# Elasticsearch

**URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=420

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 421

---

## [Full Text Search with JAVA!](https://discuss.elastic.co/t/full-text-search-with-java/307887)

<div class="topic-metadata">

**Author:** [@Serkan\_Demir](https://discuss.elastic.co/u/Serkan_Demir)\
**Replies:** 2\
**Last updated:** [June 22, 2022, 2:51pm UTC](https://discuss.elastic.co/t/full-text-search-with-java/307887 "2022-06-22T14:51:48Z")

</div>

We have a project and we use ElasticSearch and Java. I improved myself and I can Aggregations, Delete, Update , Insert , Empty index creating, wildcard and mapping etc. from JAVA . But only problem is in our project we g…

---

## [Getting BulkIndexError When Trying to Write Documents to ElasticsearchDocumentStore()](https://discuss.elastic.co/t/getting-bulkindexerror-when-trying-to-write-documents-to-elasticsearchdocumentstore/307894)

<div class="topic-metadata">

**Author:** [@Marsa\_Andari](https://discuss.elastic.co/u/Marsa_Andari)\
**Replies:** 0\
**Last updated:** [June 22, 2022, 2:51pm UTC](https://discuss.elastic.co/t/getting-bulkindexerror-when-trying-to-write-documents-to-elasticsearchdocumentstore/307894 "2022-06-22T14:51:03Z")

</div>

My goal is to write documents that I have from a csv file (around 700MB) but I received a BulkIndexError Here is my code: from haystack.document\_stores.elasticsearch import ElasticsearchDocumentStore document\_store = E…

---

## [Missing Fleet Default server policy](https://discuss.elastic.co/t/missing-fleet-default-server-policy/307874)

<div class="topic-metadata">

**Author:** [@ghostmomo](https://discuss.elastic.co/u/ghostmomo)\
**Replies:** 0\
**Last updated:** [June 22, 2022, 12:15pm UTC](https://discuss.elastic.co/t/missing-fleet-default-server-policy/307874 "2022-06-22T12:15:07Z")

</div>

Elastic version: 8.2.2 Kibana version: 8.2.2 OS: Windows server 2019 on Azure I am trying to setup the fleet server but encounter some issue while setting it up. After I generated the service token and attempted to u…

---

## [How to identify and remove duplicates in Elasticsearch index](https://discuss.elastic.co/t/how-to-identify-and-remove-duplicates-in-elasticsearch-index/307866)

<div class="topic-metadata">

**Author:** [@Sowmya1](https://discuss.elastic.co/u/Sowmya1)\
**Replies:** 3\
**Last updated:** [June 22, 2022, 1:35pm UTC](https://discuss.elastic.co/t/how-to-identify-and-remove-duplicates-in-elasticsearch-index/307866 "2022-06-22T13:35:56Z")

</div>

we are using elasticsearch 7.11.1 recently we observed an issue and below are the points for it. we store data for every 15 mins interval and we get time stamp from our input file (ex: 05:00, 23:15, 20:30, 11:45 ) rece…

---

## [ElasticSearch as primary DB for document library](https://discuss.elastic.co/t/elasticsearch-as-primary-db-for-document-library/307852)

<div class="topic-metadata">

**Author:** [@Gresmir](https://discuss.elastic.co/u/Gresmir)\
**Replies:** 2\
**Last updated:** [June 22, 2022, 12:05pm UTC](https://discuss.elastic.co/t/elasticsearch-as-primary-db-for-document-library/307852 "2022-06-22T12:05:47Z")

</div>

My task is a full-text search system for a really large amount of documents (tens of millions). Now I have documents as RTF file and their metadata, so all this will be indexed in Elasticsearch. These documents are uncha…

---

## [The CPU load increases, the CPU utilization decreases, and the Version Map continues to decrease for 30 hours](https://discuss.elastic.co/t/the-cpu-load-increases-the-cpu-utilization-decreases-and-the-version-map-continues-to-decrease-for-30-hours/307618)

<div class="topic-metadata">

**Author:** [@yanha186036](https://discuss.elastic.co/u/yanha186036)\
**Replies:** 1\
**Last updated:** [June 22, 2022, 12:03pm UTC](https://discuss.elastic.co/t/the-cpu-load-increases-the-cpu-utilization-decreases-and-the-version-map-continues-to-decrease-for-30-hours/307618 "2022-06-22T12:03:57Z")

</div>

question1：Why are indicators suddenly like this？ java code ex：Exception message failed to refresh index: user\_rank\_total question2：Why is the sharding uneven? node3 is not sharded

---

## [Return multiple parent documents for each nested object match](https://discuss.elastic.co/t/return-multiple-parent-documents-for-each-nested-object-match/307873)

<div class="topic-metadata">

**Author:** [@dgurusam](https://discuss.elastic.co/u/dgurusam)\
**Replies:** 0\
**Last updated:** [June 22, 2022, 11:59am UTC](https://discuss.elastic.co/t/return-multiple-parent-documents-for-each-nested-object-match/307873 "2022-06-22T11:59:52Z")

</div>

Hi All, I have an index which contains a nested object. I would like to return multiple parent documents for each object matched in the nested object. For example: Index Details: "settings": { "number\_of\_sha…

---

## [Filebeat made my disk full in less than one day](https://discuss.elastic.co/t/filebeat-made-my-disk-full-in-less-than-one-day/307856)

<div class="topic-metadata">

**Author:** [@Khalifa\_Khalifi](https://discuss.elastic.co/u/Khalifa_Khalifi)\
**Replies:** 1\
**Last updated:** [June 22, 2022, 11:58am UTC](https://discuss.elastic.co/t/filebeat-made-my-disk-full-in-less-than-one-day/307856 "2022-06-22T11:58:21Z")

</div>

Using filebeat made my disk full in less than one day!!! Is there any config I could apply to filebeat.yml to avoid this please? Using this tool is really dangerous. Prod servers are suddenly full for no reason.

---

## [Conditionally Apply Attachment Processor](https://discuss.elastic.co/t/conditionally-apply-attachment-processor/307867)

<div class="topic-metadata">

**Author:** [@jasmoon](https://discuss.elastic.co/u/jasmoon)\
**Replies:** 0\
**Last updated:** [June 22, 2022, 10:43am UTC](https://discuss.elastic.co/t/conditionally-apply-attachment-processor/307867 "2022-06-22T10:43:39Z")

</div>

Hi all, first time posting in this forum. I have trouble writing the condition to apply the attachment processor. Below is the wrong configuration of the pipeline: PUT \_ingest/pipeline/attachment { "description" : "Ex…

---

## [@elastic/elasticsearch](https://discuss.elastic.co/t/elastic-elasticsearch/307829)

<div class="topic-metadata">

**Author:** [@Rajan\_Devkota](https://discuss.elastic.co/u/Rajan_Devkota)\
**Replies:** 2\
**Last updated:** [June 22, 2022, 10:16am UTC](https://discuss.elastic.co/t/elastic-elasticsearch/307829 "2022-06-22T10:16:30Z")

</div>

Hello everyone. I am using elasticsearch client(@elastic/elasticsearch) version 7.13.0 and my elasticsearch server version is 7.10.0. And I am using typescript and node js in my backend. While using the elasticsearch c…

---

## [Snapshots on datastream](https://discuss.elastic.co/t/snapshots-on-datastream/306779)

<div class="topic-metadata">

**Author:** [@Bilanda](https://discuss.elastic.co/u/Bilanda)\
**Replies:** 2\
**Last updated:** [June 22, 2022, 9:46am UTC](https://discuss.elastic.co/t/snapshots-on-datastream/306779 "2022-06-22T09:46:48Z")

</div>

Hello, I recently decided to moove from traditionals index to datastream. Everything goes fine, template and ILM are working fine, my backing index (.ds-logs......) are daily rotated. I've just got two issues with dat…

---

## [How to identify and remove duplicates in Elasticsearch index](https://discuss.elastic.co/t/how-to-identify-and-remove-duplicates-in-elasticsearch-index/307842)

<div class="topic-metadata">

**Author:** [@Komal\_42](https://discuss.elastic.co/u/Komal_42)\
**Replies:** 2\
**Last updated:** [June 22, 2022, 9:38am UTC](https://discuss.elastic.co/t/how-to-identify-and-remove-duplicates-in-elasticsearch-index/307842 "2022-06-22T09:38:51Z")

</div>

we are using elasticsearch 7.11.1 recently we observed an issue and below are the points for it. we store data for every 15 mins interval and we get time stamp from our input file (ex: 05:00, 23:15, 20:30, 11:45 ) rece…

---

## [Llegal\_argument\_exception: index.lifecycle.rollover\_alias \[syslog\] does not point to index \[syslog-2022-06-22\]](https://discuss.elastic.co/t/llegal-argument-exception-index-lifecycle-rollover-alias-syslog-does-not-point-to-index-syslog-2022-06-22/307857)

<div class="topic-metadata">

**Author:** [@Lucy\_S](https://discuss.elastic.co/u/Lucy_S)\
**Replies:** 0\
**Last updated:** [June 22, 2022, 9:24am UTC](https://discuss.elastic.co/t/llegal-argument-exception-index-lifecycle-rollover-alias-syslog-does-not-point-to-index-syslog-2022-06-22/307857 "2022-06-22T09:24:34Z")

</div>

Hi all, i got this message on all index llegal\_argument\_exception: index.lifecycle.rollover\_alias \[syslog\] does not point to index \[syslog-2022-06-22\] configs: curl -X POST "localhost:5601/api/index\_patterns/index\_…

---

## [Exception in thread "main" java.lang.NoClassDefFoundError](https://discuss.elastic.co/t/exception-in-thread-main-java-lang-noclassdeffounderror/307246)

<div class="topic-metadata">

**Author:** [@Ashutosh](https://discuss.elastic.co/u/Ashutosh)\
**Replies:** 2\
**Last updated:** [June 22, 2022, 8:08am UTC](https://discuss.elastic.co/t/exception-in-thread-main-java-lang-noclassdeffounderror/307246 "2022-06-22T08:08:44Z")

</div>

Hi Team, I am a beginner in Elasticsearch. We have a wazuh cluster running which use Elasticsearch for storing alerts. Since few days, the Elasticsearch is not starting at al. Whenever we try to use "systemctl start ela…

---

## [Index Policy not taking effect on the specified indexes](https://discuss.elastic.co/t/index-policy-not-taking-effect-on-the-specified-indexes/307796)

<div class="topic-metadata">

**Author:** [@Yashwant\_Shettigar](https://discuss.elastic.co/u/Yashwant_Shettigar)\
**Replies:** 5\
**Last updated:** [June 22, 2022, 6:04am UTC](https://discuss.elastic.co/t/index-policy-not-taking-effect-on-the-specified-indexes/307796 "2022-06-22T06:04:09Z")

</div>

Hey Guys, I tried applying default 90\_days\_log\_retention policy to my monitoring-es indexes, but it gets deleted after the 7th day. Not sure where it went wrong. This is settings as per ILM policy for 90 days : { "…

---

## [While connecting elasticSearch Getting this Exception through java api](https://discuss.elastic.co/t/while-connecting-elasticsearch-getting-this-exception-through-java-api/307764)

<div class="topic-metadata">

**Author:** [@Udayaprakash\_S\_10d](https://discuss.elastic.co/u/Udayaprakash_S_10d)\
**Replies:** 5\
**Last updated:** [June 22, 2022, 2:24am UTC](https://discuss.elastic.co/t/while-connecting-elasticsearch-getting-this-exception-through-java-api/307764 "2022-06-22T02:24:12Z")

</div>

SLF4J: Failed toString() invocation on an object of type \[org.elasticsearch.search.builder.SearchSourceBuilder\] Reported exception: java.lang.NullPointerException at org.elasticsearch.index.query.BoolQueryBuilder.doXArr…

---

## [Middleware Logic Layer](https://discuss.elastic.co/t/middleware-logic-layer/307817)

<div class="topic-metadata">

**Author:** [@randomusername001](https://discuss.elastic.co/u/randomusername001)\
**Replies:** 0\
**Last updated:** [June 22, 2022, 1:15am UTC](https://discuss.elastic.co/t/middleware-logic-layer/307817 "2022-06-22T01:15:45Z")

</div>

Hi All, Apologies if this is the wrong section to be posting in. Hoping to get some advice / insights if there is anything available in market to use for our use case. We have an ELK cluster that is running our site se…

---

## [How do I host an Elasticsearch server on a local machine and allow other machines to access that data?](https://discuss.elastic.co/t/how-do-i-host-an-elasticsearch-server-on-a-local-machine-and-allow-other-machines-to-access-that-data/307766)

<div class="topic-metadata">

**Author:** [@DataStorageMuse](https://discuss.elastic.co/u/DataStorageMuse)\
**Replies:** 18\
**Last updated:** [June 21, 2022, 11:42pm UTC](https://discuss.elastic.co/t/how-do-i-host-an-elasticsearch-server-on-a-local-machine-and-allow-other-machines-to-access-that-data/307766 "2022-06-21T23:42:59Z")

</div>

I have an Elasticsearch server running on a local machine with an ip address: {local\_machine\_ip}. I have another computer that has an ip {client\_ip}. How do I allow the client computer to access the Elasticsearch server …

---

## [Painless scipt](https://discuss.elastic.co/t/painless-scipt/307524)

<div class="topic-metadata">

**Author:** [@Soren\_vdc](https://discuss.elastic.co/u/Soren_vdc)\
**Replies:** 1\
**Last updated:** [June 21, 2022, 11:19pm UTC](https://discuss.elastic.co/t/painless-scipt/307524 "2022-06-21T23:19:10Z")

</div>

Hi, I have query with aggregation and as result I receive the buckets with the "key" and "doc\_count". I want to send mail for each bucket that is find in the output. I have this: "transform": { "script": { …

---

## [Export huge amount of data converted to csv format](https://discuss.elastic.co/t/export-huge-amount-of-data-converted-to-csv-format/307779)

<div class="topic-metadata">

**Author:** [@Tony79](https://discuss.elastic.co/u/Tony79)\
**Replies:** 1\
**Last updated:** [June 21, 2022, 10:28pm UTC](https://discuss.elastic.co/t/export-huge-amount-of-data-converted-to-csv-format/307779 "2022-06-21T22:28:04Z")

</div>

Hi, I want to export a huge amount of structured data to a csv formatted file. What is the most "production friendly" way to do this? I'm thinking of running elasticdump from a system with enough disk but I'm not sure…

---

## [ALLOCATION\_FAILED needed explain Elastic 8.1.1](https://discuss.elastic.co/t/allocation-failed-needed-explain-elastic-8-1-1/307778)

<div class="topic-metadata">

**Author:** [@INS](https://discuss.elastic.co/u/INS)\
**Replies:** 2\
**Last updated:** [June 21, 2022, 10:25pm UTC](https://discuss.elastic.co/t/allocation-failed-needed-explain-elastic-8-1-1/307778 "2022-06-21T22:25:16Z")

</div>

Hi I'm facing with ALLOCATION\_FAILED, and I want to know what was the reason. My cluster consists with 51 node on 3 hosts under docker swarm, and I have also configured data tier. Can You explain how I can recover throu…

---

## [How do I publish Elasticsearch cluster run on a remote machine (via its public IP address) and access it from another machine with Python Client?](https://discuss.elastic.co/t/how-do-i-publish-elasticsearch-cluster-run-on-a-remote-machine-via-its-public-ip-address-and-access-it-from-another-machine-with-python-client/307798)

<div class="topic-metadata">

**Author:** [@DataStorageMuse](https://discuss.elastic.co/u/DataStorageMuse)\
**Replies:** 1\
**Last updated:** [June 21, 2022, 10:18pm UTC](https://discuss.elastic.co/t/how-do-i-publish-elasticsearch-cluster-run-on-a-remote-machine-via-its-public-ip-address-and-access-it-from-another-machine-with-python-client/307798 "2022-06-21T22:18:21Z")

</div>

Hi, I was wondering if anyone could give me concrete instructions (or point me to where in the documentation there are specific instructions) for publishing an Elasticsearch cluster on the host machine (via the public IP…

---

## [Is there a way to efficiently get three layer aggrigations result in elasticsearch, where each layer is conditioned by above one](https://discuss.elastic.co/t/is-there-a-way-to-efficiently-get-three-layer-aggrigations-result-in-elasticsearch-where-each-layer-is-conditioned-by-above-one/307788)

<div class="topic-metadata">

**Author:** [@Robin\_Rawat](https://discuss.elastic.co/u/Robin_Rawat)\
**Replies:** 0\
**Last updated:** [June 21, 2022, 5:35pm UTC](https://discuss.elastic.co/t/is-there-a-way-to-efficiently-get-three-layer-aggrigations-result-in-elasticsearch-where-each-layer-is-conditioned-by-above-one/307788 "2022-06-21T17:35:41Z")

</div>

I am trying to get composite aggregation for certain feilds which are present in each document. These documents are stored in elastic. Format of each document is a json with below mentioned keys. {"id","name","topic","bu…

---

## [Unnasigned shards for replica](https://discuss.elastic.co/t/unnasigned-shards-for-replica/307792)

<div class="topic-metadata">

**Author:** [@INS](https://discuss.elastic.co/u/INS)\
**Replies:** 1\
**Last updated:** [June 21, 2022, 7:43pm UTC](https://discuss.elastic.co/t/unnasigned-shards-for-replica/307792 "2022-06-21T19:43:15Z")

</div>

Hi How can I reassign (UNASSIGNED) shards for replica ? logstash-prod1-2022.06.21 3 p STARTED 2833524 es\_data\_ssd\_5\_1 logstash-prod1-2022.06.21 3 r UNASSIGNED I have tried through below req: POS…

---

## [Getting slow logs on kibana with an hour delay time](https://discuss.elastic.co/t/getting-slow-logs-on-kibana-with-an-hour-delay-time/307645)

<div class="topic-metadata">

**Author:** [@Milad\_Akhlaghi](https://discuss.elastic.co/u/Milad_Akhlaghi)\
**Replies:** 6\
**Last updated:** [June 21, 2022, 6:06pm UTC](https://discuss.elastic.co/t/getting-slow-logs-on-kibana-with-an-hour-delay-time/307645 "2022-06-21T18:06:34Z")

</div>

Hi friends, i have elk cluster that includes: 20 filebeats , 6 logstash, 9 elasticsearches and 2 kibanas Elasticsearch node roles are : 3 x \[ data\_hot, data\_content \] 3 x \[ data\_warm, ingest, master \] 1x \[ master \] …

---

## [c.a.a.p.i.BasicProfileConfigFileLoader noise](https://discuss.elastic.co/t/c-a-a-p-i-basicprofileconfigfileloader-noise/307630)

<div class="topic-metadata">

**Author:** [@Anarhyst266](https://discuss.elastic.co/u/Anarhyst266)\
**Replies:** 6\
**Last updated:** [June 21, 2022, 5:55pm UTC](https://discuss.elastic.co/t/c-a-a-p-i-basicprofileconfigfileloader-noise/307630 "2022-06-21T17:55:38Z")

</div>

When I'm trying to set logger.level to warn in my ES 8.1.3(also checked on 8.2.3) I've got the noise WARN message "message":"Unable to load config file null", "ecs.version": "1.2.0","service.name":"ES\_ECS","event.datase…

---

## [Prefix Queries Using NEST API](https://discuss.elastic.co/t/prefix-queries-using-nest-api/307590)

<div class="topic-metadata">

**Author:** [@xef](https://discuss.elastic.co/u/xef)\
**Replies:** 2\
**Last updated:** [June 21, 2022, 4:00pm UTC](https://discuss.elastic.co/t/prefix-queries-using-nest-api/307590 "2022-06-21T16:00:30Z")

</div>

Is there any way to analyze the prefix text as the same analyzer used in the indexing. For example : var searchResponse = await client.SearchAsync\<Locality\>(s =\> s.Index($"localities-{country.ToLower()}") …

---

## [Huge memory usage because of SnapshotShardFailure error objects on master node](https://discuss.elastic.co/t/huge-memory-usage-because-of-snapshotshardfailure-error-objects-on-master-node/307761)

<div class="topic-metadata">

**Author:** [@Vivek\_Singh1](https://discuss.elastic.co/u/Vivek_Singh1)\
**Replies:** 5\
**Last updated:** [June 21, 2022, 3:49pm UTC](https://discuss.elastic.co/t/huge-memory-usage-because-of-snapshotshardfailure-error-objects-on-master-node/307761 "2022-06-21T15:49:11Z")

</div>

We are seeing a considerable memory consumption on master nodes. ES Version: 6.5.4 The number of shards is close to 45k. The number of data nodes is 9. The memory on data nodes is 32GB, and the ES Heap size is 18GB. …

---

## [Master not discovered yet](https://discuss.elastic.co/t/master-not-discovered-yet/307752)

<div class="topic-metadata">

**Author:** [@tamis-laan](https://discuss.elastic.co/u/tamis-laan)\
**Replies:** 13\
**Last updated:** [June 21, 2022, 2:41pm UTC](https://discuss.elastic.co/t/master-not-discovered-yet/307752 "2022-06-21T14:41:09Z")

</div>

I'm trying to build a docker swarm elasticsearch cluster and I have the following compose file: elastic: # image: elasticsearch:7.14.1 image: elasticsearch:7.6.2 hostname: elastic.{{.Task.Slot}} enviro…

---

## [How do we recover from corruption in transaction log file?](https://discuss.elastic.co/t/how-do-we-recover-from-corruption-in-transaction-log-file/307379)

<div class="topic-metadata">

**Author:** [@EVINDX](https://discuss.elastic.co/u/EVINDX)\
**Replies:** 3\
**Last updated:** [June 21, 2022, 2:01pm UTC](https://discuss.elastic.co/t/how-do-we-recover-from-corruption-in-transaction-log-file/307379 "2022-06-21T14:01:51Z")

</div>

There has been corruption of transaction log in the environment due to which the indices are in red. Because of which we are unable to move forward with indexing new items and the backlog for the items to index keep incr…

[Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=419)

[Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=421)
