# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=464 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 465 --- ## [How to set up filebeat](https://discuss.elastic.co/t/how-to-set-up-filebeat/301382)
**Author:** [@mick463](https://discuss.elastic.co/u/mick463)\ **Replies:** 0\ **Last updated:** [April 2, 2022, 7:38am UTC](https://discuss.elastic.co/t/how-to-set-up-filebeat/301382 "2022-04-02T07:38:29Z")
Hi I am trying to set up filebeat to learn how to use it and Elastic ( I am new to this) I have set up winlogbeat and metric beat and they are working. When i set up filebeat i get No matching indices found: No indice… --- ## [ERROR: Skipping security auto configuration because it appears that the node is not starting up for the first time. The node might already be part of a cluster and this auto setup utility is designed to configure Security for new clusters only](https://discuss.elastic.co/t/error-skipping-security-auto-configuration-because-it-appears-that-the-node-is-not-starting-up-for-the-first-time-the-node-might-already-be-part-of-a-cluster-and-this-auto-setup-utility-is-designed-to-configure-security-for-new-clusters-only/300568)
**Author:** [@qili](https://discuss.elastic.co/u/qili)\ **Replies:** 3\ **Last updated:** [April 2, 2022, 6:41am UTC](https://discuss.elastic.co/t/error-skipping-security-auto-configuration-because-it-appears-that-the-node-is-not-starting-up-for-the-first-time-the-node-might-already-be-part-of-a-cluster-and-this-auto-setup-utility-is-designed-to-configure-security-for-new-clusters-only/300568 "2022-04-02T06:41:38Z")
why？ I use es8.1.1 mast node had Started ，but failed to join cluster from node mast node is ： --- ## [Will allocation settings work on closed indexes?](https://discuss.elastic.co/t/will-allocation-settings-work-on-closed-indexes/301190)
**Author:** [@casterQ](https://discuss.elastic.co/u/casterQ)\ **Replies:** 4\ **Last updated:** [April 2, 2022, 2:15am UTC](https://discuss.elastic.co/t/will-allocation-settings-work-on-closed-indexes/301190 "2022-04-02T02:15:26Z")
When I set the cluster settings as follows： "cluster.routing.allocation.exclude.\_ip" : "10.1.1.1" It's means that All indices will be removed from this node（10.1.1.1） My question is ：Will the closed index be moved？ --- ## [SQL column alias equivalent in Elasticsearch query](https://discuss.elastic.co/t/sql-column-alias-equivalent-in-elasticsearch-query/301362)
**Author:** [@elk.pepper](https://discuss.elastic.co/u/elk.pepper)\ **Replies:** 0\ **Last updated:** [April 1, 2022, 6:12pm UTC](https://discuss.elastic.co/t/sql-column-alias-equivalent-in-elasticsearch-query/301362 "2022-04-01T18:12:41Z")
Hello, I am trying to create a query similar to the following (ignore the fact that time is not taken into account): SELECT host, sum(bytes) FROM (SELECT sender as host, sent\_bytes as bytes from traffic UNION SE… --- ## [Slow cosine similarity script](https://discuss.elastic.co/t/slow-cosine-similarity-script/299496)
**Author:** [@adibaba](https://discuss.elastic.co/u/adibaba)\ **Replies:** 4\ **Last updated:** [April 1, 2022, 11:02pm UTC](https://discuss.elastic.co/t/slow-cosine-similarity-script/299496 "2022-04-01T23:02:22Z")
Hi, in a query, I am executing a cosine similarity script. It takes multiple seconds, but the top command shows CPU and memory usage of nearly zero. It looks like a configuration issue to me, but I can not figure out th… --- ## [Adding component templates to existing index templates](https://discuss.elastic.co/t/adding-component-templates-to-existing-index-templates/301368)
**Author:** [@ARDiver86](https://discuss.elastic.co/u/ARDiver86)\ **Replies:** 0\ **Last updated:** [April 1, 2022, 7:09pm UTC](https://discuss.elastic.co/t/adding-component-templates-to-existing-index-templates/301368 "2022-04-01T19:09:56Z")
How can I apply a new component template to all existing index templates that I have? I know you can supply the "composed\_of" field, but that looks like all of the component templates that should be on the index template… --- ## [Comparative study for ELK VS SolarWind](https://discuss.elastic.co/t/comparative-study-for-elk-vs-solarwind/301357)
**Author:** [@gbiswas](https://discuss.elastic.co/u/gbiswas)\ **Replies:** 0\ **Last updated:** [April 1, 2022, 5:10pm UTC](https://discuss.elastic.co/t/comparative-study-for-elk-vs-solarwind/301357 "2022-04-01T17:10:01Z")
Looking for some comparative study on why ELK would be a better choice than SolarWind for application monitoring and Management --- ## [Logstash to Elasticsearch resilience](https://discuss.elastic.co/t/logstash-to-elasticsearch-resilience/301346)
**Author:** [@gneves](https://discuss.elastic.co/u/gneves)\ **Replies:** 4\ **Last updated:** [April 1, 2022, 4:33pm UTC](https://discuss.elastic.co/t/logstash-to-elasticsearch-resilience/301346 "2022-04-01T16:33:02Z")
Hello everyone, Im having a little bit of trouble finding a way to approach resilience on my Elasticsearch cluster. Currently i have 2 Logstash nodes for resilience. Each one of them are pointing to my 4 Elasticsearch… --- ## [How to handle fine grained errors in new Java API 8.0.1 for Bulk?](https://discuss.elastic.co/t/how-to-handle-fine-grained-errors-in-new-java-api-8-0-1-for-bulk/301285)
**Author:** [@ivanqwam](https://discuss.elastic.co/u/ivanqwam)\ **Replies:** 3\ **Last updated:** [April 1, 2022, 4:10pm UTC](https://discuss.elastic.co/t/how-to-handle-fine-grained-errors-in-new-java-api-8-0-1-for-bulk/301285 "2022-04-01T16:10:21Z")
With much sweat I could build a Bulk Request, on the new Java API 8.1.0, like this // build request ArrayList\ bulkOperations = new ArrayList\(); BulkOperation bulkOperation = BulkOperation.o… --- ## [Access to matched\_queries in Painless script](https://discuss.elastic.co/t/access-to-matched-queries-in-painless-script/301109)
**Author:** [@scurtis\_es](https://discuss.elastic.co/u/scurtis_es)\ **Replies:** 3\ **Last updated:** [April 1, 2022, 3:42pm UTC](https://discuss.elastic.co/t/access-to-matched-queries-in-painless-script/301109 "2022-04-01T15:42:04Z")
I am writing a Painless script in a Java-based search application, and I wondered if it is now possible to access the "matched\_queries" value for named queries in order to better determine which clauses matched in a give… --- ## [Can't create new 3 node cluster using docker swarm](https://discuss.elastic.co/t/cant-create-new-3-node-cluster-using-docker-swarm/301337)
**Author:** [@chrish1](https://discuss.elastic.co/u/chrish1)\ **Replies:** 0\ **Last updated:** [April 1, 2022, 2:38pm UTC](https://discuss.elastic.co/t/cant-create-new-3-node-cluster-using-docker-swarm/301337 "2022-04-01T14:38:13Z")
I am trying to setup a new 3 node Elasticsearch cluster within a swarm. Docker version: 20.10.12 Elastic version: 7.16.3 When deploying the stack we see the below errors from the docker service logs: elastic\_elastics… --- ## [Disable geoip](https://discuss.elastic.co/t/disable-geoip/301297)
**Author:** [@Foggie](https://discuss.elastic.co/u/Foggie)\ **Replies:** 2\ **Last updated:** [April 1, 2022, 1:44pm UTC](https://discuss.elastic.co/t/disable-geoip/301297 "2022-04-01T13:44:37Z")
I am trying to deploy Elasticsearch 7.17.1 on a server behind a very strict firewall (basically no Internet access is allowed. The deployment is via a bat file (not Docker). The Elasticsearch.yml is virtually all comme… --- ## [1 of 21 shards failed](https://discuss.elastic.co/t/1-of-21-shards-failed/301259)
**Author:** [@alex\_96](https://discuss.elastic.co/u/alex_96)\ **Replies:** 4\ **Last updated:** [April 1, 2022, 12:42pm UTC](https://discuss.elastic.co/t/1-of-21-shards-failed/301259 "2022-04-01T12:42:55Z")
Hello, today I went to my dashboard and saw such an error "1 of 21 shards failed", looking at the details I saw the following Request: { "aggs": { "2": { "terms": { "field": "agent.name", "or… --- ## [elasticsearch.exceptions.ConnectionError](https://discuss.elastic.co/t/elasticsearch-exceptions-connectionerror/301221)
**Author:** [@Hammadi\_Ben\_cheikh1](https://discuss.elastic.co/u/Hammadi_Ben_cheikh1)\ **Replies:** 3\ **Last updated:** [April 1, 2022, 12:35pm UTC](https://discuss.elastic.co/t/elasticsearch-exceptions-connectionerror/301221 "2022-04-01T12:35:23Z")
Hello my friends ! i am working at a Django project , that use Elasticsearch , so when i transfert my project to docker container , i got this error from indexer es = Elasticsearch('http://127.0.0.1:9200/') Plea… --- ## [Huge aggregation triggers CircuitBreaker in loop](https://discuss.elastic.co/t/huge-aggregation-triggers-circuitbreaker-in-loop/299637)
**Author:** [@elephant](https://discuss.elastic.co/u/elephant)\ **Replies:** 4\ **Last updated:** [April 1, 2022, 11:15am UTC](https://discuss.elastic.co/t/huge-aggregation-triggers-circuitbreaker-in-loop/299637 "2022-04-01T11:15:20Z")
Hi, I was trying to make aggregations on a very huge index. The search triggered the circuit breaker which was expected given the size of the index (billion of documents): elastic1\_1 | "Caused by: org.elastics… --- ## [Shard relocation progress, 2022](https://discuss.elastic.co/t/shard-relocation-progress-2022/301314)
**Author:** [@nisow95612](https://discuss.elastic.co/u/nisow95612)\ **Replies:** 1\ **Last updated:** [April 1, 2022, 10:53am UTC](https://discuss.elastic.co/t/shard-relocation-progress-2022/301314 "2022-04-01T10:53:40Z")
What's the best way to monitor shard relocation progress? This is follow-up to Shard relocation progress --- ## [No Write Index in Elasticsearch](https://discuss.elastic.co/t/no-write-index-in-elasticsearch/301306)
**Author:** [@wcpoon](https://discuss.elastic.co/u/wcpoon)\ **Replies:** 1\ **Last updated:** [April 1, 2022, 10:23am UTC](https://discuss.elastic.co/t/no-write-index-in-elasticsearch/301306 "2022-04-01T10:23:55Z")
Hi, I accidently deleted the active logstash-xxxxx indices. Now my logs cannot index. I check the logstash logs, below is the warning. \[2022-04-01T18:11:02,900\]\[WARN \]\[logstash.outputs.elasticsearch\]\[main\]\[bd7d93f8f… --- ## [Elasticsearch failed start when enable x-pack security](https://discuss.elastic.co/t/elasticsearch-failed-start-when-enable-x-pack-security/301117)
**Author:** [@alipujaistopo](https://discuss.elastic.co/u/alipujaistopo)\ **Replies:** 12\ **Last updated:** [April 1, 2022, 9:26am UTC](https://discuss.elastic.co/t/elasticsearch-failed-start-when-enable-x-pack-security/301117 "2022-04-01T09:26:02Z")
first thing first, i just create ssl/tls certificate using Elasticsearch-certutil cert and then i created this configuration into bottom Elasticsearch.yml #xpack xpack.security.enabled: true xpack.security.transport.ss… --- ## [Doubts about Multifields](https://discuss.elastic.co/t/doubts-about-multifields/301244)
**Author:** [@RabBit\_BR](https://discuss.elastic.co/u/RabBit_BR)\ **Replies:** 1\ **Last updated:** [April 1, 2022, 8:30am UTC](https://discuss.elastic.co/t/doubts-about-multifields/301244 "2022-04-01T08:30:10Z")
Hi! Can anyone tell me if using the multifields strategy (strategy A) would be better than individually separating (strategy B) each field? What would be the advantages between one and the other? Strategy A { "titl… --- ## [Date range matching in ES](https://discuss.elastic.co/t/date-range-matching-in-es/301289)
**Author:** [@TheGreatBaldOne](https://discuss.elastic.co/u/TheGreatBaldOne)\ **Replies:** 0\ **Last updated:** [April 1, 2022, 7:47am UTC](https://discuss.elastic.co/t/date-range-matching-in-es/301289 "2022-04-01T07:47:56Z")
I would like to create a small scheduling app. Lets say we have Joe and he needs to teach online multiple people individually about .. gardening. He cannot teach more than 1 person at a time. He has a calendar of 'ava… --- ## [Is object storage mandatory for new Java API?](https://discuss.elastic.co/t/is-object-storage-mandatory-for-new-java-api/300481)
**Author:** [@ivanqwam](https://discuss.elastic.co/u/ivanqwam)\ **Replies:** 3\ **Last updated:** [April 1, 2022, 7:11am UTC](https://discuss.elastic.co/t/is-object-storage-mandatory-for-new-java-api/300481 "2022-04-01T07:11:25Z")
From this link https://github.com/elastic/elasticsearch-java/blob/main/java-client/src/test/java/co/elastic/clients/elasticsearch/end\_to\_end/RequestTest.java I can see that indexing is using an object storage strategy … --- ## [DSL query : How to parse message contain slash](https://discuss.elastic.co/t/dsl-query-how-to-parse-message-contain-slash/300216)
**Author:** [@RickT](https://discuss.elastic.co/u/RickT)\ **Replies:** 7\ **Last updated:** [April 1, 2022, 6:27am UTC](https://discuss.elastic.co/t/dsl-query-how-to-parse-message-contain-slash/300216 "2022-04-01T06:27:56Z")
Hi, How can i parse a message field wich contain slashes ? I'm trying with query regexp, but without result. Thanks all --- ## [Returning the number of results which match a large query?](https://discuss.elastic.co/t/returning-the-number-of-results-which-match-a-large-query/301275)
**Author:** [@catmanjan](https://discuss.elastic.co/u/catmanjan)\ **Replies:** 3\ **Last updated:** [April 1, 2022, 4:27am UTC](https://discuss.elastic.co/t/returning-the-number-of-results-which-match-a-large-query/301275 "2022-04-01T04:27:33Z")
I have an index with 100 million documents What's the fastest way for me to count the number of documents which meet a certain query? I don't want the documents, just the number of documents that match the query. I am … --- ## [Total Shards Differs (dev console vs. script output)](https://discuss.elastic.co/t/total-shards-differs-dev-console-vs-script-output/301258)
**Author:** [@codewriterguy](https://discuss.elastic.co/u/codewriterguy)\ **Replies:** 2\ **Last updated:** [March 31, 2022, 10:07pm UTC](https://discuss.elastic.co/t/total-shards-differs-dev-console-vs-script-output/301258 "2022-03-31T22:07:44Z")
Hi lovely Elastic folks, I have a script that rolls over a few data streams and my cluster quickly became oversharded. The rollover requests are now failing with: elasticsearch.exceptions.RequestError: RequestError(40… --- ## [:client:rest-high-level:qa does not exist](https://discuss.elastic.co/t/rest-high-level-qa-does-not-exist/301255)
**Author:** [@erdemtuna](https://discuss.elastic.co/u/erdemtuna)\ **Replies:** 0\ **Last updated:** [March 31, 2022, 8:36pm UTC](https://discuss.elastic.co/t/rest-high-level-qa-does-not-exist/301255 "2022-03-31T20:36:51Z")
I am using SonarQube - \* Community Edition Version 9.3 (build 51899). I wanted to run SonarQube (SonarScanner) on Elasticsearch. I could build the project (Elasticsearch) with its native gradle command ./gradlew localDis… --- ## [Geoip\_databases index allocation failed](https://discuss.elastic.co/t/geoip-databases-index-allocation-failed/300783)
**Author:** [@roman.huesler](https://discuss.elastic.co/u/roman.huesler)\ **Replies:** 1\ **Last updated:** [March 31, 2022, 3:52pm UTC](https://discuss.elastic.co/t/geoip-databases-index-allocation-failed/300783 "2022-03-31T15:52:17Z")
Im learning and playing around with Elasticsearch. Just setup a new local test cluster with 3 nodes on kubernetes (Elasticsearch 8.1.0) and also set up kibana 8.1.0. In kubernetes its a StateFulset with storage on NFS. T… --- ## [Group\_concat equivalent](https://discuss.elastic.co/t/group-concat-equivalent/301222)
**Author:** [@en666](https://discuss.elastic.co/u/en666)\ **Replies:** 0\ **Last updated:** [March 31, 2022, 3:42pm UTC](https://discuss.elastic.co/t/group-concat-equivalent/301222 "2022-03-31T15:42:46Z")
Hi all, I've noticed that this very question was asked a number of times and always closed without an answer. I am new to Elasticsearch and I've managed to GROUP the hits of a query BY multiple fields, which is good ne… --- ## [How to implement Search using Java API Client 8.1](https://discuss.elastic.co/t/how-to-implement-search-using-java-api-client-8-1/301153)
**Author:** [@ksuren](https://discuss.elastic.co/u/ksuren)\ **Replies:** 2\ **Last updated:** [March 31, 2022, 2:24pm UTC](https://discuss.elastic.co/t/how-to-implement-search-using-java-api-client-8-1/301153 "2022-03-31T14:24:23Z")
The docs here Elasticsearch Java API Client \[8.1\] | Elastic do not have clear examples of using the Java API Client. Although I can view the docs for all the available classes Overview (java-client 8.1.1 API) but not sur… --- ## [Failed to start elasticsearch 7.16.2 after upgrade from 6.8.8](https://discuss.elastic.co/t/failed-to-start-elasticsearch-7-16-2-after-upgrade-from-6-8-8/301192)
**Author:** [@msoufiyan](https://discuss.elastic.co/u/msoufiyan)\ **Replies:** 3\ **Last updated:** [March 31, 2022, 2:17pm UTC](https://discuss.elastic.co/t/failed-to-start-elasticsearch-7-16-2-after-upgrade-from-6-8-8/301192 "2022-03-31T14:17:44Z")
hi, i'm new at ELK, i installed the Elasticsearch version 7.16.2 on centos 8 but i get this error so i disabled machine learning functionality with(xpack.ml.enabled: false) org.elasticsearch.ElasticsearchException: Fai… --- ## [Cluster down after upgrade](https://discuss.elastic.co/t/cluster-down-after-upgrade/301004)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 4\ **Last updated:** [March 31, 2022, 1:46pm UTC](https://discuss.elastic.co/t/cluster-down-after-upgrade/301004 "2022-03-31T13:46:20Z")
I have three Linux container as data node and three as master and it fails with following error. can't figure out why. whole file system /s1/Elasticsearch/ndoes is clean on all container. I can run full find /s1 on all … [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=463) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=465)