# Elasticsearch

**URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=430

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 431

---

## [ES master only works and 2 other nodes get empty cluster id](https://discuss.elastic.co/t/es-master-only-works-and-2-other-nodes-get-empty-cluster-id/305827)

<div class="topic-metadata">

**Author:** [@rockers](https://discuss.elastic.co/u/rockers)\
**Replies:** 4\
**Last updated:** [June 4, 2022, 11:50am UTC](https://discuss.elastic.co/t/es-master-only-works-and-2-other-nodes-get-empty-cluster-id/305827 "2022-06-04T11:50:53Z")

</div>

i created 3 ES machines in virtualbox 1 master1 1 data1 1 data2 my master01 only get cluster\_uuid two other nodes failed "cluster\_uuid": "\_na\_"" master cluster.name: mycluster node.name: master1 path.data: /var/li…

---

## [How to remove discovery.zen.ping.unicasts completely](https://discuss.elastic.co/t/how-to-remove-discovery-zen-ping-unicasts-completely/306344)

<div class="topic-metadata">

**Author:** [@garry12](https://discuss.elastic.co/u/garry12)\
**Replies:** 2\
**Last updated:** [June 4, 2022, 10:11am UTC](https://discuss.elastic.co/t/how-to-remove-discovery-zen-ping-unicasts-completely/306344 "2022-06-04T10:11:08Z")

</div>

I am running a Elasticsearch 7.2 version and I had a property defined in my Elasticsearch.yml file that is - discovery.zen.ping.unicast.hosts: \[IP1, IP2....\] but obviously when I read the documentation I see that this d…

---

## [Unable to authenticate user after password creation](https://discuss.elastic.co/t/unable-to-authenticate-user-after-password-creation/306359)

<div class="topic-metadata">

**Author:** [@dorinand](https://discuss.elastic.co/u/dorinand)\
**Replies:** 2\
**Last updated:** [June 4, 2022, 8:39am UTC](https://discuss.elastic.co/t/unable-to-authenticate-user-after-password-creation/306359 "2022-06-04T08:39:48Z")

</div>

I have created Elasticsearch built-in users password with: bin/elasticsearch-setup-passwords interactive I set for every user password asdfasdf. All successfuly: Initiating the setup of passwords for reserved users el…

---

## ["Empty client certificate chain" error stops inter-node handshake using wildcard certs](https://discuss.elastic.co/t/empty-client-certificate-chain-error-stops-inter-node-handshake-using-wildcard-certs/306278)

<div class="topic-metadata">

**Author:** [@Anil\_Kumar\_2003](https://discuss.elastic.co/u/Anil_Kumar_2003)\
**Replies:** 1\
**Last updated:** [June 4, 2022, 6:02am UTC](https://discuss.elastic.co/t/empty-client-certificate-chain-error-stops-inter-node-handshake-using-wildcard-certs/306278 "2022-06-04T06:02:58Z")

</div>

Hi Team, I need help securing ES inter-node communication. Environment Details: ES version: 7.14.1, cluster with 2 nodes (reduced size to get to the root cause) Java: openjdk-16.0.2 OS: Ubuntu 20.02 JVM options: al…

---

## [Not able to run elasticsearch after installing tls demo certificate(search guard)](https://discuss.elastic.co/t/not-able-to-run-elasticsearch-after-installing-tls-demo-certificate-search-guard/306335)

<div class="topic-metadata">

**Author:** [@jisha](https://discuss.elastic.co/u/jisha)\
**Replies:** 1\
**Last updated:** [June 3, 2022, 9:23pm UTC](https://discuss.elastic.co/t/not-able-to-run-elasticsearch-after-installing-tls-demo-certificate-search-guard/306335 "2022-06-03T21:23:50Z")

</div>

i have metioned the error code below: \[2022-06-03T13:18:26,086\]\[WARN \]\[o.e.d.PeerFinder \] \[node-2\] address \[1.xx.xx9.xxx:9xx\], node \[null\], requesting \[false\] connection failed: \[1.xx.xx9.xxx:9xx\] general node connectio…

---

## [Where can I access the logs sent to Elasticsearch?](https://discuss.elastic.co/t/where-can-i-access-the-logs-sent-to-elasticsearch/306259)

<div class="topic-metadata">

**Author:** [@BenGur](https://discuss.elastic.co/u/BenGur)\
**Replies:** 3\
**Last updated:** [June 3, 2022, 6:35pm UTC](https://discuss.elastic.co/t/where-can-i-access-the-logs-sent-to-elasticsearch/306259 "2022-06-03T18:35:00Z")

</div>

Hello, I am trying to access the log files sent to Elasticsearch outside of the Kibana browser but don't know where to find them. I am running Elasticsearch on a remote CentOS 7 server with another AWS CentOS 7 server …

---

## [Out of the Box ML jobs for Security](https://discuss.elastic.co/t/out-of-the-box-ml-jobs-for-security/305162)

<div class="topic-metadata">

**Author:** [@alaine](https://discuss.elastic.co/u/alaine)\
**Replies:** 3\
**Last updated:** [June 3, 2022, 3:41pm UTC](https://discuss.elastic.co/t/out-of-the-box-ml-jobs-for-security/305162 "2022-06-03T15:41:42Z")

</div>

Good Morning, I am looking for help/advice in regards to using the out of the box ML jobs. Specifically, some of the jobs that are underlying SIEM detections. I have an environment with 4500 hosts sending endpoint data …

---

## [Rally 7.9.2 is not supported?](https://discuss.elastic.co/t/rally-7-9-2-is-not-supported/306331)

<div class="topic-metadata">

**Author:** [@Gsqsf](https://discuss.elastic.co/u/Gsqsf)\
**Replies:** 9\
**Last updated:** [June 3, 2022, 2:40pm UTC](https://discuss.elastic.co/t/rally-7-9-2-is-not-supported/306331 "2022-06-03T14:40:13Z")

</div>

Elasticsearch.exceptions.UnsupportedProductError: The client noticed that the server is not a supported distribution of Elasticsearch The Elasticsearch server version is 7.9.2. Tagline is "You Know, for Search" build\_…

---

## [Looking to get only the latest records from the index](https://discuss.elastic.co/t/looking-to-get-only-the-latest-records-from-the-index/306205)

<div class="topic-metadata">

**Author:** [@Mohamed\_Naufal](https://discuss.elastic.co/u/Mohamed_Naufal)\
**Replies:** 7\
**Last updated:** [June 3, 2022, 2:02pm UTC](https://discuss.elastic.co/t/looking-to-get-only-the-latest-records-from-the-index/306205 "2022-06-03T14:02:17Z")

</div>

Hi Community, I'm currently working on Elasticsearch and looking for an option to retrieve only the latest records from the index. Let me break down this query, We're using AWS Data Stream to load the logs and then, i…

---

## [Lucene (Or KQL) query to filter current day of week](https://discuss.elastic.co/t/lucene-or-kql-query-to-filter-current-day-of-week/306339)

<div class="topic-metadata">

**Author:** [@vincent2mots](https://discuss.elastic.co/u/vincent2mots)\
**Replies:** 0\
**Last updated:** [June 3, 2022, 1:06pm UTC](https://discuss.elastic.co/t/lucene-or-kql-query-to-filter-current-day-of-week/306339 "2022-06-03T13:06:38Z")

</div>

Hi there! I have some data on Elasticsearch with a datetime field. I would like to filter all the data where the dayofweek is the same as today's... this way, I would be able to get all friday's data, saturday's data, …

---

## [Elastic search restore](https://discuss.elastic.co/t/elastic-search-restore/306329)

<div class="topic-metadata">

**Author:** [@A\_j\_xx](https://discuss.elastic.co/u/A_j_xx)\
**Replies:** 4\
**Last updated:** [June 3, 2022, 1:00pm UTC](https://discuss.elastic.co/t/elastic-search-restore/306329 "2022-06-03T13:00:59Z")

</div>

Hi , I am new at Elasticsearch and have some doubts regarding restore , as the documentation is not very thorough on these points . Let us say i make some changes every time to my index and take a snapshot , now the n…

---

## [How to make nodes forget about the old/previous cluster?](https://discuss.elastic.co/t/how-to-make-nodes-forget-about-the-old-previous-cluster/306315)

<div class="topic-metadata">

**Author:** [@AS11](https://discuss.elastic.co/u/AS11)\
**Replies:** 3\
**Last updated:** [June 3, 2022, 12:04pm UTC](https://discuss.elastic.co/t/how-to-make-nodes-forget-about-the-old-previous-cluster/306315 "2022-06-03T12:04:49Z")

</div>

I had (and still have) a running 3-node cluster C1. C1 has all 3 nodes (es0,es1,es2) as master nodes. Then, accessible within the same network, I wanted to set up a second cluster C2 (nodes es3,es4,es5), to which I would…

---

## [ML - Anomaly Detection - Weight Rare against Entity AND Population](https://discuss.elastic.co/t/ml-anomaly-detection-weight-rare-against-entity-and-population/306273)

<div class="topic-metadata">

**Author:** [@BenB196](https://discuss.elastic.co/u/BenB196)\
**Replies:** 1\
**Last updated:** [June 3, 2022, 11:08am UTC](https://discuss.elastic.co/t/ml-anomaly-detection-weight-rare-against-entity-and-population/306273 "2022-06-03T11:08:21Z")

</div>

Hi All, I'm attempting to find a way to find anomalies within some data, but I'm having some trouble understanding the correct way to go about it. I want to effectively determine the weight of an anomaly by comparing t…

---

## [Vietnamese support](https://discuss.elastic.co/t/vietnamese-support/305037)

<div class="topic-metadata">

**Author:** [@Jean-Marc\_Autexier](https://discuss.elastic.co/u/Jean-Marc_Autexier)\
**Replies:** 2\
**Last updated:** [June 3, 2022, 10:50am UTC](https://discuss.elastic.co/t/vietnamese-support/305037 "2022-06-03T10:50:49Z")

</div>

Hi, the documentation \[1\] does mention the Vietnamese analysis plugin: I already do use the ICU plugin \[2\] for multi language support. How much better is the Vietnamese Plugin compared to ICU for Vietnamese language? …

---

## [Elastic agent indices - ILM Policy Changes](https://discuss.elastic.co/t/elastic-agent-indices-ilm-policy-changes/306320)

<div class="topic-metadata">

**Author:** [@praveen\_raju](https://discuss.elastic.co/u/praveen_raju)\
**Replies:** 0\
**Last updated:** [June 3, 2022, 10:03am UTC](https://discuss.elastic.co/t/elastic-agent-indices-ilm-policy-changes/306320 "2022-06-03T10:03:20Z")

</div>

Hello, We have deployed Elastic Agent on 1000+ VM's, i see default ILM policy is being used "metrics" for all the indices created by the elastic agent. Questions: Can we change the settings directly on the ILM polic…

---

## [Taxonmy in ES 7.10 using search-time analyzer](https://discuss.elastic.co/t/taxonmy-in-es-7-10-using-search-time-analyzer/306312)

<div class="topic-metadata">

**Author:** [@wardyard](https://discuss.elastic.co/u/wardyard)\
**Replies:** 0\
**Last updated:** [June 3, 2022, 9:31am UTC](https://discuss.elastic.co/t/taxonmy-in-es-7-10-using-search-time-analyzer/306312 "2022-06-03T09:31:32Z")

</div>

Hi all! Since I've been struggling with this for quite a while now, I decided to try my luck here :wink: I'm working on a taxonomy search using managed vocabularies, as described in this article: Patterns for Elasticse…

---

## [Licence Upgrade: From Gold to Platinum](https://discuss.elastic.co/t/licence-upgrade-from-gold-to-platinum/306183)

<div class="topic-metadata">

**Author:** [@smm](https://discuss.elastic.co/u/smm)\
**Replies:** 3\
**Last updated:** [June 3, 2022, 8:47am UTC](https://discuss.elastic.co/t/licence-upgrade-from-gold-to-platinum/306183 "2022-06-03T08:47:54Z")

</div>

Hi there, are there any issues to be excted while upgrading out licence from gold to platinum? Thanks and kind regards!

---

## [Unassigned shards after upgrade to 8.2](https://discuss.elastic.co/t/unassigned-shards-after-upgrade-to-8-2/304717)

<div class="topic-metadata">

**Author:** [@Ian\_Simpson](https://discuss.elastic.co/u/Ian_Simpson)\
**Replies:** 6\
**Last updated:** [June 3, 2022, 8:09am UTC](https://discuss.elastic.co/t/unassigned-shards-after-upgrade-to-8-2/304717 "2022-06-03T08:09:45Z")

</div>

I am managing an Elasticsearch cluster deployed to our Azure environment. I am trying to upgrade our test single-node cluster from 7.x to 8.2. I have done the following: Upgraded to 7.17.3 and confirmed all shards were…

---

## [Store max value of a metric in a week in elasticsearch](https://discuss.elastic.co/t/store-max-value-of-a-metric-in-a-week-in-elasticsearch/306209)

<div class="topic-metadata">

**Author:** [@S-elk](https://discuss.elastic.co/u/S-elk)\
**Replies:** 2\
**Last updated:** [June 3, 2022, 7:36am UTC](https://discuss.elastic.co/t/store-max-value-of-a-metric-in-a-week-in-elasticsearch/306209 "2022-06-03T07:36:41Z")

</div>

Hello! I am currently collecting the metrics of certain services and I am interested in storing the maximum value of a week. I know how to do it with the tsvb visualization but I don't know how to store it in the elasti…

---

## [Disable Replicate Data on Elasticsearch Cluster](https://discuss.elastic.co/t/disable-replicate-data-on-elasticsearch-cluster/306202)

<div class="topic-metadata">

**Author:** [@Xenial](https://discuss.elastic.co/u/Xenial)\
**Replies:** 4\
**Last updated:** [June 3, 2022, 7:34am UTC](https://discuss.elastic.co/t/disable-replicate-data-on-elasticsearch-cluster/306202 "2022-06-03T07:34:20Z")

</div>

Hello Elastic Team, I've create Elasticsearch with 3 node, when i send the data, Elasticsearch replicate my original data and consume more storage. How to disable replicated data on Elasticsearch Cluster? Thankyou

---

## [Migrate Elasticsearch Data](https://discuss.elastic.co/t/migrate-elasticsearch-data/306291)

<div class="topic-metadata">

**Author:** [@Xenial](https://discuss.elastic.co/u/Xenial)\
**Replies:** 1\
**Last updated:** [June 3, 2022, 7:04am UTC](https://discuss.elastic.co/t/migrate-elasticsearch-data/306291 "2022-06-03T07:04:56Z")

</div>

Hello Elastic Team, I've migrate elastic data from old elastic to new elastic, Data from old index have 90.000.000 Data, but after data migrated, total data in new index just 846.000. Please Help Me, Thankyou

---

## [Logstash won't create new index patterns again](https://discuss.elastic.co/t/logstash-wont-create-new-index-patterns-again/306224)

<div class="topic-metadata">

**Author:** [@Tasdiq\_Shaikh](https://discuss.elastic.co/u/Tasdiq_Shaikh)\
**Replies:** 2\
**Last updated:** [June 3, 2022, 7:00am UTC](https://discuss.elastic.co/t/logstash-wont-create-new-index-patterns-again/306224 "2022-06-03T07:00:07Z")

</div>

Previously, I have connected my logstash with PostgreSQL and Elasticsearch and it also created new index pattern, but it wouldnt load data properly so I deleted my index and restarted logstash to create a new index patte…

---

## [Limit JVM heap](https://discuss.elastic.co/t/limit-jvm-heap/305920)

<div class="topic-metadata">

**Author:** [@gerardgorrion](https://discuss.elastic.co/u/gerardgorrion)\
**Replies:** 13\
**Last updated:** [June 3, 2022, 6:12am UTC](https://discuss.elastic.co/t/limit-jvm-heap/305920 "2022-06-03T06:12:26Z")

</div>

Good morning, We have a issue with the limit of JVM heap. Our Elasticsearch data nodes have a data, ingest and master role, and the node that allow it have 32gb of memory and 8 cpu. Our configuration of resources on dat…

---

## [Documents size vs. indexing size?](https://discuss.elastic.co/t/documents-size-vs-indexing-size/306255)

<div class="topic-metadata">

**Author:** [@Denis\_Haskin](https://discuss.elastic.co/u/Denis_Haskin)\
**Replies:** 1\
**Last updated:** [June 2, 2022, 7:39pm UTC](https://discuss.elastic.co/t/documents-size-vs-indexing-size/306255 "2022-06-02T19:39:56Z")

</div>

We have an existing Kibana/Elastic setup ingesting logs from our infrastructure. I'm trying to determine what the actual documents size is, e.g. I want to exclude indices. Basically, what is the volume of logs coming o…

---

## [Architecture to use dynamic document read permition](https://discuss.elastic.co/t/architecture-to-use-dynamic-document-read-permition/306269)

<div class="topic-metadata">

**Author:** [@jodinathan](https://discuss.elastic.co/u/jodinathan)\
**Replies:** 1\
**Last updated:** [June 2, 2022, 10:39pm UTC](https://discuss.elastic.co/t/architecture-to-use-dynamic-document-read-permition/306269 "2022-06-02T22:39:26Z")

</div>

We need to enable our customers to access our Kibana to create sales reports, however, the sale documents they can read can change over time. Each customer would have their own user in Kibana and a sale document can be …

---

## [How to filter aggregated data on the nested object](https://discuss.elastic.co/t/how-to-filter-aggregated-data-on-the-nested-object/306264)

<div class="topic-metadata">

**Author:** [@shri\_palchuri](https://discuss.elastic.co/u/shri_palchuri)\
**Replies:** 0\
**Last updated:** [June 2, 2022, 7:26pm UTC](https://discuss.elastic.co/t/how-to-filter-aggregated-data-on-the-nested-object/306264 "2022-06-02T19:26:39Z")

</div>

Here is the payload used to filter the data, holdings is a nested type and in the aggregation it includes non matched count. {"size":0,"query":{"bool":{"filter":\[{"bool":{"filter":\[{"bool":{"should":\[{"bool":{"filter":…

---

## [Time weighting after ANN search](https://discuss.elastic.co/t/time-weighting-after-ann-search/306022)

<div class="topic-metadata">

**Author:** [@lz-mn](https://discuss.elastic.co/u/lz-mn)\
**Replies:** 1\
**Last updated:** [June 2, 2022, 6:17pm UTC](https://discuss.elastic.co/t/time-weighting-after-ann-search/306022 "2022-06-02T18:17:31Z")

</div>

Hi, I'm trying to write a search query to: perform an ANN search on a dense vector field re-rank the returned documents to weight more recent documents higher, according to a custom exponential decay function applied t…

---

## [Elastic Endpoint: securing elasticsearch (port 9200) server public access from brute force attacks](https://discuss.elastic.co/t/elastic-endpoint-securing-elasticsearch-port-9200-server-public-access-from-brute-force-attacks/306043)

<div class="topic-metadata">

**Author:** [@raymondbagats](https://discuss.elastic.co/u/raymondbagats)\
**Replies:** 3\
**Last updated:** [June 2, 2022, 4:06pm UTC](https://discuss.elastic.co/t/elastic-endpoint-securing-elasticsearch-port-9200-server-public-access-from-brute-force-attacks/306043 "2022-06-02T16:06:30Z")

</div>

Hi team, My elastic stack is currently working and endpoint security is working and is being managed by fleet. I'm planning to expose port 8220 and 9200 so my mobile endpoints can search the server when outside the comp…

---

## [Multiple index search and PIT index ID reuse](https://discuss.elastic.co/t/multiple-index-search-and-pit-index-id-reuse/306247)

<div class="topic-metadata">

**Author:** [@mattsbennett](https://discuss.elastic.co/u/mattsbennett)\
**Replies:** 0\
**Last updated:** [June 2, 2022, 3:01pm UTC](https://discuss.elastic.co/t/multiple-index-search-and-pit-index-id-reuse/306247 "2022-06-02T15:01:14Z")

</div>

I’m planning to search multiple different sets of multiple indices at once. I’d also like to use search\_after with point-in-time indices for deep pagination. I’ve got some general questions about how/if PIT works in this…

---

## [When is Elasticsearch 8 coming to Homebrew on MacOS?](https://discuss.elastic.co/t/when-is-elasticsearch-8-coming-to-homebrew-on-macos/306227)

<div class="topic-metadata">

**Author:** [@pelmered](https://discuss.elastic.co/u/pelmered)\
**Replies:** 0\
**Last updated:** [June 2, 2022, 12:51pm UTC](https://discuss.elastic.co/t/when-is-elasticsearch-8-coming-to-homebrew-on-macos/306227 "2022-06-02T12:51:35Z")

</div>

When is Elasticsearch 8.\* coming to Homebrew on MacOS? Do I need to install from package to upgrade in the future?

[Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=429)

[Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=431)
