# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=463 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 464 --- ## [Rollover "action time" seems to increase 10m each day](https://discuss.elastic.co/t/rollover-action-time-seems-to-increase-10m-each-day/301483)
**Author:** [@nunex\_17](https://discuss.elastic.co/u/nunex_17)\ **Replies:** 0\ **Last updated:** [April 4, 2022, 9:46am UTC](https://discuss.elastic.co/t/rollover-action-time-seems-to-increase-10m-each-day/301483 "2022-04-04T09:46:41Z")
In my setup, the indices are created every day at midnight. I started to notice that "current action time" is increasing about 10m per day, which is starting to be a pattern. Here are the prints: 03-04-2022 04-04-20… --- ## [Mlockall in elastic 7.15.2](https://discuss.elastic.co/t/mlockall-in-elastic-7-15-2/301326)
**Author:** [@samiujan](https://discuss.elastic.co/u/samiujan)\ **Replies:** 2\ **Last updated:** [April 4, 2022, 9:38am UTC](https://discuss.elastic.co/t/mlockall-in-elastic-7-15-2/301326 "2022-04-04T09:38:59Z")
Hi I have changed memory settings for the system and elastic, both, while working on ES v7.6.2 More recently, I've found an ES system running 7.15.2 whose mlockall returned false I checked the documentation and it say… --- ## [Do I need cluster.initial\_master\_nodes?](https://discuss.elastic.co/t/do-i-need-cluster-initial-master-nodes/301480)
**Author:** [@rachit\_upadhyay](https://discuss.elastic.co/u/rachit_upadhyay)\ **Replies:** 0\ **Last updated:** [April 4, 2022, 9:17am UTC](https://discuss.elastic.co/t/do-i-need-cluster-initial-master-nodes/301480 "2022-04-04T09:17:59Z")
Below is the Elasticsearch.yml configuration for my ec2 based ECS Elasticsearch setup. cluster.name: dashboards-elasticsearch node.data: true node.master: true # node.name: ${ES\_NODE\_NAME:} path.data: ${ES\_DATA\_PATH:/… --- ## [How to use Top\_Hit in a alarm querry](https://discuss.elastic.co/t/how-to-use-top-hit-in-a-alarm-querry/301473)
**Author:** [@mathric](https://discuss.elastic.co/u/mathric)\ **Replies:** 0\ **Last updated:** [April 4, 2022, 8:40am UTC](https://discuss.elastic.co/t/how-to-use-top-hit-in-a-alarm-querry/301473 "2022-04-04T08:40:50Z")
Hi, we use alarms to get notification about missing (or new) machines onbording to our elk. Therefore we querry the docs containing heartbeats for the last 15min and have a look if every machine has more than 12 beats. … --- ## [Elasticsearch performance](https://discuss.elastic.co/t/elasticsearch-performance/301430)
**Author:** [@osamaali2405](https://discuss.elastic.co/u/osamaali2405)\ **Replies:** 5\ **Last updated:** [April 4, 2022, 8:23am UTC](https://discuss.elastic.co/t/elasticsearch-performance/301430 "2022-04-04T08:23:23Z")
I have an issue when try to update in Elasticsearch, sometimes it takes more than 10 seconds According to the elastic logs, the overall health check itself takes too long , below example is \> 20 seconds {"type": "serve… --- ## [How to Reduce Received Logs Size in ELK Stack?](https://discuss.elastic.co/t/how-to-reduce-received-logs-size-in-elk-stack/301066)
**Author:** [@wcpoon](https://discuss.elastic.co/u/wcpoon)\ **Replies:** 31\ **Last updated:** [April 4, 2022, 7:56am UTC](https://discuss.elastic.co/t/how-to-reduce-received-logs-size-in-elk-stack/301066 "2022-04-04T07:56:54Z")
Hi, I would like to ask, any way we can compress / dedup the sizes of the logs that we received in ELK stack? Thanks. --- ## [Can I have only one master eligible node in elasticsearch](https://discuss.elastic.co/t/can-i-have-only-one-master-eligible-node-in-elasticsearch/301461)
**Author:** [@rachit\_upadhyay](https://discuss.elastic.co/u/rachit_upadhyay)\ **Replies:** 2\ **Last updated:** [April 4, 2022, 7:39am UTC](https://discuss.elastic.co/t/can-i-have-only-one-master-eligible-node-in-elasticsearch/301461 "2022-04-04T07:39:46Z")
I am getting following log message when my single master eligible node goes down and then starts again in ecs. Is it possible to have a cluster with only one master eligible node? What is the ideal number of master e… --- ## [Elasticsearch on large HW](https://discuss.elastic.co/t/elasticsearch-on-large-hw/301445)
**Author:** [@pszemesy](https://discuss.elastic.co/u/pszemesy)\ **Replies:** 3\ **Last updated:** [April 4, 2022, 7:16am UTC](https://discuss.elastic.co/t/elasticsearch-on-large-hw/301445 "2022-04-04T07:16:57Z")
Hi, There is request for me to set up Elasticsearch cluster (8.1) on large hardwares. The hardware of the data nodes: RAM: 384GB Cores: 48 Storage: 11.52 TB SSD Please help me how to set the jvm.options for this set… --- ## [How to remove the white list email Id's from the elastic cloud](https://discuss.elastic.co/t/how-to-remove-the-white-list-email-ids-from-the-elastic-cloud/299860)
**Author:** [@Kannan\_Rajendran](https://discuss.elastic.co/u/Kannan_Rajendran)\ **Replies:** 1\ **Last updated:** [April 4, 2022, 6:51am UTC](https://discuss.elastic.co/t/how-to-remove-the-white-list-email-ids-from-the-elastic-cloud/299860 "2022-04-04T06:51:47Z")
Hi Team, I have situation that we have already whitelist list of email address in the elastic cloud and now our email domain was migrated last week and after migration of domain we don't receive the elastic alert for th… --- ## [Advanced Watcher: Use key value in a mail webhook](https://discuss.elastic.co/t/advanced-watcher-use-key-value-in-a-mail-webhook/299457)
**Author:** [@Jonathan\_Fernandez](https://discuss.elastic.co/u/Jonathan_Fernandez)\ **Replies:** 2\ **Last updated:** [April 4, 2022, 6:50am UTC](https://discuss.elastic.co/t/advanced-watcher-use-key-value-in-a-mail-webhook/299457 "2022-04-04T06:50:03Z")
Hello everybody! So, basically I'm trying to get my 'key' value to print it into my mail body, but I'm not being able to do it. Once I get it, I will iterate over the buckets with a "foreach" before the webhook (within … --- ## [\]\[INFO \]\[o.e.x.s.a.AuthenAuthentication of \[elastic\] was terminated by realm \[reserved\] - failed to authenticate user \[elastic\]](https://discuss.elastic.co/t/info-o-e-x-s-a-authenauthentication-of-elastic-was-terminated-by-realm-reserved-failed-to-authenticate-user-elastic/300860)
**Author:** [@aman.nagi2210](https://discuss.elastic.co/u/aman.nagi2210)\ **Replies:** 0\ **Last updated:** [March 28, 2022, 2:52pm UTC](https://discuss.elastic.co/t/info-o-e-x-s-a-authenauthentication-of-elastic-was-terminated-by-realm-reserved-failed-to-authenticate-user-elastic/300860 "2022-03-28T14:52:10Z")
History: Recently moved to SSL.(xpack enabled) Cluster infra: 3 master nodes, 8 data nodes M1,M2,M3 and D1,----- D8 In elastinsearch.yml discovery.zen.ping.unicast.hosts: \[M1,M2,M3,D1\] Issue: We have generated the e… --- ## [Indexing a Circle (geoshape) Using NEST](https://discuss.elastic.co/t/indexing-a-circle-geoshape-using-nest/301421)
**Author:** [@xef](https://discuss.elastic.co/u/xef)\ **Replies:** 10\ **Last updated:** [April 4, 2022, 5:33am UTC](https://discuss.elastic.co/t/indexing-a-circle-geoshape-using-nest/301421 "2022-04-04T05:33:02Z")
Is there anyway of Indexing a Circle i.e. just have the lat/lng and a radius without first having to create a geojson polygon that represents it. i.e. just using its center lat/lng and its radius. Thanks. --- ## [Parent-Child Relationship performance](https://discuss.elastic.co/t/parent-child-relationship-performance/301416)
**Author:** [@sanders\_2345](https://discuss.elastic.co/u/sanders_2345)\ **Replies:** 0\ **Last updated:** [April 3, 2022, 8:17am UTC](https://discuss.elastic.co/t/parent-child-relationship-performance/301416 "2022-04-03T08:17:16Z")
We've one usecase to implement where we want to maintain a relationship between two types of documents. We tried to put in the same document but the document size exceeding 200kb. So we're exploring parent-child relation… --- ## [How to upgrade ElasticSearch In \`docker-compose.yml\`](https://discuss.elastic.co/t/how-to-upgrade-elasticsearch-in-docker-compose-yml/301408)
**Author:** [@linghengqian](https://discuss.elastic.co/u/linghengqian)\ **Replies:** 1\ **Last updated:** [April 4, 2022, 12:52am UTC](https://discuss.elastic.co/t/how-to-upgrade-elasticsearch-in-docker-compose-yml/301408 "2022-04-04T00:52:51Z")
According to Upgrade Elasticsearch | Elastic Installation and Upgrade Guide \[8.1\] | Elastic , if I wish to update the ElasticSearch instance started within docker-compose.yml, do I just need to stop all The insert data… --- ## [The consequences of manually changing the mapping of the destination index after reindexing has started](https://discuss.elastic.co/t/the-consequences-of-manually-changing-the-mapping-of-the-destination-index-after-reindexing-has-started/301245)
**Author:** [@Lala\_D](https://discuss.elastic.co/u/Lala_D)\ **Replies:** 1\ **Last updated:** [April 4, 2022, 12:42am UTC](https://discuss.elastic.co/t/the-consequences-of-manually-changing-the-mapping-of-the-destination-index-after-reindexing-has-started/301245 "2022-04-04T00:42:34Z")
Hello everyone! I am new to Elasticsearch and will highly appreciate any reply. My task is to do reindexing. Without configuring settings, mappings or even creating the destination index, I started reindexing straight… --- ## [Changing path to which pv is pointing](https://discuss.elastic.co/t/changing-path-to-which-pv-is-pointing/301311)
**Author:** [@shisir99](https://discuss.elastic.co/u/shisir99)\ **Replies:** 1\ **Last updated:** [April 4, 2022, 12:41am UTC](https://discuss.elastic.co/t/changing-path-to-which-pv-is-pointing/301311 "2022-04-04T00:41:32Z")
Hello, I want to change the path to which the following pv is pointing. I am using Elasticsearch helm chart provided by elastic.co --- ## [Index old zip files along with new files with index life management](https://discuss.elastic.co/t/index-old-zip-files-along-with-new-files-with-index-life-management/301324)
**Author:** [@shi](https://discuss.elastic.co/u/shi)\ **Replies:** 1\ **Last updated:** [April 4, 2022, 12:40am UTC](https://discuss.elastic.co/t/index-old-zip-files-along-with-new-files-with-index-life-management/301324 "2022-04-04T00:40:07Z")
i am indexing files collected by syslog server using filebeat. And those indexes are given index life management as to create new indexes by appending current date when the size of the index file reaches 50Gb But i have… --- ## [Elasticsearch cloud returning errors on each query](https://discuss.elastic.co/t/elasticsearch-cloud-returning-errors-on-each-query/301331)
**Author:** [@Munashe\_komichi](https://discuss.elastic.co/u/Munashe_komichi)\ **Replies:** 1\ **Last updated:** [April 4, 2022, 12:36am UTC](https://discuss.elastic.co/t/elasticsearch-cloud-returning-errors-on-each-query/301331 "2022-04-04T00:36:49Z")
Trying to run queries with Elasticsearch but getting errors, help would be appreciated! elasticsearch.exceptions.AuthorizationException: AuthorizationException(403, 'security\_exception', 'action \[indices:data/write/ind… --- ## [Logging on startup](https://discuss.elastic.co/t/logging-on-startup/301354)
**Author:** [@dkaflowitz](https://discuss.elastic.co/u/dkaflowitz)\ **Replies:** 1\ **Last updated:** [April 4, 2022, 12:35am UTC](https://discuss.elastic.co/t/logging-on-startup/301354 "2022-04-04T00:35:28Z")
Does logging, including login that the application is starting, begin on startup or does it start some time after? If so is this documented anywhere? --- ## [JVM heap size arguments](https://discuss.elastic.co/t/jvm-heap-size-arguments/301343)
**Author:** [@Leo\_Collette](https://discuss.elastic.co/u/Leo_Collette)\ **Replies:** 1\ **Last updated:** [April 4, 2022, 12:35am UTC](https://discuss.elastic.co/t/jvm-heap-size-arguments/301343 "2022-04-04T00:35:05Z")
hello guys, in my system we adopted a pattern of adjusting the heap size parameter to 1G, but over time the service ends up consuming more than this value, is this ok or not? another question, does adjusting a limit for … --- ## [Strong authentication](https://discuss.elastic.co/t/strong-authentication/301355)
**Author:** [@dkaflowitz](https://discuss.elastic.co/u/dkaflowitz)\ **Replies:** 0\ **Last updated:** [April 1, 2022, 4:59pm UTC](https://discuss.elastic.co/t/strong-authentication/301355 "2022-04-01T16:59:29Z")
Does the Native Realm use strong authentication like Kerberos, IPSEC, or Secure Shell (SSH)? Is that documented somewhere? --- ## [Index life cycle policy to delete indices](https://discuss.elastic.co/t/index-life-cycle-policy-to-delete-indices/300649)
**Author:** [@tkotthakota](https://discuss.elastic.co/u/tkotthakota)\ **Replies:** 14\ **Last updated:** [April 4, 2022, 12:29am UTC](https://discuss.elastic.co/t/index-life-cycle-policy-to-delete-indices/300649 "2022-04-04T00:29:43Z")
Hi, I created below policy to delete old indices. I notice that old indices are getting deleted but slowly . Meaning the count went down from 695 to 573 in 1 hour. Is it normal? PUT \_ilm/policy/QA\_only\_cleanup\_old\_indic… --- ## [Basic Authentication not working via python client](https://discuss.elastic.co/t/basic-authentication-not-working-via-python-client/301435)
**Author:** [@tfinan](https://discuss.elastic.co/u/tfinan)\ **Replies:** 2\ **Last updated:** [April 3, 2022, 9:55pm UTC](https://discuss.elastic.co/t/basic-authentication-not-working-via-python-client/301435 "2022-04-03T21:55:12Z")
I have been experimenting with some very simply python code to interact with Elasticsearch. Up until a couple of days ago, everything was working great. I could add data to an index, read from the index, search, etc...… --- ## [After deleting an index and creating new index with same name, new data is visible for sometime after than old data is coming](https://discuss.elastic.co/t/after-deleting-an-index-and-creating-new-index-with-same-name-new-data-is-visible-for-sometime-after-than-old-data-is-coming/301423)
**Author:** [@sona](https://discuss.elastic.co/u/sona)\ **Replies:** 2\ **Last updated:** [April 3, 2022, 6:10pm UTC](https://discuss.elastic.co/t/after-deleting-an-index-and-creating-new-index-with-same-name-new-data-is-visible-for-sometime-after-than-old-data-is-coming/301423 "2022-04-03T18:10:38Z")
I have deleted an index from my Elasticsearch and created the new index with same name. When I am trying to get doc.count using below command then initially it is showing 0 curl -X GET "localhost:9200/\_cat/indices?v&pr… --- ## [Connection refused elasticsearch port 9200 on ubuntu 20.04](https://discuss.elastic.co/t/connection-refused-elasticsearch-port-9200-on-ubuntu-20-04/301335)
**Author:** [@danielbsilva2](https://discuss.elastic.co/u/danielbsilva2)\ **Replies:** 12\ **Last updated:** [April 3, 2022, 5:15pm UTC](https://discuss.elastic.co/t/connection-refused-elasticsearch-port-9200-on-ubuntu-20-04/301335 "2022-04-03T17:15:11Z")
good afternoon guys my English is not very good but I will try to explain myself I have a test server here at digitalocean with ubuntu 20.04 and I installed Elasticsearch for log collection on this same test server but … --- ## [Elastic search complex query](https://discuss.elastic.co/t/elastic-search-complex-query/301399)
**Author:** [@Hassan\_Shaitou](https://discuss.elastic.co/u/Hassan_Shaitou)\ **Replies:** 5\ **Last updated:** [April 3, 2022, 2:15pm UTC](https://discuss.elastic.co/t/elastic-search-complex-query/301399 "2022-04-03T14:15:03Z")
So, let us say I have 2 indices users and products. Within users I have the following format: users: { uid:"00001", name:"Hash", country:"US" }, Within the products I have the following format: product: { prod… --- ## [Aliases and indices on demand](https://discuss.elastic.co/t/aliases-and-indices-on-demand/298625)
**Author:** [@Metheny](https://discuss.elastic.co/u/Metheny)\ **Replies:** 10\ **Last updated:** [April 3, 2022, 1:08pm UTC](https://discuss.elastic.co/t/aliases-and-indices-on-demand/298625 "2022-04-03T13:08:08Z")
We have many indices in our system, and we're following the general guideline to create indices only on demand. We're also starting to use aliases to allow for rollover and for background data migrations (using the inde… --- ## [Elasticsearch alerting free for MS Teams](https://discuss.elastic.co/t/elasticsearch-alerting-free-for-ms-teams/301400)
**Author:** [@Anagha\_nambiar](https://discuss.elastic.co/u/Anagha_nambiar)\ **Replies:** 1\ **Last updated:** [April 2, 2022, 8:42pm UTC](https://discuss.elastic.co/t/elasticsearch-alerting-free-for-ms-teams/301400 "2022-04-02T20:42:43Z")
Hi All, I would like to know whether Alerting to MS Teams is available for free (basic) in any version of Elasticsearch. Please confirm on this. --- ## [Duplicate Tokens in elasticsearch uax\_url\_email tokenizer](https://discuss.elastic.co/t/duplicate-tokens-in-elasticsearch-uax-url-email-tokenizer/301398)
**Author:** [@TheGreatBaldOne](https://discuss.elastic.co/u/TheGreatBaldOne)\ **Replies:** 0\ **Last updated:** [April 2, 2022, 7:02pm UTC](https://discuss.elastic.co/t/duplicate-tokens-in-elasticsearch-uax-url-email-tokenizer/301398 "2022-04-02T19:02:48Z")
I have created a test index here { "settings" : { "analysis" : { "filter" : { "emailcustom" : { … --- ## [The query speed of sentence vector in elasticsearch8 is slow](https://discuss.elastic.co/t/the-query-speed-of-sentence-vector-in-elasticsearch8-is-slow/301380)
**Author:** [@qili](https://discuss.elastic.co/u/qili)\ **Replies:** 0\ **Last updated:** [April 2, 2022, 6:24am UTC](https://discuss.elastic.co/t/the-query-speed-of-sentence-vector-in-elasticsearch8-is-slow/301380 "2022-04-02T06:24:40Z")
The es7.16.2 version inserts 3 million 768-dimensional sentence vectors, and the query results in 2-3 seconds. After the es8.1.1 version is used, the query time reaches 5 or 6 minutes. Is there any special configuration … [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=462) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=464)