# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=456 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 457 --- ## [Index aliases is missing](https://discuss.elastic.co/t/index-aliases-is-missing/302483)
**Author:** [@wcpoon](https://discuss.elastic.co/u/wcpoon)\ **Replies:** 0\ **Last updated:** [April 15, 2022, 6:04am UTC](https://discuss.elastic.co/t/index-aliases-is-missing/302483 "2022-04-15T06:04:11Z")
Hi, My winlogbeat index aliases is empty, any idea why it is empty and how to include aliases in every new index? { "winlogbeat-8.1.2-2022.04.15" : { "aliases" : { }, "mappings" : { "\_meta" : { … --- ## [Count query over the date range doesn't return proper results](https://discuss.elastic.co/t/count-query-over-the-date-range-doesnt-return-proper-results/302476)
**Author:** [@stecino](https://discuss.elastic.co/u/stecino)\ **Replies:** 1\ **Last updated:** [April 15, 2022, 4:51am UTC](https://discuss.elastic.co/t/count-query-over-the-date-range-doesnt-return-proper-results/302476 "2022-04-15T04:51:56Z")
Executing following query curl -s -XGET http://blah:9200/kgacrm-2022.04.15/\_count?pretty=true {"query": {"range" : {"timestamp": { "gte" : "now-15m", "lt" : "now"}}}} { "count" : 1725, "\_shards" : { "total" : 5… --- ## [Elastic Agent and Tagging](https://discuss.elastic.co/t/elastic-agent-and-tagging/302165)
**Author:** [@MarcomPrintable](https://discuss.elastic.co/u/MarcomPrintable)\ **Replies:** 2\ **Last updated:** [April 14, 2022, 11:08pm UTC](https://discuss.elastic.co/t/elastic-agent-and-tagging/302165 "2022-04-14T23:08:58Z")
Greetings, I have an EC account and I have been really enjoying using the elastic agent. However, I am hitting a few rough spots. I am trying to tag in a general sense in the Elasticsearch output but I notice that -… --- ## [Facing issue in elastic search](https://discuss.elastic.co/t/facing-issue-in-elastic-search/302469)
**Author:** [@Hammadahmed](https://discuss.elastic.co/u/Hammadahmed)\ **Replies:** 3\ **Last updated:** [April 14, 2022, 8:31pm UTC](https://discuss.elastic.co/t/facing-issue-in-elastic-search/302469 "2022-04-14T20:31:23Z")
bin/Elasticsearch \[2022-04-15T00:47:44,478\]\[INFO \]\[o.e.n.Node \] \[ubuntu\] version\[8.1.2\], pid\[11981\], build\[default/tar/31df9689e80bad366ac20176aa7f2371ea5eb4c1/2022-03-29T21:18:59.991429448Z\], OS\[Linux/5.1… --- ## [Elasticsearch run error](https://discuss.elastic.co/t/elasticsearch-run-error/302370)
**Author:** [@dawiddudek](https://discuss.elastic.co/u/dawiddudek)\ **Replies:** 6\ **Last updated:** [April 14, 2022, 7:54pm UTC](https://discuss.elastic.co/t/elasticsearch-run-error/302370 "2022-04-14T19:54:58Z")
Hi, i tried install and run Elasticsearch but service is still failed. I try to run this on Ubuntu 20.04 LTS from apk, dpkg and archive. i found Elasticsearch: Job for elasticsearch.service failed - Stack Overflow but… --- ## [Spring4Shell ::Spring Framework Remote Code Execution Vulnerability for eck operator](https://discuss.elastic.co/t/spring4shell-spring-framework-remote-code-execution-vulnerability-for-eck-operator/302455)
**Author:** [@Sagarika\_Mahalik](https://discuss.elastic.co/u/Sagarika_Mahalik)\ **Replies:** 0\ **Last updated:** [April 14, 2022, 4:31pm UTC](https://discuss.elastic.co/t/spring4shell-spring-framework-remote-code-execution-vulnerability-for-eck-operator/302455 "2022-04-14T16:31:48Z")
Hello, We are using eck operator 1.9.1. I see the code for eck operator is written on go lang. So then is eck operator not affected any way by the reported spring shell vulnerability? Please suggest, whether we need t… --- ## [v8.X Docker image does not accept bin/elasticsearch env variables](https://discuss.elastic.co/t/v8-x-docker-image-does-not-accept-bin-elasticsearch-env-variables/302446)
**Author:** [@violetaria](https://discuss.elastic.co/u/violetaria)\ **Replies:** 2\ **Last updated:** [April 14, 2022, 4:56pm UTC](https://discuss.elastic.co/t/v8-x-docker-image-does-not-accept-bin-elasticsearch-env-variables/302446 "2022-04-14T16:56:31Z")
Using the existing docker image does not accept positional arguments for Elasticsearch environment variables correctly. The documentation states that we should be able to pass the arguments in with this command docker … --- ## [Extracting data between two phrases with GROK](https://discuss.elastic.co/t/extracting-data-between-two-phrases-with-grok/302269)
**Author:** [@ARDiver86](https://discuss.elastic.co/u/ARDiver86)\ **Replies:** 3\ **Last updated:** [April 14, 2022, 2:31pm UTC](https://discuss.elastic.co/t/extracting-data-between-two-phrases-with-grok/302269 "2022-04-14T14:31:27Z")
I'm trying to extract a powershell signature block from powershell scripts that are being ran in our environment. At the end of the powershell.file.script\_block\_text field there is sometimes a signature in this format: #… --- ## [Installation of ELK on Windows help](https://discuss.elastic.co/t/installation-of-elk-on-windows-help/302333)
**Author:** [@insurin](https://discuss.elastic.co/u/insurin)\ **Replies:** 5\ **Last updated:** [April 14, 2022, 1:39pm UTC](https://discuss.elastic.co/t/installation-of-elk-on-windows-help/302333 "2022-04-14T13:39:39Z")
Hi all, need some help with Windows install. Windows Server 2022, ELK 8.12. I am trying to install everything on the 1 box. Steps for far Installed Elasticsearch using Elasticsearch.bat. This creates the elastic passwo… --- ## [Snort with Elastic Cloud](https://discuss.elastic.co/t/snort-with-elastic-cloud/302436)
**Author:** [@kesako](https://discuss.elastic.co/u/kesako)\ **Replies:** 0\ **Last updated:** [April 14, 2022, 1:31pm UTC](https://discuss.elastic.co/t/snort-with-elastic-cloud/302436 "2022-04-14T13:31:19Z")
Hi, I'm trying to configure Snort to send his logs to Elastic cloud but the Snort integration doesn't work. What other way do I have to get those logs automatically ? Thanks Have a nice day --- ## [How to retrieve the number of matched terms?](https://discuss.elastic.co/t/how-to-retrieve-the-number-of-matched-terms/302430)
**Author:** [@Filip4D](https://discuss.elastic.co/u/Filip4D)\ **Replies:** 0\ **Last updated:** [April 14, 2022, 12:33pm UTC](https://discuss.elastic.co/t/how-to-retrieve-the-number-of-matched-terms/302430 "2022-04-14T12:33:57Z")
Hey everyone, is there a way to count the number of matching words in the results. I.e. if I have the following query, I'd like to know for the results set, how many of the words: african, american and male were matched … --- ## [QDSL Query: date\_histogram aggregating the results of a date\_histogram](https://discuss.elastic.co/t/qdsl-query-date-histogram-aggregating-the-results-of-a-date-histogram/302414)
**Author:** [@sebneu](https://discuss.elastic.co/u/sebneu)\ **Replies:** 0\ **Last updated:** [April 14, 2022, 9:29am UTC](https://discuss.elastic.co/t/qdsl-query-date-histogram-aggregating-the-results-of-a-date-histogram/302414 "2022-04-14T09:29:41Z")
Hi, I would like to stack two date-histograms, but I do not have a clue how to do it... Say, it's the traffic going through an interface and I want to receive the daily or hourly peaks of data in 60 minutes. For the p… --- ## [Elasticsearch immutable](https://discuss.elastic.co/t/elasticsearch-immutable/302413)
**Author:** [@111401](https://discuss.elastic.co/u/111401)\ **Replies:** 0\ **Last updated:** [April 14, 2022, 9:28am UTC](https://discuss.elastic.co/t/elasticsearch-immutable/302413 "2022-04-14T09:28:58Z")
Hi, I try to understand immutable in Elasticsearch, and read the article Updating API and Partial Update API , but still not clear about it. The article said Documents in Elasticsearch are immutable, but the Update API… --- ## [Doc count per day and avearge](https://discuss.elastic.co/t/doc-count-per-day-and-avearge/302317)
**Author:** [@meyer1](https://discuss.elastic.co/u/meyer1)\ **Replies:** 2\ **Last updated:** [April 14, 2022, 8:53am UTC](https://discuss.elastic.co/t/doc-count-per-day-and-avearge/302317 "2022-04-14T08:53:55Z")
hello everyone is it possible to get the number of documents that we have in our index per day? and then, after getting that (which I have already done) get the average of that, ie doc\_count per day. I aim to integrate… --- ## [Waiting on default policy with Fleet Server integration](https://discuss.elastic.co/t/waiting-on-default-policy-with-fleet-server-integration/302398)
**Author:** [@tirelibirefe](https://discuss.elastic.co/u/tirelibirefe)\ **Replies:** 2\ **Last updated:** [April 14, 2022, 8:12am UTC](https://discuss.elastic.co/t/waiting-on-default-policy-with-fleet-server-integration/302398 "2022-04-14T08:12:14Z")
Hello, I am not able to run fleet 8.2.2 on EKS Kubernetes. I am not able to find what I'm missing and need to your adises. Here is my config: apiVersion: agent.k8s.elastic.co/v1alpha1 kind: Agent metadata: name: $FL… --- ## [Eck does take metadata name as role name](https://discuss.elastic.co/t/eck-does-take-metadata-name-as-role-name/302186)
**Author:** [@Rasoul\_Ahmadi](https://discuss.elastic.co/u/Rasoul_Ahmadi)\ **Replies:** 1\ **Last updated:** [April 14, 2022, 7:35am UTC](https://discuss.elastic.co/t/eck-does-take-metadata-name-as-role-name/302186 "2022-04-14T07:35:52Z")
hi I have encountered a potentially ridiculous problem and can't find my way out I would appreciate any help my YAML file apiVersion: elasticsearch.k8s.elastic.co/v1 kind: Elasticsearch metadata: name: logging na… --- ## [Elasticsearch non blocking ElasticsearchAsyncSearchAsyncClient and ElasticsearchAsyncClient](https://discuss.elastic.co/t/elasticsearch-non-blocking-elasticsearchasyncsearchasyncclient-and-elasticsearchasyncclient/302077)
**Author:** [@saeed\_shahsavan](https://discuss.elastic.co/u/saeed_shahsavan)\ **Replies:** 1\ **Last updated:** [April 14, 2022, 6:57am UTC](https://discuss.elastic.co/t/elasticsearch-non-blocking-elasticsearchasyncsearchasyncclient-and-elasticsearchasyncclient/302077 "2022-04-14T06:57:32Z")
Recently I have upgraded my project to use Elasticsearch so I have changed my client to use ElasticsearchAsyncSearchAsyncClient and ElasticsearchAsyncClient unfortunately in both clients my response time increased huge… --- ## [Query array of keyword responce different in source and docfields](https://discuss.elastic.co/t/query-array-of-keyword-responce-different-in-source-and-docfields/302389)
**Author:** [@waitingF](https://discuss.elastic.co/u/waitingF)\ **Replies:** 0\ **Last updated:** [April 14, 2022, 3:34am UTC](https://discuss.elastic.co/t/query-array-of-keyword-responce-different-in-source-and-docfields/302389 "2022-04-14T03:34:43Z")
I have an mapping of keyword field, like below PUT test-map { "mappings": { "properties": { "field": { "type": "keyword" } } } } And I post a doc: POST … --- ## [Track Queries with High Heap Usage](https://discuss.elastic.co/t/track-queries-with-high-heap-usage/302267)
**Author:** [@BenB196](https://discuss.elastic.co/u/BenB196)\ **Replies:** 5\ **Last updated:** [April 14, 2022, 3:24am UTC](https://discuss.elastic.co/t/track-queries-with-high-heap-usage/302267 "2022-04-14T03:24:29Z")
Hi All, I was wondering the best way to track queries based on their Heap usage. Context: I've recently had to increase heap allocation (currently 20GB RAM - 18GB Heap, up from 10GB RAM - 8GB Heap) on coordinating node… --- ## [Forced-awareness in Elastic 8.0.1](https://discuss.elastic.co/t/forced-awareness-in-elastic-8-0-1/301738)
**Author:** [@INS](https://discuss.elastic.co/u/INS)\ **Replies:** 10\ **Last updated:** [April 14, 2022, 2:44am UTC](https://discuss.elastic.co/t/forced-awareness-in-elastic-8-0-1/301738 "2022-04-14T02:44:57Z")
Hi I have a question: how I can ensure shard replication for to scatter shards to other hosts?, My Elastic cluster consist from 3 host (under 51 data nodes) As You can see Elasticsearch has made replicat on the same … --- ## [Editing and re-indexing large amounts of data in elasticsearch (millions of records)](https://discuss.elastic.co/t/editing-and-re-indexing-large-amounts-of-data-in-elasticsearch-millions-of-records/302373)
**Author:** [@jp184](https://discuss.elastic.co/u/jp184)\ **Replies:** 1\ **Last updated:** [April 14, 2022, 12:55am UTC](https://discuss.elastic.co/t/editing-and-re-indexing-large-amounts-of-data-in-elasticsearch-millions-of-records/302373 "2022-04-14T00:55:20Z")
I recently made a new version of an index for my Elasticsearch data with some new fields included. I re-indexed from the old index, so the new index has all of the old data with also the new mapping to include the new fi… --- ## [ElasticSearch using Docker and BitBucket DataCenter](https://discuss.elastic.co/t/elasticsearch-using-docker-and-bitbucket-datacenter/302163)
**Author:** [@ibmsorerer](https://discuss.elastic.co/u/ibmsorerer)\ **Replies:** 3\ **Last updated:** [April 13, 2022, 8:21pm UTC](https://discuss.elastic.co/t/elasticsearch-using-docker-and-bitbucket-datacenter/302163 "2022-04-13T20:21:34Z")
We were running BitBucket v6.10.3 as a monolithic server, which has reached EOL. I've been migrating this system to BB v7.21.0 (current release). I've been able to create an ES cluster under Docker/OpenShift without re… --- ## [Reducing relevance for viewed videos](https://discuss.elastic.co/t/reducing-relevance-for-viewed-videos/302352)
**Author:** [@Gustavo\_Leite\_Silvan](https://discuss.elastic.co/u/Gustavo_Leite_Silvan)\ **Replies:** 1\ **Last updated:** [April 13, 2022, 6:14pm UTC](https://discuss.elastic.co/t/reducing-relevance-for-viewed-videos/302352 "2022-04-13T18:14:05Z")
Hello there! We have a social network app that contains user's videos. The video URL is stored in a timeline index on Elastic. When the users opens the app, we will retrieve relevant videos for him based on the video p… --- ## [How to Index duplicate documents with the different routing id](https://discuss.elastic.co/t/how-to-index-duplicate-documents-with-the-different-routing-id/302353)
**Author:** [@raja\_augstin](https://discuss.elastic.co/u/raja_augstin)\ **Replies:** 1\ **Last updated:** [April 13, 2022, 5:20pm UTC](https://discuss.elastic.co/t/how-to-index-duplicate-documents-with-the-different-routing-id/302353 "2022-04-13T17:20:26Z")
My index settings: { "aliases": { "alias\_test\_read": {} }, "mappings": { "\_routing": { "required": true }, "properties": { "id": { "typ… --- ## [Specifying multiple preferences](https://discuss.elastic.co/t/specifying-multiple-preferences/302367)
**Author:** [@ahmedasadi](https://discuss.elastic.co/u/ahmedasadi)\ **Replies:** 2\ **Last updated:** [April 13, 2022, 5:30pm UTC](https://discuss.elastic.co/t/specifying-multiple-preferences/302367 "2022-04-13T17:30:35Z")
Hi, Is it possible to specify multiple preferences in an Elasticsearch query? I'm getting an error when using \_local and \_shard as preferences: URL: localhost:9200/testindex/\_search?preference=\_local,\_shards:1 { "… --- ## [Restore MediaWiki ElasticSearch functionality](https://discuss.elastic.co/t/restore-mediawiki-elasticsearch-functionality/301786)
**Author:** [@lenhartp](https://discuss.elastic.co/u/lenhartp)\ **Replies:** 5\ **Last updated:** [April 13, 2022, 5:29pm UTC](https://discuss.elastic.co/t/restore-mediawiki-elasticsearch-functionality/301786 "2022-04-13T17:29:32Z")
A couple months ago, had a mediawiki server with 3 wikis running on it dumped in my lap to support. The search box was using CirrusSearch and Elasticsearch / Elastica to generate results, but that was recently broken whe… --- ## [How to skip errors on snapshots](https://discuss.elastic.co/t/how-to-skip-errors-on-snapshots/302295)
**Author:** [@views\_eos](https://discuss.elastic.co/u/views_eos)\ **Replies:** 1\ **Last updated:** [April 13, 2022, 4:23pm UTC](https://discuss.elastic.co/t/how-to-skip-errors-on-snapshots/302295 "2022-04-13T16:23:22Z")
I was backing up the Snapshot data through NFS, but the NFS connection was cut off, so I received an error as below curl -H 'content-type: application/JSON' -XPUT "http://localhost:39023/\_snapshot/fs\_snapshot/$TARGET\_LO… --- ## [Error on import the Elasticsearch public GPG key into apt](https://discuss.elastic.co/t/error-on-import-the-elasticsearch-public-gpg-key-into-apt/302337)
**Author:** [@sashasingle](https://discuss.elastic.co/u/sashasingle)\ **Replies:** 3\ **Last updated:** [April 13, 2022, 2:58pm UTC](https://discuss.elastic.co/t/error-on-import-the-elasticsearch-public-gpg-key-into-apt/302337 "2022-04-13T14:58:08Z")
Hi, cannot download GPG-KEY when i run this command wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | sudo apt-key add -. System send answer - gpg: no valid OpenPGP data found --- ## [Installa elasticsearch in a different directory](https://discuss.elastic.co/t/installa-elasticsearch-in-a-different-directory/302226)
**Author:** [@gustavoluza](https://discuss.elastic.co/u/gustavoluza)\ **Replies:** 2\ **Last updated:** [April 13, 2022, 2:27pm UTC](https://discuss.elastic.co/t/installa-elasticsearch-in-a-different-directory/302226 "2022-04-13T14:27:17Z")
hi, by default Elasticsearch are installed in / directory (/etc/Elasticsearch). but i have an partition in my centos that is dedicated just for the database, how can change the default installing partition and install … --- ## [Elasticsearch downgrade / Restore](https://discuss.elastic.co/t/elasticsearch-downgrade-restore/302344)
**Author:** [@PAVK\_PRASAD](https://discuss.elastic.co/u/PAVK_PRASAD)\ **Replies:** 0\ **Last updated:** [April 13, 2022, 1:36pm UTC](https://discuss.elastic.co/t/elasticsearch-downgrade-restore/302344 "2022-04-13T13:36:59Z")
Hi Team, I have multiple queries on ES Restore / Downgrade on single node Currently we have elastic server(DEV) with 7.16.2 and we would like go back to 7.3.2 but we don't have any backup snapshot of 7.3.2. How to … [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=455) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=457)