308203)
**Author:** [@baishangkun2011](https://discuss.elastic.co/u/baishangkun2011)\ **Replies:** 1\ **Last updated:** [June 27, 2022, 2:21am UTC](https://discuss.elastic.co/t/hive-into-es-err-head-on-pon-ihgu-sp-day-ln20220627-failed-server-10-204-172-64-9200-returned-503-service-unavailable/308203 "2022-06-27T02:21:30Z")
HI i use hive into es have err Caused by: org.elasticsearch.hadoop.rest.EsHadoopInvalidRequest: \[HEAD\] on \[pon\_ihgu\_sp\_day\_ln20220627\] failed; server\[10.204.172.64:9200\] returned \[503|Service Unavailable:\] at org.el… --- ## [ILM lifecycle error](https://discuss.elastic.co/t/ilm-lifecycle-error/307880)
**Author:** [@alon\_carmelly](https://discuss.elastic.co/u/alon_carmelly)\ **Replies:** 1\ **Last updated:** [June 27, 2022, 1:29am UTC](https://discuss.elastic.co/t/ilm-lifecycle-error/307880 "2022-06-27T01:29:48Z")
So I created a lifecycle policy with an Index templates using wild card for all my tests env. : test\* I get an error for all the indecies. Index lifecycle error illegal\_argument\_exception: setting \[index.lifecycle.rol… --- ## [Is it necessary to put "Discovery Seed\_hosts\[\]" when working on a single node in elasticsearch 8.2?](https://discuss.elastic.co/t/is-it-necessary-to-put-discovery-seed-hosts-when-working-on-a-single-node-in-elasticsearch-8-2/308179)
**Author:** [@Firas\_Bougrine](https://discuss.elastic.co/u/Firas_Bougrine)\ **Replies:** 1\ **Last updated:** [June 27, 2022, 1:21am UTC](https://discuss.elastic.co/t/is-it-necessary-to-put-discovery-seed-hosts-when-working-on-a-single-node-in-elasticsearch-8-2/308179 "2022-06-27T01:21:32Z")
is it necessary to put "Discovery Seed\_hosts" when working on a single node in elasticsearch 8.2? --- ## [Bulk Insert documents - Getting BulkError](https://discuss.elastic.co/t/bulk-insert-documents-getting-bulkerror/308198)
**Author:** [@Hardik\_Sanghavi](https://discuss.elastic.co/u/Hardik_Sanghavi)\ **Replies:** 2\ **Last updated:** [June 27, 2022, 1:08am UTC](https://discuss.elastic.co/t/bulk-insert-documents-getting-bulkerror/308198 "2022-06-27T01:08:42Z")
Hello, I am new to inserting bulk documents into ElasticSearch using Python When I am trying to bulk insert documents, I am getting "elasticsearch.helpers.BulkIndexError: 100 document(s) failed to index." The index do… --- ## [Mapper parsing exception - Am I looking in the right place or is ES fooling me!?](https://discuss.elastic.co/t/mapper-parsing-exception-am-i-looking-in-the-right-place-or-is-es-fooling-me/308022)
**Author:** [@js-jp](https://discuss.elastic.co/u/js-jp)\ **Replies:** 4\ **Last updated:** [June 27, 2022, 12:25am UTC](https://discuss.elastic.co/t/mapper-parsing-exception-am-i-looking-in-the-right-place-or-is-es-fooling-me/308022 "2022-06-27T00:25:39Z")
Hi all Apologies if I don't have all the correct terminology as I am new to the elastic stack. I have just been allocated a task to remedy this problem; We have a Filebeat - ES - Kibana installation When users run th… --- ## [Get error while on "Add your Fleet Server host"](https://discuss.elastic.co/t/get-error-while-on-add-your-fleet-server-host/308021)
**Author:** [@ghostmomo](https://discuss.elastic.co/u/ghostmomo)\ **Replies:** 0\ **Last updated:** [June 23, 2022, 2:10pm UTC](https://discuss.elastic.co/t/get-error-while-on-add-your-fleet-server-host/308021 "2022-06-23T14:10:11Z")
Trying to add the Fleet Server host but turn out having error as below. Any idea what did I setup incorrectly please? Thank you. --- ## [Is the java jdk by default available in elk stack 8.2](https://discuss.elastic.co/t/is-the-java-jdk-by-default-available-in-elk-stack-8-2/308192)
**Author:** [@Firas\_Bougrine](https://discuss.elastic.co/u/Firas_Bougrine)\ **Replies:** 5\ **Last updated:** [June 26, 2022, 9:40pm UTC](https://discuss.elastic.co/t/is-the-java-jdk-by-default-available-in-elk-stack-8-2/308192 "2022-06-26T21:40:29Z")
is the java jdk by default available in elk stack 8.2 ? because when i try java --version this the response elastic@elastic:~$ java -version Command 'java' not found, but can be installed with: sudo apt install openjdk… --- ## [How does match\_phrase result data order in detail?](https://discuss.elastic.co/t/how-does-match-phrase-result-data-order-in-detail/308188)
**Author:** [@mktriniti](https://discuss.elastic.co/u/mktriniti)\ **Replies:** 0\ **Last updated:** [June 26, 2022, 3:00pm UTC](https://discuss.elastic.co/t/how-does-match-phrase-result-data-order-in-detail/308188 "2022-06-26T15:00:29Z")
Hello there, I am new to Elasticsearch. I am trying to use match\_phrase to accomplish a search task on item name that having a phrase match in order. But the result order is a little bit strange in my case. Example quer… --- ## [Bulk API Failing](https://discuss.elastic.co/t/bulk-api-failing/308184)
**Author:** [@chandramouli\_ravi](https://discuss.elastic.co/u/chandramouli_ravi)\ **Replies:** 2\ **Last updated:** [June 26, 2022, 2:45pm UTC](https://discuss.elastic.co/t/bulk-api-failing/308184 "2022-06-26T14:45:55Z")
Hi, I am using ElasticSearch 8.2.3 version in Windows 10 I have tried modifying in multiple ways.. but its still failing Could you please help. curl --insecure -H "Content-Type: application/x-ndjson" -XPUT "https://… --- ## [Collapse over more then 10,000 docs](https://discuss.elastic.co/t/collapse-over-more-then-10-000-docs/308096)
**Author:** [@LenaM](https://discuss.elastic.co/u/LenaM)\ **Replies:** 1\ **Last updated:** [June 26, 2022, 1:43pm UTC](https://discuss.elastic.co/t/collapse-over-more-then-10-000-docs/308096 "2022-06-26T13:43:33Z")
I have an index that contains more than 1 million documents. I am using a query with the "collapse" parameter to group a field and get its unique values. Do I get ALL unique values from this field that might match the qu… --- ## [Elastic search parse a string](https://discuss.elastic.co/t/elastic-search-parse-a-string/308164)
**Author:** [@Dorian](https://discuss.elastic.co/u/Dorian)\ **Replies:** 8\ **Last updated:** [June 26, 2022, 10:57am UTC](https://discuss.elastic.co/t/elastic-search-parse-a-string/308164 "2022-06-26T10:57:46Z")
Hi, I search a way to find a string inside another string by parsing it. For example i index into elasticSearch a document that contain the text : "2000Newyork" in a field name "id" And now i want to find the indexed … --- ## [ILM Performance in search](https://discuss.elastic.co/t/ilm-performance-in-search/307951)
**Author:** [@Yariv\_Moshe](https://discuss.elastic.co/u/Yariv_Moshe)\ **Replies:** 6\ **Last updated:** [June 26, 2022, 7:48am UTC](https://discuss.elastic.co/t/ilm-performance-in-search/307951 "2022-06-26T07:48:55Z")
Hi, I want to use ILM to create a new index per day or month. my question is how it going to affect search performance if old indexes will move to the warm | cold stage with pure HW. let's say that I have a query rang… --- ## [Java client 8.2.2 Trouble loading keystore during setup](https://discuss.elastic.co/t/java-client-8-2-2-trouble-loading-keystore-during-setup/307577)
**Author:** [@Jack\_Park](https://discuss.elastic.co/u/Jack_Park)\ **Replies:** 20\ **Last updated:** [June 26, 2022, 12:52am UTC](https://discuss.elastic.co/t/java-client-8-2-2-trouble-loading-keystore-during-setup/307577 "2022-06-26T00:52:52Z")
I created a gist here When doing a keystore.load I get DerInputStream.getLength(): lengthTag=87, too big. Apparently that's a rich topic, as in Most of the issue seems to be on platforms other than ES. I'm hoping … --- ## [Aggregation over top hits](https://discuss.elastic.co/t/aggregation-over-top-hits/308169)
**Author:** [@Nowrin\_Hossain](https://discuss.elastic.co/u/Nowrin_Hossain)\ **Replies:** 0\ **Last updated:** [June 25, 2022, 9:33pm UTC](https://discuss.elastic.co/t/aggregation-over-top-hits/308169 "2022-06-25T21:33:23Z")
Hello, This is my query { "aggs": { "by\_agency\_id": { "terms": { "field": "agency\_id.keyword", "size": 1000 }, "aggs": { "by\_uuid": { "terms": { "fi… --- ## [Elasticsearch index on compressed string blob](https://discuss.elastic.co/t/elasticsearch-index-on-compressed-string-blob/308151)
**Author:** [@Harsh\_Agarwal](https://discuss.elastic.co/u/Harsh_Agarwal)\ **Replies:** 7\ **Last updated:** [June 25, 2022, 9:04pm UTC](https://discuss.elastic.co/t/elasticsearch-index-on-compressed-string-blob/308151 "2022-06-25T21:04:43Z")
I needed to index on compressed string blob.. I read that ingest attachment plugin could be the right tool for files.. and base64 strings.. ingest attachment plugin relies on appache tikka I read that Tika supports: "… --- ## [XPOST Failing](https://discuss.elastic.co/t/xpost-failing/308153)
**Author:** [@chandramouli\_ravi](https://discuss.elastic.co/u/chandramouli_ravi)\ **Replies:** 5\ **Last updated:** [June 25, 2022, 2:50pm UTC](https://discuss.elastic.co/t/xpost-failing/308153 "2022-06-25T14:50:47Z")
Hi, I am running elasticsearch 8.2.3 from my laptop. Able to check health, create index but insert document is failing. Could you please help what's the problem here. C:\\Users\\ravich\>curl --insecure -H "Content-Type:… --- ## [How do I increase the number of logs per second processing by Elastic Agent and Ingest pipeline?](https://discuss.elastic.co/t/how-do-i-increase-the-number-of-logs-per-second-processing-by-elastic-agent-and-ingest-pipeline/306535)
**Author:** [@alah64](https://discuss.elastic.co/u/alah64)\ **Replies:** 1\ **Last updated:** [June 25, 2022, 12:45pm UTC](https://discuss.elastic.co/t/how-do-i-increase-the-number-of-logs-per-second-processing-by-elastic-agent-and-ingest-pipeline/306535 "2022-06-25T12:45:22Z")
Hi I came first and only received the Suricata log from the elastic agent, about 600 EPS processing is done. The amount of CPU that you can see in the following figure by htop command: Then I came and processed othe… --- ## [Python 无法通过ssh使用Elasticsearch类和远程服务器建立连接](https://discuss.elastic.co/t/python-ssh-elasticsearch/308157)
**Author:** [@qigemingzihaonana](https://discuss.elastic.co/u/qigemingzihaonana)\ **Replies:** 2\ **Last updated:** [June 25, 2022, 8:11am UTC](https://discuss.elastic.co/t/python-ssh-elasticsearch/308157 "2022-06-25T08:11:45Z")
elasticsearch.exceptions.ConnectionError: ConnectionError(\: Failed to establish a new connection: \[WinError 10061\] 由于目标计算机积极拒绝，无法连接。) caused by: NewConnecti… --- ## [Set data view format in index template](https://discuss.elastic.co/t/set-data-view-format-in-index-template/307445)
**Author:** [@seanziee](https://discuss.elastic.co/u/seanziee)\ **Replies:** 10\ **Last updated:** [June 25, 2022, 1:40am UTC](https://discuss.elastic.co/t/set-data-view-format-in-index-template/307445 "2022-06-25T01:40:06Z")
Hi, I have multiple spaces that all reference the same index with an index pattern - metricbeat-\*./ Metricbeat comes with MANY \*.pct fields and I'd like to display them all as percentages rather than numbers. It would … --- ## [Num\_reduce\_phases in query response](https://discuss.elastic.co/t/num-reduce-phases-in-query-response/308145)
**Author:** [@Akshay\_Pawar](https://discuss.elastic.co/u/Akshay_Pawar)\ **Replies:** 0\ **Last updated:** [June 25, 2022, 12:43am UTC](https://discuss.elastic.co/t/num-reduce-phases-in-query-response/308145 "2022-06-25T00:43:24Z")
Hello, we are using Elasticsearch's version 7.5.1 and noticed that sometimes (not always) Elasticsearch returns "num\_reduced\_phases" in query response for aggregate queries. Is there any specific query/scenario which can… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=416) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=418)