# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=466 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 467 --- ## [Elasticsearch crashes after a few minutes on VM](https://discuss.elastic.co/t/elasticsearch-crashes-after-a-few-minutes-on-vm/300487)
**Author:** [@fidegnon](https://discuss.elastic.co/u/fidegnon)\ **Replies:** 10\ **Last updated:** [March 30, 2022, 9:31am UTC](https://discuss.elastic.co/t/elasticsearch-crashes-after-a-few-minutes-on-vm/300487 "2022-03-30T09:31:50Z")
I have two identical VM where ELK 6.6.2 is running, they are independent and not configured as a cluster. On one Elasticsearch is running fine, on the other Elasticsearch crashes a few minutes after starting. Here is t… --- ## [Using an element of an array as match\_field in enrich policy](https://discuss.elastic.co/t/using-an-element-of-an-array-as-match-field-in-enrich-policy/301059)
**Author:** [@mustafa\_savran](https://discuss.elastic.co/u/mustafa_savran)\ **Replies:** 0\ **Last updated:** [March 30, 2022, 8:56am UTC](https://discuss.elastic.co/t/using-an-element-of-an-array-as-match-field-in-enrich-policy/301059 "2022-03-30T08:56:40Z")
I have been trying to use the element of an array as match\_field in enrich policy but I didn't achieve this. I have an array contains a bbox, a multi polygon and geo point respectively and I mapped this array as geo\_sh… --- ## [Connection errors during indexing using goroutines](https://discuss.elastic.co/t/connection-errors-during-indexing-using-goroutines/301040)
**Author:** [@apo\_p9](https://discuss.elastic.co/u/apo_p9)\ **Replies:** 4\ **Last updated:** [March 30, 2022, 8:52am UTC](https://discuss.elastic.co/t/connection-errors-during-indexing-using-goroutines/301040 "2022-03-30T08:52:28Z")
I have a syncing utility in Go, that moves data from MongoDB to ES. Here is the gist of it. Create workgroup, launch a goroutine listening on a channel, pull results from Mongo and publish to a channel which will index i… --- ## [Not getting perfect results (Am using elasticsearch dsl for django ) and please help me](https://discuss.elastic.co/t/not-getting-perfect-results-am-using-elasticsearch-dsl-for-django-and-please-help-me/300994)
**Author:** [@RohitBR\_K](https://discuss.elastic.co/u/RohitBR_K)\ **Replies:** 1\ **Last updated:** [March 30, 2022, 7:57am UTC](https://discuss.elastic.co/t/not-getting-perfect-results-am-using-elasticsearch-dsl-for-django-and-please-help-me/300994 "2022-03-30T07:57:31Z")
Here am searching for juices and am getting the juice products but also am getting other products that includes letter j ,u, i, c, e. Here i used nGram with match query and i used min diff =1 and max diff = 20. kindly pl… --- ## [Elaticsearch Java client output dsl](https://discuss.elastic.co/t/elaticsearch-java-client-output-dsl/300952)
**Author:** [@supermario](https://discuss.elastic.co/u/supermario)\ **Replies:** 12\ **Last updated:** [March 30, 2022, 7:52am UTC](https://discuss.elastic.co/t/elaticsearch-java-client-output-dsl/300952 "2022-03-30T07:52:49Z")
I am using Elasticsearch java Client version 8.1. I want to output dsl by searchrequest, but i don't find any function. I look forward hearing your reply,thanks. --- ## [Watcher cannot be started after upgrading Elasticsearch 7.x to Elasticsearch 8.x](https://discuss.elastic.co/t/watcher-cannot-be-started-after-upgrading-elasticsearch-7-x-to-elasticsearch-8-x/301041)
**Author:** [@yohanwongso](https://discuss.elastic.co/u/yohanwongso)\ **Replies:** 1\ **Last updated:** [March 30, 2022, 7:52am UTC](https://discuss.elastic.co/t/watcher-cannot-be-started-after-upgrading-elasticsearch-7-x-to-elasticsearch-8-x/301041 "2022-03-30T07:52:27Z")
The watcher is stop working just after the Elasticsearch has been upgraded to version 8.x. At the Kibana's Stack Management -\> Watcher, the state of all active watchers are OK, but the watchers haven't been triggered ev… --- ## [Not able to start elasticsearch-2.0](https://discuss.elastic.co/t/not-able-to-start-elasticsearch-2-0/300339)
**Author:** [@siddarthhegde](https://discuss.elastic.co/u/siddarthhegde)\ **Replies:** 2\ **Last updated:** [March 30, 2022, 7:24am UTC](https://discuss.elastic.co/t/not-able-to-start-elasticsearch-2-0/300339 "2022-03-30T07:24:17Z")
Elasticsearch version 2.0 OS: Linux I am not able to start Elasticsearch and I am getting the following error: \[ERROR\]\[gateway \] \[Node\] failed to read local state, exiting... ElasticsearchException\[mu… --- ## [Am I losing data?](https://discuss.elastic.co/t/am-i-losing-data/300819)
**Author:** [@anon90868141](https://discuss.elastic.co/u/anon90868141)\ **Replies:** 4\ **Last updated:** [March 30, 2022, 6:48am UTC](https://discuss.elastic.co/t/am-i-losing-data/300819 "2022-03-30T06:48:54Z")
Hi guys, I'm currently not sure if I'm losing data. Last monday, I restarted the Elasticsearch cluster. Sadly, I restarted the master nodes all at the same time and didn't deactivate the shard allocation. I changed the… --- ## [Elastcsearch client - javascript connection error](https://discuss.elastic.co/t/elastcsearch-client-javascript-connection-error/300894)
**Author:** [@VV1002](https://discuss.elastic.co/u/VV1002)\ **Replies:** 7\ **Last updated:** [March 30, 2022, 5:56am UTC](https://discuss.elastic.co/t/elastcsearch-client-javascript-connection-error/300894 "2022-03-30T05:56:11Z")
Hi, I am running a 7.17 Elasticsearch and kibana services using docker compose with xpack security disabled (local env). I am developing an express application for some data manipulation so trying to use the Elasticsear… --- ## [How to create rule when monitor is up in UPTIME?](https://discuss.elastic.co/t/how-to-create-rule-when-monitor-is-up-in-uptime/300940)
**Author:** [@shivendra95](https://discuss.elastic.co/u/shivendra95)\ **Replies:** 2\ **Last updated:** [March 30, 2022, 5:24am UTC](https://discuss.elastic.co/t/how-to-create-rule-when-monitor-is-up-in-uptime/300940 "2022-03-30T05:24:46Z")
I was exploring the alerting capabilities in ELK, found a way to trigger alerts when any monitor is down in Uptime App. I also want to trigger alerts when the downed service has come back up again but I'm not able creat… --- ## [Help me, question! java.io.IOException: Unable to parse response body for Response{requestLine=PUT](https://discuss.elastic.co/t/help-me-question-java-io-ioexception-unable-to-parse-response-body-for-response-requestline-put/301028)
**Author:** [@wonderfulLand](https://discuss.elastic.co/u/wonderfulLand)\ **Replies:** 0\ **Last updated:** [March 30, 2022, 5:21am UTC](https://discuss.elastic.co/t/help-me-question-java-io-ioexception-unable-to-parse-response-body-for-response-requestline-put/301028 "2022-03-30T05:21:55Z")
Elasticsearch vesion :8.1.0 pom file: \ 4.0.0 org.springframework.boot spring-boot-starter-parent 2.6.4 com.example elasticsearchdemo 0.0.1-SNAPSHOT elasticsearchdem… --- ## [Help me! search rate spike down](https://discuss.elastic.co/t/help-me-search-rate-spike-down/301023)
**Author:** [@slowup](https://discuss.elastic.co/u/slowup)\ **Replies:** 0\ **Last updated:** [March 30, 2022, 4:06am UTC](https://discuss.elastic.co/t/help-me-search-rate-spike-down/301023 "2022-03-30T04:06:34Z")
Hi! Nice to meet you all I'm having a problem with lag issues due to a sharp drop in search rate In other words, the APIs that request a search to elasticseach are experiencing a timeout. I think the image below will e… --- ## [ES not search with hyphen](https://discuss.elastic.co/t/es-not-search-with-hyphen/300769)
**Author:** [@EnJay](https://discuss.elastic.co/u/EnJay)\ **Replies:** 8\ **Last updated:** [March 30, 2022, 12:54am UTC](https://discuss.elastic.co/t/es-not-search-with-hyphen/300769 "2022-03-30T00:54:42Z")
Hello :slight\_smile: I can't figure out the problem at all. I have a field with a title. The name consists of a hyphen. This is: "usd-coin". I'm trying to search with this query: { "sort": \[ { "… --- ## [Would it be deleted the closed index in delete phase of ILM?](https://discuss.elastic.co/t/would-it-be-deleted-the-closed-index-in-delete-phase-of-ilm/300912)
**Author:** [@m-amano](https://discuss.elastic.co/u/m-amano)\ **Replies:** 2\ **Last updated:** [March 30, 2022, 12:22am UTC](https://discuss.elastic.co/t/would-it-be-deleted-the-closed-index-in-delete-phase-of-ilm/300912 "2022-03-30T00:22:35Z")
Does ILM support the closed index to be deleted in delete phase? Or should I reopen the index? --- ## [Officially recommended cluster planning](https://discuss.elastic.co/t/officially-recommended-cluster-planning/300539)
**Author:** [@casterQ](https://discuss.elastic.co/u/casterQ)\ **Replies:** 1\ **Last updated:** [March 29, 2022, 10:38pm UTC](https://discuss.elastic.co/t/officially-recommended-cluster-planning/300539 "2022-03-29T22:38:30Z")
Are there any suggestions for cluster planning and hardware resources： Recommended configuration of CPU？ If there are only a few servers, do you need independent master and coordinating nodes？or reuse server for multip… --- ## [Return other fields in highlight](https://discuss.elastic.co/t/return-other-fields-in-highlight/300898)
**Author:** [@matty\_r](https://discuss.elastic.co/u/matty_r)\ **Replies:** 3\ **Last updated:** [March 29, 2022, 10:28pm UTC](https://discuss.elastic.co/t/return-other-fields-in-highlight/300898 "2022-03-29T22:28:07Z")
Hi all, When highlighting a field, i'd like to also return both fields that are associated. I have the setup below. I want to highlight comment.message, but return both comment.message and comment.id: PUT temp-test { … --- ## [Service Failed to Run: Failed to find metadata for existing index \>\> Failed to bind service \>\> Failed to read or upgrade local state](https://discuss.elastic.co/t/service-failed-to-run-failed-to-find-metadata-for-existing-index-failed-to-bind-service-failed-to-read-or-upgrade-local-state/300836)
**Author:** [@tgs.vaibhav](https://discuss.elastic.co/u/tgs.vaibhav)\ **Replies:** 3\ **Last updated:** [March 29, 2022, 9:58pm UTC](https://discuss.elastic.co/t/service-failed-to-run-failed-to-find-metadata-for-existing-index-failed-to-bind-service-failed-to-read-or-upgrade-local-state/300836 "2022-03-29T21:58:20Z")
\[2022-03-28T06:42:22,558\]\[INFO \]\[o.e.x.m.p.l.CppLogMessageHandler\] \[SYSTNAME\] \[controller/13524\] \[Main.cc@110\] controller (64 bit): Version 7.3.2 (Build 265429af874fbe) Copyright (c) 2019 Elasticsearch BV \[2022-03-28T06:… --- ## [Frozen Tier](https://discuss.elastic.co/t/frozen-tier/299368)
**Author:** [@tmahany419](https://discuss.elastic.co/u/tmahany419)\ **Replies:** 4\ **Last updated:** [March 29, 2022, 8:49pm UTC](https://discuss.elastic.co/t/frozen-tier/299368 "2022-03-29T20:49:39Z")
What's the difference between searchable snapshots and the frozen tier? Reading the documentation is looks like Frozen tier uses searchable snapshots and reading the searchable snapshot documentation it looks like the o… --- ## [Moving over snapshot to another system doesn't get added to registered repo](https://discuss.elastic.co/t/moving-over-snapshot-to-another-system-doesnt-get-added-to-registered-repo/300892)
**Author:** [@hishamnajem](https://discuss.elastic.co/u/hishamnajem)\ **Replies:** 5\ **Last updated:** [March 29, 2022, 8:31pm UTC](https://discuss.elastic.co/t/moving-over-snapshot-to-another-system-doesnt-get-added-to-registered-repo/300892 "2022-03-29T20:31:49Z")
I am taking a snapshot on system 1 and transferring the index-X, index.latest, meta-... and snap-.... over to system 2 under the same registered repo. System 2 does not find snapshot for restore. On SYSTEM 1: --\> curl … --- ## [Failing to parse datestamp](https://discuss.elastic.co/t/failing-to-parse-datestamp/301005)
**Author:** [@stevedwray](https://discuss.elastic.co/u/stevedwray)\ **Replies:** 2\ **Last updated:** [March 29, 2022, 8:25pm UTC](https://discuss.elastic.co/t/failing-to-parse-datestamp/301005 "2022-03-29T20:25:05Z")
I'm using Integrations/Upload file, something I've done many times before with CSV files. I have a CSV file that has a datestamp field like this: 11/01/2022 06:00:06 PM which is from January, so the 01 is the month an… --- ## [How to change replica for system indices](https://discuss.elastic.co/t/how-to-change-replica-for-system-indices/300415)
**Author:** [@lusynda](https://discuss.elastic.co/u/lusynda)\ **Replies:** 7\ **Last updated:** [March 29, 2022, 6:08pm UTC](https://discuss.elastic.co/t/how-to-change-replica-for-system-indices/300415 "2022-03-29T18:08:32Z")
Hi all, I wanted to change the number of replicas for Elasticsearch system indices. I know that the forbit it but is there a way to override that to increase the number of indices or replicas for elastic system indices… --- ## [ElasticSearch 8.1.1 Java API - Sort doesn't work](https://discuss.elastic.co/t/elasticsearch-8-1-1-java-api-sort-doesnt-work/301003)
**Author:** [@AKDAS\_System](https://discuss.elastic.co/u/AKDAS_System)\ **Replies:** 1\ **Last updated:** [March 29, 2022, 7:06pm UTC](https://discuss.elastic.co/t/elasticsearch-8-1-1-java-api-sort-doesnt-work/301003 "2022-03-29T19:06:19Z")
Hello, I'm currently in the process of migrating from Elasticsearch 6.8 to the new Java API in 8.1.1. So far everything is going well but the only problem that is left is that adding sort to SearchRequest breaks everythi… --- ## [Doubts for SSL certs renew on ELK stack v8](https://discuss.elastic.co/t/doubts-for-ssl-certs-renew-on-elk-stack-v8/300959)
**Author:** [@gustavoluza](https://discuss.elastic.co/u/gustavoluza)\ **Replies:** 3\ **Last updated:** [March 29, 2022, 6:37pm UTC](https://discuss.elastic.co/t/doubts-for-ssl-certs-renew-on-elk-stack-v8/300959 "2022-03-29T18:37:49Z")
i have an ELK stack version 8 environment and i use the default security configuration for Elasticsearch, with the default certificates (http\_ca.crt, http.p12, transport.p12), at the moment the environment works fine wit… --- ## [And/OR DSL Query](https://discuss.elastic.co/t/and-or-dsl-query/300985)
**Author:** [@JeremyP](https://discuss.elastic.co/u/JeremyP)\ **Replies:** 0\ **Last updated:** [March 29, 2022, 2:56pm UTC](https://discuss.elastic.co/t/and-or-dsl-query/300985 "2022-03-29T14:56:08Z")
Hello, I'm having a difficult time getting a DSL query to work right with a combination of an AND and OR. For the OR side, one of the two must be present in the document.... { "state": "active" } { "state": "re-surfa… --- ## [Terminate user session based on time period](https://discuss.elastic.co/t/terminate-user-session-based-on-time-period/300975)
**Author:** [@dkaflowitz](https://discuss.elastic.co/u/dkaflowitz)\ **Replies:** 2\ **Last updated:** [March 29, 2022, 2:18pm UTC](https://discuss.elastic.co/t/terminate-user-session-based-on-time-period/300975 "2022-03-29T14:18:46Z")
Can Elasticsearch be configured to terminate and log out privileged users after a set period? If so, is it documented anywhere? --- ## [Reindex from AWS elasticsearch to elastic cloud](https://discuss.elastic.co/t/reindex-from-aws-elasticsearch-to-elastic-cloud/300911)
**Author:** [@Vadiraj\_B](https://discuss.elastic.co/u/Vadiraj_B)\ **Replies:** 3\ **Last updated:** [March 29, 2022, 2:02pm UTC](https://discuss.elastic.co/t/reindex-from-aws-elasticsearch-to-elastic-cloud/300911 "2022-03-29T14:02:55Z")
We have a AWS Elasticsearch cluster. We are trying to reindex this onto elastic cloud instance. We have created Elasticsearch intstance on elastic cloud. and from kibana trying to reindex. We have listed remote source (A… --- ## [Create and email report based on query](https://discuss.elastic.co/t/create-and-email-report-based-on-query/300971)
**Author:** [@ddraganp6](https://discuss.elastic.co/u/ddraganp6)\ **Replies:** 0\ **Last updated:** [March 29, 2022, 1:55pm UTC](https://discuss.elastic.co/t/create-and-email-report-based-on-query/300971 "2022-03-29T13:55:02Z")
Hi everyone, I was able to succesfully retrieve the data I need - my top 10 most ERROR log producing applications - using this query : GET \_search { "size": 0, "query": { "bool": { "must": \[ { … --- ## [Write and then Read consistency](https://discuss.elastic.co/t/write-and-then-read-consistency/300785)
**Author:** [@TheGreatBaldOne](https://discuss.elastic.co/u/TheGreatBaldOne)\ **Replies:** 2\ **Last updated:** [March 29, 2022, 1:11pm UTC](https://discuss.elastic.co/t/write-and-then-read-consistency/300785 "2022-03-29T13:11:59Z")
I am trying to achieve write and then read consistency. In other words, once i update or insert a document, I want to immediately read it correctly. I am getting a a list of a user's posts from ES insert a new pos… --- ## [Input the data into Elastic](https://discuss.elastic.co/t/input-the-data-into-elastic/300957)
**Author:** [@Thiago\_Paiva](https://discuss.elastic.co/u/Thiago_Paiva)\ **Replies:** 1\ **Last updated:** [March 29, 2022, 1:00pm UTC](https://discuss.elastic.co/t/input-the-data-into-elastic/300957 "2022-03-29T13:00:33Z")
Hi, I have an elastic cluster with 3 master nodes, ten data nodes, and of these three are ingest too. But all nodes accept data in elastic open port. I used in the logstash output master:port and node:port, always \_docs… --- ## [Can't remove key in keystone](https://discuss.elastic.co/t/cant-remove-key-in-keystone/300943)
**Author:** [@chaishiqi](https://discuss.elastic.co/u/chaishiqi)\ **Replies:** 1\ **Last updated:** [March 29, 2022, 12:53pm UTC](https://discuss.elastic.co/t/cant-remove-key-in-keystone/300943 "2022-03-29T12:53:52Z")
/usr/share/Elasticsearch/bin/Elasticsearch-keystore remove xpack.security.authc.realms.oidc.oidc1.rp.client\_secret ERROR: will not overwrite keystore at \[/etc/Elasticsearch/Elasticsearch.keystore\], because this incurs c… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=465) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=467)