# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=465 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 466 --- ## [Sorting documents with same multiple fields in one bucket](https://discuss.elastic.co/t/sorting-documents-with-same-multiple-fields-in-one-bucket/301202)
**Author:** [@Hella\_Konnecker](https://discuss.elastic.co/u/Hella_Konnecker)\ **Replies:** 0\ **Last updated:** [March 31, 2022, 1:38pm UTC](https://discuss.elastic.co/t/sorting-documents-with-same-multiple-fields-in-one-bucket/301202 "2022-03-31T13:38:47Z")
Hello, I have a dataset with 3 000 000 indices from a shipping platform. Each index describes one product, and I would like to put similar products in one bucket. To be considered “similar” five fields have to be the sa… --- ## [Nested multiple date-range intervals](https://discuss.elastic.co/t/nested-multiple-date-range-intervals/301121)
**Author:** [@TheGreatBaldOne](https://discuss.elastic.co/u/TheGreatBaldOne)\ **Replies:** 2\ **Last updated:** [March 31, 2022, 11:57am UTC](https://discuss.elastic.co/t/nested-multiple-date-range-intervals/301121 "2022-03-31T11:57:02Z")
I have an index, that will hold a 'job' and each job will have a couple of date-intervals where that job can be performed. In our case it a plumbing job :slight\_smile: These date-intervals are limited, so they do not ex… --- ## [TransportError(503, 'search\_phase\_execution\_exception') only while using python but not in kibana?](https://discuss.elastic.co/t/transporterror-503-search-phase-execution-exception-only-while-using-python-but-not-in-kibana/301164)
**Author:** [@Harish\_fragger](https://discuss.elastic.co/u/Harish_fragger)\ **Replies:** 1\ **Last updated:** [March 31, 2022, 11:50am UTC](https://discuss.elastic.co/t/transporterror-503-search-phase-execution-exception-only-while-using-python-but-not-in-kibana/301164 "2022-03-31T11:50:03Z")
I am using python to extract data from my Elasticsearch but suddenly started to get this error : TransportError(503, 'search\_phase\_execution\_exception'). I also have kibana working with the same Elasticsearch and I am ab… --- ## [New Java API with Credentials and SSL certificates](https://discuss.elastic.co/t/new-java-api-with-credentials-and-ssl-certificates/301173)
**Author:** [@ivanqwam](https://discuss.elastic.co/u/ivanqwam)\ **Replies:** 2\ **Last updated:** [March 31, 2022, 11:33am UTC](https://discuss.elastic.co/t/new-java-api-with-credentials-and-ssl-certificates/301173 "2022-03-31T11:33:55Z")
To connect to new Java API, this url: https://www.elastic.co/guide/en/elasticsearch/client/java-api-client/8.1/connecting.html explains to do this : // Create the low-level client RestClient restClient = RestClient.bu… --- ## [1h difference between rollover time and action time](https://discuss.elastic.co/t/1h-difference-between-rollover-time-and-action-time/300895)
**Author:** [@nunex\_17](https://discuss.elastic.co/u/nunex_17)\ **Replies:** 5\ **Last updated:** [March 31, 2022, 9:07am UTC](https://discuss.elastic.co/t/1h-difference-between-rollover-time-and-action-time/300895 "2022-03-31T09:07:23Z")
Hi, I noticed that despite my indexes are being rolled over at midnight, the "index phase time" and "index action time" are with 2h difference apart, like: { "indices" : { "suricata-ids-2022.03.28-000021" : { … --- ## [cURL request not working with CA certificate on Windows](https://discuss.elastic.co/t/curl-request-not-working-with-ca-certificate-on-windows/299566)
**Author:** [@Andy0708](https://discuss.elastic.co/u/Andy0708)\ **Replies:** 9\ **Last updated:** [March 31, 2022, 8:52am UTC](https://discuss.elastic.co/t/curl-request-not-working-with-ca-certificate-on-windows/299566 "2022-03-31T08:52:49Z")
Hi, The following command works fine on macOS, but I am unable to get it to work on Windows 10. curl --cacert config\\certs\\http\_ca.crt -u elastic https://localhost:9200 This happens after starting up a fresh cluster o… --- ## [Unable to connect to secondary master node, when manually stopping primary master node](https://discuss.elastic.co/t/unable-to-connect-to-secondary-master-node-when-manually-stopping-primary-master-node/300917)
**Author:** [@Dhamodharan](https://discuss.elastic.co/u/Dhamodharan)\ **Replies:** 5\ **Last updated:** [March 31, 2022, 7:32am UTC](https://discuss.elastic.co/t/unable-to-connect-to-secondary-master-node-when-manually-stopping-primary-master-node/300917 "2022-03-31T07:32:53Z")
I got a small project so thought to go with only 2nodes ES cluster and maintain HA. Both nodes are act as Master and data node, i wanted to maintain any 1 node should be up all the time. Both machine having the same conf… --- ## [Group by Count equals value](https://discuss.elastic.co/t/group-by-count-equals-value/301161)
**Author:** [@chivas](https://discuss.elastic.co/u/chivas)\ **Replies:** 1\ **Last updated:** [March 31, 2022, 7:04am UTC](https://discuss.elastic.co/t/group-by-count-equals-value/301161 "2022-03-31T07:04:09Z")
Hello, I am using below query to group by a field and return the count, is there a way to return documents whose doc\_count equals 1 (or less than 2) GET logs-test\*/\_search { "aggs": { "2": { "terms": { … --- ## [How to sort keyword/text fields on aggregation results](https://discuss.elastic.co/t/how-to-sort-keyword-text-fields-on-aggregation-results/301160)
**Author:** [@Shushil\_Shankar](https://discuss.elastic.co/u/Shushil_Shankar)\ **Replies:** 0\ **Last updated:** [March 31, 2022, 5:51am UTC](https://discuss.elastic.co/t/how-to-sort-keyword-text-fields-on-aggregation-results/301160 "2022-03-31T05:51:48Z")
Hi Everyone! I have a aggregation results and I need to sort aggregation data using Elasticsearch.Net. When i'm trying using terms aggregation i'm getting this error "buckets\_path must reference either a number value or… --- ## [Is access to Elasticsearch / Elastic Cloud restricted for Belarus?](https://discuss.elastic.co/t/is-access-to-elasticsearch-elastic-cloud-restricted-for-belarus/300784)
**Author:** [@Sleepy\_Panda](https://discuss.elastic.co/u/Sleepy_Panda)\ **Replies:** 2\ **Last updated:** [March 31, 2022, 5:37am UTC](https://discuss.elastic.co/t/is-access-to-elasticsearch-elastic-cloud-restricted-for-belarus/300784 "2022-03-31T05:37:03Z")
Is access to Elasticsearch restricted for Belarus? I can't pull the Docker image: docker pull docker.elastic.co/elasticsearch/elasticsearch:8.1.1 leads to The Amazon CloudFront distribution is configured to block acces… --- ## [Intergation of elastic with a service desk app](https://discuss.elastic.co/t/intergation-of-elastic-with-a-service-desk-app/301055)
**Author:** [@Vinay\_Menon1](https://discuss.elastic.co/u/Vinay_Menon1)\ **Replies:** 1\ **Last updated:** [March 31, 2022, 5:14am UTC](https://discuss.elastic.co/t/intergation-of-elastic-with-a-service-desk-app/301055 "2022-03-31T05:14:05Z")
Hi Team, I have a query not sure if anyone can help in this We have an in house created ticketing system which one of the developers created this we plan to integrate with elastic. We have multiple client regions & on… --- ## [Elasticsearch change CA and http and transport Certificate](https://discuss.elastic.co/t/elasticsearch-change-ca-and-http-and-transport-certificate/301078)
**Author:** [@sharbich](https://discuss.elastic.co/u/sharbich)\ **Replies:** 1\ **Last updated:** [March 31, 2022, 3:23am UTC](https://discuss.elastic.co/t/elasticsearch-change-ca-and-http-and-transport-certificate/301078 "2022-03-31T03:23:56Z")
Hi there, i have my own self-signed CA. I would like to use this Root CA for Elasticsearch and create new http and transport certificates via my Root CA and activate them in Elasticsearch. Do I have to consider somethi… --- ## [Starting Elasticsearch 8.0.1 in Docker](https://discuss.elastic.co/t/starting-elasticsearch-8-0-1-in-docker/298997)
**Author:** [@SwampyFox](https://discuss.elastic.co/u/SwampyFox)\ **Replies:** 2\ **Last updated:** [March 31, 2022, 2:51am UTC](https://discuss.elastic.co/t/starting-elasticsearch-8-0-1-in-docker/298997 "2022-03-31T02:51:08Z")
I am running the following docker run command docker run --name es01 --net elastic -p 9200:9200 -v /home/cbryan/Elasticsearch.yml:/usr/share/Elasticsearch/config/Elasticsearch.yml -it docker.elastic.co/elasticsearch/ela… --- ## [When mounting \`elasticsearch.yml\`, docker displays \`Device or resource busy\`](https://discuss.elastic.co/t/when-mounting-elasticsearch-yml-docker-displays-device-or-resource-busy/300981)
**Author:** [@linghengqian](https://discuss.elastic.co/u/linghengqian)\ **Replies:** 3\ **Last updated:** [March 31, 2022, 2:49am UTC](https://discuss.elastic.co/t/when-mounting-elasticsearch-yml-docker-displays-device-or-resource-busy/300981 "2022-03-31T02:49:12Z")
I tried to mount elasticsearch.yml and kibana.yml inside docker-compose.yml. For kibana, it is very smooth, but for Elasticsearch, an exception is thrown and the corresponding service is aborted, which confuses me. The … --- ## [After a while the logs stop](https://discuss.elastic.co/t/after-a-while-the-logs-stop/301030)
**Author:** [@Arraso26](https://discuss.elastic.co/u/Arraso26)\ **Replies:** 1\ **Last updated:** [March 30, 2022, 11:49pm UTC](https://discuss.elastic.co/t/after-a-while-the-logs-stop/301030 "2022-03-30T23:49:48Z")
Hello, my problem for half an hour the logs arrive perfect but after about 30 minutes or so the logs stop arriving and I get all the time the log shown below or one very similar and the rest of the logs do not arrive, I … --- ## [Delete oldest index if storage is full](https://discuss.elastic.co/t/delete-oldest-index-if-storage-is-full/301115)
**Author:** [@6NMgfDwZ3](https://discuss.elastic.co/u/6NMgfDwZ3)\ **Replies:** 1\ **Last updated:** [March 30, 2022, 11:46pm UTC](https://discuss.elastic.co/t/delete-oldest-index-if-storage-is-full/301115 "2022-03-30T23:46:36Z")
Hello, ELK stack version: v7.x ... latest I've created an ILM policy that deletes the index if the index is older than x days. It works well. But sometimes too many documents arrive into the indexes so the storage bec… --- ## [Request/API to display detailed view of elasticsearch index field options](https://discuss.elastic.co/t/request-api-to-display-detailed-view-of-elasticsearch-index-field-options/301128)
**Author:** [@shi](https://discuss.elastic.co/u/shi)\ **Replies:** 1\ **Last updated:** [March 30, 2022, 11:45pm UTC](https://discuss.elastic.co/t/request-api-to-display-detailed-view-of-elasticsearch-index-field-options/301128 "2022-03-30T23:45:23Z")
I have defined datatype and set the following options for some of the fields of an index "doc\_values": true "enabled ": false "index": false Even though data is getting indexed and some of the set options can be viewe… --- ## [Make in india percentage(This is a purchase related query)](https://discuss.elastic.co/t/make-in-india-percentage-this-is-a-purchase-related-query/301124)
**Author:** [@shi](https://discuss.elastic.co/u/shi)\ **Replies:** 3\ **Last updated:** [March 30, 2022, 7:48pm UTC](https://discuss.elastic.co/t/make-in-india-percentage-this-is-a-purchase-related-query/301124 "2022-03-30T19:48:18Z")
What is the make in india percentage for Elasticsearch? (This is a non technical query) regards shini --- ## [Using synonyms file in Elastic Cloud](https://discuss.elastic.co/t/using-synonyms-file-in-elastic-cloud/301136)
**Author:** [@Conor\_Hennessy](https://discuss.elastic.co/u/Conor_Hennessy)\ **Replies:** 0\ **Last updated:** [March 30, 2022, 5:53pm UTC](https://discuss.elastic.co/t/using-synonyms-file-in-elastic-cloud/301136 "2022-03-30T17:53:46Z")
Hi, In order to use synonyms in Elasticsearch, we can use a .txt file with a list of our synonyms and add the path to this file in our index definition. See below as an example: PUT /test\_index { "settings": { "i… --- ## [Reusing internal implementation to transform JSON mapping to ES mapping](https://discuss.elastic.co/t/reusing-internal-implementation-to-transform-json-mapping-to-es-mapping/300597)
**Author:** [@vred](https://discuss.elastic.co/u/vred)\ **Replies:** 2\ **Last updated:** [March 30, 2022, 5:24pm UTC](https://discuss.elastic.co/t/reusing-internal-implementation-to-transform-json-mapping-to-es-mapping/300597 "2022-03-30T17:24:04Z")
Hello all, I have a use case where I have to do some validation on the JSON mapping passed into the PUT request body. There are several keywords (like dynamic, include\_in\_parent, etc.) and I cannot account for them all w… --- ## [Multi node setup for elastic search](https://discuss.elastic.co/t/multi-node-setup-for-elastic-search/301116)
**Author:** [@shi](https://discuss.elastic.co/u/shi)\ **Replies:** 3\ **Last updated:** [March 30, 2022, 4:54pm UTC](https://discuss.elastic.co/t/multi-node-setup-for-elastic-search/301116 "2022-03-30T16:54:41Z")
Is it possible to set up Elasticsearch in a multiple nodes architecture with basic license? regards shini --- ## [Fs-crawler for data scraping](https://discuss.elastic.co/t/fs-crawler-for-data-scraping/301063)
**Author:** [@Um\_Ar](https://discuss.elastic.co/u/Um_Ar)\ **Replies:** 1\ **Last updated:** [March 30, 2022, 4:37pm UTC](https://discuss.elastic.co/t/fs-crawler-for-data-scraping/301063 "2022-03-30T16:37:30Z")
I would like to use fs-crawler for page by page data extraction or extract data based on title hierarchy(title) instead of getting all the data of a document in a single row. --- ## [Not able to access my elasticsearch url via public IP](https://discuss.elastic.co/t/not-able-to-access-my-elasticsearch-url-via-public-ip/301110)
**Author:** [@sandeepbisht](https://discuss.elastic.co/u/sandeepbisht)\ **Replies:** 6\ **Last updated:** [March 30, 2022, 4:14pm UTC](https://discuss.elastic.co/t/not-able-to-access-my-elasticsearch-url-via-public-ip/301110 "2022-03-30T16:14:08Z")
Hi All, I am not able to able to access url via public IP on port 9200. Even when i changed below setting in config file and tried to restart service, getting below error. network.host: \ http.port: 9200 r… --- ## [How to add leading zeros to a numeric field using the ingest pipeline?](https://discuss.elastic.co/t/how-to-add-leading-zeros-to-a-numeric-field-using-the-ingest-pipeline/300885)
**Author:** [@Patr123](https://discuss.elastic.co/u/Patr123)\ **Replies:** 2\ **Last updated:** [March 30, 2022, 3:36pm UTC](https://discuss.elastic.co/t/how-to-add-leading-zeros-to-a-numeric-field-using-the-ingest-pipeline/300885 "2022-03-30T15:36:43Z")
I have a field that needs to be a 3 digit field always. so if the field value is 1 it should be coming in as 001 and if its 11 then it should be coming in as 011. I am parsing this field from a different field using the… --- ## [Metric aggregations on custom fields that use flattened field type](https://discuss.elastic.co/t/metric-aggregations-on-custom-fields-that-use-flattened-field-type/300724)
**Author:** [@amkoehler](https://discuss.elastic.co/u/amkoehler)\ **Replies:** 5\ **Last updated:** [March 30, 2022, 2:52pm UTC](https://discuss.elastic.co/t/metric-aggregations-on-custom-fields-that-use-flattened-field-type/300724 "2022-03-30T14:52:32Z")
Hello, I am looking for a way to index our documents in such a way that gives me the ability to run metric aggregations on custom number fields. Here's an example data structure we are indexing: { name: 'My Element',… --- ## [Elastic Agent for syslog](https://discuss.elastic.co/t/elastic-agent-for-syslog/301104)
**Author:** [@hebph001](https://discuss.elastic.co/u/hebph001)\ **Replies:** 0\ **Last updated:** [March 30, 2022, 2:27pm UTC](https://discuss.elastic.co/t/elastic-agent-for-syslog/301104 "2022-03-30T14:27:12Z")
Hi Elastic community, I am trying to determine what would be the best and easiest way to gather logs and metrics from 35 SLES 12 servers because Elastic Agent is not supported on that version. I am currently collecting … --- ## [ESRally issue when running EventData track](https://discuss.elastic.co/t/esrally-issue-when-running-eventdata-track/300858)
**Author:** [@Kailas](https://discuss.elastic.co/u/Kailas)\ **Replies:** 7\ **Last updated:** [March 30, 2022, 1:56pm UTC](https://discuss.elastic.co/t/esrally-issue-when-running-eventdata-track/300858 "2022-03-30T13:56:29Z")
There were some network changes and the Rally process stopped in between and the state of ES was in “yellow/red”. Hence I deleted to index from the ES cluster. Now, when I run the below Rally command esrally race --kil… --- ## [Accidentally deleted .security index for x-pack](https://discuss.elastic.co/t/accidentally-deleted-security-index-for-x-pack/69844)
**Author:** [@Johntdyer](https://discuss.elastic.co/u/Johntdyer)\ **Replies:** 3\ **Last updated:** [March 30, 2022, 12:29pm UTC](https://discuss.elastic.co/t/accidentally-deleted-security-index-for-x-pack/69844 "2022-03-30T12:29:45Z")
So by some horrible error we deleted the .security index for x-pack. How do we get that back? We tried reinstalling in a lab deployment and it didnt seem to recover that index. --- ## [Unable to search double quotes](https://discuss.elastic.co/t/unable-to-search-double-quotes/301024)
**Author:** [@Abhi\_Abhishek](https://discuss.elastic.co/u/Abhi_Abhishek)\ **Replies:** 0\ **Last updated:** [March 30, 2022, 4:40am UTC](https://discuss.elastic.co/t/unable-to-search-double-quotes/301024 "2022-03-30T04:40:14Z")
I have a field unitDesignator = "" Even if I escape with backslash no output & field type is text. { "query":{ "match":{ "unitDesignator"="\\"\\"" } } } Can anyone help me please. --- ## [When to apply Stemmer, Stop Word and Synonym Filters](https://discuss.elastic.co/t/when-to-apply-stemmer-stop-word-and-synonym-filters/301076)
**Author:** [@duncRed](https://discuss.elastic.co/u/duncRed)\ **Replies:** 0\ **Last updated:** [March 30, 2022, 10:50am UTC](https://discuss.elastic.co/t/when-to-apply-stemmer-stop-word-and-synonym-filters/301076 "2022-03-30T10:50:05Z")
When creating an index we apply filters in the following order: Stop token filter Stemmer token filter Synonym filter - these are user defined and then included in the index We apply them in this order due to the fol… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=464) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=466)