# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=469 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 470 --- ## [How to update all docs with query that looks for a regex and update it incase found](https://discuss.elastic.co/t/how-to-update-all-docs-with-query-that-looks-for-a-regex-and-update-it-incase-found/299894)
**Author:** [@ShayWeizman](https://discuss.elastic.co/u/ShayWeizman)\ **Replies:** 12\ **Last updated:** [March 25, 2022, 1:52pm UTC](https://discuss.elastic.co/t/how-to-update-all-docs-with-query-that-looks-for-a-regex-and-update-it-incase-found/299894 "2022-03-25T13:52:07Z")
Hi, I'm using 7.16.2. I have a lot of records looks like this { "\_index" : "testcases", "\_type" : "\_doc", "\_id" : "Cv6z8HoBF-BJEaLQYGtU", "\_score" : 1.0, "\_source" : { … --- ## [Error Field \[data\] not present as part of path \[data\]](https://discuss.elastic.co/t/error-field-data-not-present-as-part-of-path-data/300642)
**Author:** [@Enxiad](https://discuss.elastic.co/u/Enxiad)\ **Replies:** 2\ **Last updated:** [March 25, 2022, 12:41pm UTC](https://discuss.elastic.co/t/error-field-data-not-present-as-part-of-path-data/300642 "2022-03-25T12:41:01Z")
(Redacted for improved clarity, please see next post on this thread) --- ## [ILM pattern is incrementing by two numbers instead of one](https://discuss.elastic.co/t/ilm-pattern-is-incrementing-by-two-numbers-instead-of-one/299882)
**Author:** [@adminunix](https://discuss.elastic.co/u/adminunix)\ **Replies:** 1\ **Last updated:** [March 25, 2022, 12:31pm UTC](https://discuss.elastic.co/t/ilm-pattern-is-incrementing-by-two-numbers-instead-of-one/299882 "2022-03-25T12:31:44Z")
Hi, I have a strange issue with new backing indices creates after rollover. Suffix number is incrementing by two numbers instead of one. Initially, ILM generated new indices with correct names incrementing only one… --- ## [How to return data that has particular columns in every \_source dictionary in Elasticsearch?](https://discuss.elastic.co/t/how-to-return-data-that-has-particular-columns-in-every-source-dictionary-in-elasticsearch/300680)
**Author:** [@Harish\_fragger](https://discuss.elastic.co/u/Harish_fragger)\ **Replies:** 1\ **Last updated:** [March 25, 2022, 10:41am UTC](https://discuss.elastic.co/t/how-to-return-data-that-has-particular-columns-in-every-source-dictionary-in-elasticsearch/300680 "2022-03-25T10:41:50Z")
I have an Elasticsearch query which is extracting data from the following fields "\_source": \["data.service","data.vpn","data.policyid","data.srccountry1"\] . While using the search function which gives only max hits of 10… --- ## [Multi level Transform with Elasticsearch](https://discuss.elastic.co/t/multi-level-transform-with-elasticsearch/300226)
**Author:** [@bianca6](https://discuss.elastic.co/u/bianca6)\ **Replies:** 1\ **Last updated:** [March 25, 2022, 10:30am UTC](https://discuss.elastic.co/t/multi-level-transform-with-elasticsearch/300226 "2022-03-25T10:30:05Z")
Hi, I have different logs just like this: timestamp = A, group = B, objectCount= C timestamp = A, group = B, object = D, value = E timestamp = A, group = B, object = F, value = G I already use a Transform which group… --- ## [Unable to view namespace labels in report, only pod level labels work](https://discuss.elastic.co/t/unable-to-view-namespace-labels-in-report-only-pod-level-labels-work/300683)
**Author:** [@MChal](https://discuss.elastic.co/u/MChal)\ **Replies:** 1\ **Last updated:** [March 25, 2022, 10:01am UTC](https://discuss.elastic.co/t/unable-to-view-namespace-labels-in-report-only-pod-level-labels-work/300683 "2022-03-25T10:01:42Z")
Hey there, I'm looking to create a report that aggregates CPU and Memory usage based on a reporting label. I have labelled some namespaces as a test and my labels don't come up until I also label individual pods. Is the… --- ## [Can we import one elastic search cluster data into another?](https://discuss.elastic.co/t/can-we-import-one-elastic-search-cluster-data-into-another/300529)
**Author:** [@Prashant\_Kamble](https://discuss.elastic.co/u/Prashant_Kamble)\ **Replies:** 14\ **Last updated:** [March 25, 2022, 9:14am UTC](https://discuss.elastic.co/t/can-we-import-one-elastic-search-cluster-data-into-another/300529 "2022-03-25T09:14:48Z")
We have two different clusters created on Elasticsearch server cluster 6.8 cluster 7.10 Just wanted to check is there any way to import data from one cluster to another? If yes, what are the ways to do it without re-i… --- ## [Modsecurity integrations vanished](https://discuss.elastic.co/t/modsecurity-integrations-vanished/299341)
**Author:** [@stefan.pinter](https://discuss.elastic.co/u/stefan.pinter)\ **Replies:** 1\ **Last updated:** [March 25, 2022, 8:55am UTC](https://discuss.elastic.co/t/modsecurity-integrations-vanished/299341 "2022-03-25T08:55:37Z")
hi! a few weeks ago I had the possibility to install the modsecurity integration from within kibana... but now it is gone - can this be an issue on my site? thanks! --- ## [Duplicate document ids when using rolling indices](https://discuss.elastic.co/t/duplicate-document-ids-when-using-rolling-indices/300666)
**Author:** [@vlasami](https://discuss.elastic.co/u/vlasami)\ **Replies:** 0\ **Last updated:** [March 25, 2022, 7:46am UTC](https://discuss.elastic.co/t/duplicate-document-ids-when-using-rolling-indices/300666 "2022-03-25T07:46:27Z")
Hi, We have ES v7.17 and started to use index rolling with ILM (with 40G size limit on index) and faced a document duplication issue that was described in the ILM updating record with existing Id on older index creates… --- ## [Terms aggregation bucket Sorting is not working when using with partition](https://discuss.elastic.co/t/terms-aggregation-bucket-sorting-is-not-working-when-using-with-partition/298502)
**Author:** [@truptir](https://discuss.elastic.co/u/truptir)\ **Replies:** 12\ **Last updated:** [March 25, 2022, 7:47am UTC](https://discuss.elastic.co/t/terms-aggregation-bucket-sorting-is-not-working-when-using-with-partition/298502 "2022-03-25T07:47:04Z")
I am trying to do TermAggregation + Sort order(by \_count) + pagination(using partition). But resulting bucket partitions are not sorted properly. Without using partitions, sorting is working properly. Here is my elasti… --- ## [How to get results from another results field value](https://discuss.elastic.co/t/how-to-get-results-from-another-results-field-value/300014)
**Author:** [@Shushil\_Shankar](https://discuss.elastic.co/u/Shushil_Shankar)\ **Replies:** 3\ **Last updated:** [March 25, 2022, 7:04am UTC](https://discuss.elastic.co/t/how-to-get-results-from-another-results-field-value/300014 "2022-03-25T07:04:41Z")
Hi Everyone, I need to implement a query when the results are returned, from that I need to take one field value then need to get another result from the field, From the above screenshot, I got some results based on … --- ## [Sort before pagination](https://discuss.elastic.co/t/sort-before-pagination/300617)
**Author:** [@Rushil\_Patel](https://discuss.elastic.co/u/Rushil_Patel)\ **Replies:** 1\ **Last updated:** [March 25, 2022, 4:17am UTC](https://discuss.elastic.co/t/sort-before-pagination/300617 "2022-03-25T04:17:14Z")
Hey I am trying to sort and paginate the result simultaneously, but I am not getting the expected result. NOTE: we are using 6.1 version Example: data = \[ { level : 0 time: some date ... other fields } , { level: 1 t… --- ## [Is there a way to automatically apply a mapping?](https://discuss.elastic.co/t/is-there-a-way-to-automatically-apply-a-mapping/300632)
**Author:** [@johnrodey](https://discuss.elastic.co/u/johnrodey)\ **Replies:** 1\ **Last updated:** [March 25, 2022, 4:04am UTC](https://discuss.elastic.co/t/is-there-a-way-to-automatically-apply-a-mapping/300632 "2022-03-25T04:04:11Z")
Currently I have an API that on initialization checks if my index exists, if not it creates it and applies my mapping, then allows the client to index documents. By and large this works well however sometimes we run int… --- ## [How to complete a common word from bunch of docs](https://discuss.elastic.co/t/how-to-complete-a-common-word-from-bunch-of-docs/300549)
**Author:** [@casparxu](https://discuss.elastic.co/u/casparxu)\ **Replies:** 2\ **Last updated:** [March 25, 2022, 2:47am UTC](https://discuss.elastic.co/t/how-to-complete-a-common-word-from-bunch-of-docs/300549 "2022-03-25T02:47:12Z")
Hi there, I'm trying to use 'search\_as\_you\_type' for auto complete. I got the idea of how this works, but stuck with a basic scneario. for exmaple I have a field with type 'search\_as\_you\_type' { "mappings": { "p… --- ## [Why strong rotation](https://discuss.elastic.co/t/why-strong-rotation/300413)
**Author:** [@Oliverwq](https://discuss.elastic.co/u/Oliverwq)\ **Replies:** 2\ **Last updated:** [March 25, 2022, 1:34am UTC](https://discuss.elastic.co/t/why-strong-rotation/300413 "2022-03-25T01:34:04Z")
In ClusterHealthResponse that int numberOfNodes = (int) parsedObjects\[i++\]; int numberOfDataNodes = (int) parsedObjects\[i++\]; int activeShards = (int) parsedObjects\[i++\]; int relocat… --- ## [Ubuntu 20.04 What has happened to "http://artifacts.elastic.co/packages/7.x/apt"](https://discuss.elastic.co/t/ubuntu-20-04-what-has-happened-to-http-artifacts-elastic-co-packages-7-x-apt/300641)
**Author:** [@Russell\_Fulton](https://discuss.elastic.co/u/Russell_Fulton)\ **Replies:** 0\ **Last updated:** [March 24, 2022, 9:00pm UTC](https://discuss.elastic.co/t/ubuntu-20-04-what-has-happened-to-http-artifacts-elastic-co-packages-7-x-apt/300641 "2022-03-24T21:00:07Z")
It appear to have vanished -- Trying to install a new kibaban 7.x instance on a new VM and apt update says E: The repository 'http://artifacts.elastic.co/packages/7.x/apt stable Release' does not have a Release file. a… --- ## [Max\_snapshot\_bytes\_per\_sec - Implications of setting this value](https://discuss.elastic.co/t/max-snapshot-bytes-per-sec-implications-of-setting-this-value/300643)
**Author:** [@bar0n36](https://discuss.elastic.co/u/bar0n36)\ **Replies:** 0\ **Last updated:** [March 24, 2022, 9:37pm UTC](https://discuss.elastic.co/t/max-snapshot-bytes-per-sec-implications-of-setting-this-value/300643 "2022-03-24T21:37:37Z")
I am after a more in depth explanation of the implications of adjusting the max\_snapshot\_bytes\_per\_sec for an S3 repository. Reading the documentation, it is simply described as max\_snapshot\_bytes\_per\_sec (Optional, byt… --- ## [How to implement pagination with large dataset](https://discuss.elastic.co/t/how-to-implement-pagination-with-large-dataset/300550)
**Author:** [@achobanov](https://discuss.elastic.co/u/achobanov)\ **Replies:** 4\ **Last updated:** [March 24, 2022, 9:03pm UTC](https://discuss.elastic.co/t/how-to-implement-pagination-with-large-dataset/300550 "2022-03-24T21:03:08Z")
Environment .Net 5 Elasticsearch.Net.Aws 7.1.0 : NuGet Gallery | Elasticsearch.Net.Aws 7.2.2 Low level client Problem Even with pagination, Elasticsearch's query API does not support more than 10\_000 records by defaul… --- ## [Retrieve all documents with a field value that is included a previous query's field values](https://discuss.elastic.co/t/retrieve-all-documents-with-a-field-value-that-is-included-a-previous-querys-field-values/300639)
**Author:** [@megancooper](https://discuss.elastic.co/u/megancooper)\ **Replies:** 0\ **Last updated:** [March 24, 2022, 8:53pm UTC](https://discuss.elastic.co/t/retrieve-all-documents-with-a-field-value-that-is-included-a-previous-querys-field-values/300639 "2022-03-24T20:53:15Z")
I have a unique query use case that I can't seem to find covered in the documentation. (I'm using ElasticSearch 7.17) I have documents inside an index that are shaped the following way: { parentName: string childre… --- ## [Elasticsearch Cluster - no node visible](https://discuss.elastic.co/t/elasticsearch-cluster-no-node-visible/300338)
**Author:** [@zicherka](https://discuss.elastic.co/u/zicherka)\ **Replies:** 1\ **Last updated:** [March 24, 2022, 8:27pm UTC](https://discuss.elastic.co/t/elasticsearch-cluster-no-node-visible/300338 "2022-03-24T20:27:58Z")
Hi System: CentOS 8 Stream Elasticsearch ver: 8.1.0 Nodes: node1.test.com 192.168.100.101 node2.test.com 192.168.100.102 node3.test.com 192.168.100.103 All nodes can be pinged by IP and FQDN, Firewalld has open port… --- ## [Mapped\_geo\_shape test error but I don't use any geo code v7.16.3](https://discuss.elastic.co/t/mapped-geo-shape-test-error-but-i-dont-use-any-geo-code-v7-16-3/300634)
**Author:** [@brian8371](https://discuss.elastic.co/u/brian8371)\ **Replies:** 0\ **Last updated:** [March 24, 2022, 8:05pm UTC](https://discuss.elastic.co/t/mapped-geo-shape-test-error-but-i-dont-use-any-geo-code-v7-16-3/300634 "2022-03-24T20:05:58Z")
I have a class that extends AbstractQueryTestCase and all of its tests are failing, included ones that I didn't override, with the same stacktrace error: Failed to parse mapping \[\_doc\]: No handler for type \[geo\_shape\] d… --- ## [Cluster Red after system patching forced upgrade 7.16.1 -\> 7.17.1](https://discuss.elastic.co/t/cluster-red-after-system-patching-forced-upgrade-7-16-1-7-17-1/300592)
**Author:** [@thealy](https://discuss.elastic.co/u/thealy)\ **Replies:** 1\ **Last updated:** [March 24, 2022, 7:00pm UTC](https://discuss.elastic.co/t/cluster-red-after-system-patching-forced-upgrade-7-16-1-7-17-1/300592 "2022-03-24T19:00:59Z")
We have and 8 node cluster where the nodes are all running Centos 7. When they were rebooted for patching, the ES version went to 7.17.1. The master node is periodically scrolling these errors: \[2022-03-24T10:59:50,530… --- ## [Elasticsearch Querying Double Nested Object, Match Multiple Rows in Query Within Parent](https://discuss.elastic.co/t/elasticsearch-querying-double-nested-object-match-multiple-rows-in-query-within-parent/300619)
**Author:** [@CoreyFournier](https://discuss.elastic.co/u/CoreyFournier)\ **Replies:** 0\ **Last updated:** [March 24, 2022, 6:30pm UTC](https://discuss.elastic.co/t/elasticsearch-querying-double-nested-object-match-multiple-rows-in-query-within-parent/300619 "2022-03-24T18:30:26Z")
My data model is related to patient records. At the highest level is the Patient, then their information such as Lab Panels and the individual rows of the results of the panel. So it looks like this: {Patient:{Labs:\[{Res… --- ## [What are the limitations of array size at document in elastic search?](https://discuss.elastic.co/t/what-are-the-limitations-of-array-size-at-document-in-elastic-search/300602)
**Author:** [@AhmadHamouda](https://discuss.elastic.co/u/AhmadHamouda)\ **Replies:** 0\ **Last updated:** [March 24, 2022, 4:02pm UTC](https://discuss.elastic.co/t/what-are-the-limitations-of-array-size-at-document-in-elastic-search/300602 "2022-03-24T16:02:17Z")
I have document which have array. { "id" :1, "UserIds":\[1,2,4\] } Given that UserIds is indexed field What are the performance implications of having several elements on UserIds Array on search? Also why when se… --- ## [End to end Testing](https://discuss.elastic.co/t/end-to-end-testing/300598)
**Author:** [@AliBaba](https://discuss.elastic.co/u/AliBaba)\ **Replies:** 0\ **Last updated:** [March 24, 2022, 3:28pm UTC](https://discuss.elastic.co/t/end-to-end-testing/300598 "2022-03-24T15:28:10Z")
Hi, A quick question relating the end to end testing using Nest in c#. I was able to setup an InMemoryConnection for Elasticsearch and be able to get a mock response when I do the search query. The problem is when I ru… --- ## [ECS - Difference between event.id and event.code](https://discuss.elastic.co/t/ecs-difference-between-event-id-and-event-code/299924)
**Author:** [@Sako](https://discuss.elastic.co/u/Sako)\ **Replies:** 4\ **Last updated:** [March 24, 2022, 3:24pm UTC](https://discuss.elastic.co/t/ecs-difference-between-event-id-and-event-code/299924 "2022-03-24T15:24:35Z")
Hi, I have a question regarding the usage of the ECS fields event.id and event.code. What is the intended difference between these two fields? Is there any guidance on how to use them? The example for event.code refer… --- ## [How to understand translog stats](https://discuss.elastic.co/t/how-to-understand-translog-stats/300507)
**Author:** [@jthoni](https://discuss.elastic.co/u/jthoni)\ **Replies:** 2\ **Last updated:** [March 24, 2022, 3:12pm UTC](https://discuss.elastic.co/t/how-to-understand-translog-stats/300507 "2022-03-24T15:12:06Z")
We are seeing the situation where when we restart ES, there is a long recovery time for the shards. The service is down usually for only about 90 seconds, but the recovery can be an hour or so. During my investigation, I… --- ## [How to convert Date to specific format and string to amount conversion](https://discuss.elastic.co/t/how-to-convert-date-to-specific-format-and-string-to-amount-conversion/300591)
**Author:** [@slj](https://discuss.elastic.co/u/slj)\ **Replies:** 0\ **Last updated:** [March 24, 2022, 3:10pm UTC](https://discuss.elastic.co/t/how-to-convert-date-to-specific-format-and-string-to-amount-conversion/300591 "2022-03-24T15:10:46Z")
I am trying to create a aggregation query to filter data if 2 columns in same index is matching. My InputDate is '2022-03-02T03:33:34.000Z' format and exeDate in '2022-03-02'. if both dates are same then need to sum up t… --- ## [Need Some Advice Regarding Data Ingestion](https://discuss.elastic.co/t/need-some-advice-regarding-data-ingestion/299859)
**Author:** [@tthiry](https://discuss.elastic.co/u/tthiry)\ **Replies:** 1\ **Last updated:** [March 24, 2022, 2:58pm UTC](https://discuss.elastic.co/t/need-some-advice-regarding-data-ingestion/299859 "2022-03-24T14:58:19Z")
Hello, I am ingesting Windows certificate data via winlogbeat and the "Microsoft-Windows-CertificateServicesClient-Lifecycle-System/Operational" channel to I can track certificates that are expiring. I am using the "inc… --- ## [Can't open ElasticSearch on browser from outside the server](https://discuss.elastic.co/t/cant-open-elasticsearch-on-browser-from-outside-the-server/229717)
**Author:** [@Hamza\_Dev](https://discuss.elastic.co/u/Hamza_Dev)\ **Replies:** 6\ **Last updated:** [March 24, 2022, 2:43pm UTC](https://discuss.elastic.co/t/cant-open-elasticsearch-on-browser-from-outside-the-server/229717 "2022-03-24T14:43:11Z")
Hi , I'm new with ES I've installed it from the official site on an Azure VM with Centos 7 System, it's successfully installed, when I start the service it started correctly, and when I check the availability of ES, usi… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=468) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=470)