# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=474 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 475 --- ## [ELK installing](https://discuss.elastic.co/t/elk-installing/299936)
**Author:** [@SOC](https://discuss.elastic.co/u/SOC)\ **Replies:** 0\ **Last updated:** [March 17, 2022, 10:31am UTC](https://discuss.elastic.co/t/elk-installing/299936 "2022-03-17T10:31:41Z")
HI All I'm planning for deploy ELK SIEM 8.1 for small organization, as of now I don't have any idea of how many assets or servers i need integrate in ELK SIEM. Please let me know system requirement or server configurat… --- ## [Update by Query elastic on field type as Text - ES 7.17](https://discuss.elastic.co/t/update-by-query-elastic-on-field-type-as-text-es-7-17/299837)
**Author:** [@vitaly1233](https://discuss.elastic.co/u/vitaly1233)\ **Replies:** 3\ **Last updated:** [March 17, 2022, 10:23am UTC](https://discuss.elastic.co/t/update-by-query-elastic-on-field-type-as-text-es-7-17/299837 "2022-03-17T10:23:36Z")
Trying to do "findAndModify" in ES According to doc Update By Query API | Elasticsearch Guide \[7.17\] | Elastic We have mapping as the following: { "dynamic\_templates": \[ { "strings\_as\_keywords": { … --- ## [When using synonyms, got exception "term: xxx analyzed to a token (xxx) with position increment != 1 (got: 0)](https://discuss.elastic.co/t/when-using-synonyms-got-exception-term-xxx-analyzed-to-a-token-xxx-with-position-increment-1-got-0/299259)
**Author:** [@Cindy\_X](https://discuss.elastic.co/u/Cindy_X)\ **Replies:** 1\ **Last updated:** [March 17, 2022, 10:06am UTC](https://discuss.elastic.co/t/when-using-synonyms-got-exception-term-xxx-analyzed-to-a-token-xxx-with-position-increment-1-got-0/299259 "2022-03-17T10:06:18Z")
Hi team, We tried to find the root cause of an exception while using synonyms. This is the synonym filter: "japanese\_index\_synonym": { "type": "synonym\_graph", "lenient": false, "sy… --- ## [Elastic did not load properly. Check the server output for more information](https://discuss.elastic.co/t/elastic-did-not-load-properly-check-the-server-output-for-more-information/299366)
**Author:** [@Lucas\_Roberto](https://discuss.elastic.co/u/Lucas_Roberto)\ **Replies:** 1\ **Last updated:** [March 17, 2022, 10:03am UTC](https://discuss.elastic.co/t/elastic-did-not-load-properly-check-the-server-output-for-more-information/299366 "2022-03-17T10:03:42Z")
I followed the ES Quickstart guide, but I still receiving the error "Elastic did not load properly. Check the server output for more information" when I try to acess the KIbana dashboard on my browser. For information, … --- ## [Upgrade to 8.1 from 7.14.0](https://discuss.elastic.co/t/upgrade-to-8-1-from-7-14-0/299409)
**Author:** [@Disha\_Bodade](https://discuss.elastic.co/u/Disha_Bodade)\ **Replies:** 1\ **Last updated:** [March 17, 2022, 10:03am UTC](https://discuss.elastic.co/t/upgrade-to-8-1-from-7-14-0/299409 "2022-03-17T10:03:21Z")
We are planning to upgrade Elasticsearch from 7.14 to 8.1. The doubt I have is about index templates. As legacy templates are deprecated in favor of composable templates. So before upgrade do we need to change all exist… --- ## [Union of queries in highRestClient java 7.9.1](https://discuss.elastic.co/t/union-of-queries-in-highrestclient-java-7-9-1/299568)
**Author:** [@Anna\_Kuranda](https://discuss.elastic.co/u/Anna_Kuranda)\ **Replies:** 1\ **Last updated:** [March 17, 2022, 10:02am UTC](https://discuss.elastic.co/t/union-of-queries-in-highrestclient-java-7-9-1/299568 "2022-03-17T10:02:18Z")
I try to do few selects in elk and union results of query Like in sql (select .... ) UNION (select..) Is there way todo it in one request ? Thanks --- ## [Outsource parts in queries](https://discuss.elastic.co/t/outsource-parts-in-queries/299450)
**Author:** [@simobrusch](https://discuss.elastic.co/u/simobrusch)\ **Replies:** 1\ **Last updated:** [March 17, 2022, 10:01am UTC](https://discuss.elastic.co/t/outsource-parts-in-queries/299450 "2022-03-17T10:01:03Z")
So let's say I have the following code in C# using NEST: private ISearchResponse\ GetFilteredResultsByIds(ElasticClient client, Query query) { return client.Search\(s =\> s … --- ## [Store certificated in keystore](https://discuss.elastic.co/t/store-certificated-in-keystore/299889)
**Author:** [@ginolegigot](https://discuss.elastic.co/u/ginolegigot)\ **Replies:** 2\ **Last updated:** [March 17, 2022, 9:51am UTC](https://discuss.elastic.co/t/store-certificated-in-keystore/299889 "2022-03-17T09:51:26Z")
Hello, If i properly understood this doc and especially this paragraph: The elasticsearch-certutil outputs a PKCS#12 keystore which includes the CA certificate as a trusted certificate entry. This allows for the keyst… --- ## [DSL Query with match phrase](https://discuss.elastic.co/t/dsl-query-with-match-phrase/299922)
**Author:** [@Divyank\_Mahalle](https://discuss.elastic.co/u/Divyank_Mahalle)\ **Replies:** 1\ **Last updated:** [March 17, 2022, 8:35am UTC](https://discuss.elastic.co/t/dsl-query-with-match-phrase/299922 "2022-03-17T08:35:49Z")
Hi, My Doc in Index. I want to query fields in the source. { "\_index" : "hi-2022.01.04", "\_type" : "\_doc", "\_id" : "-e2AIn4BnkeJqJCuSq9B", "\_version" : 16, "\_seq\_no" : 264786, "\_primary\_term" : 2, "found"… --- ## [Elastic search with tokenizer](https://discuss.elastic.co/t/elastic-search-with-tokenizer/299562)
**Author:** [@fizhhh1997](https://discuss.elastic.co/u/fizhhh1997)\ **Replies:** 4\ **Last updated:** [March 17, 2022, 7:28am UTC](https://discuss.elastic.co/t/elastic-search-with-tokenizer/299562 "2022-03-17T07:28:20Z")
Hi, i am wonder about the important of tokenizer when searching with Elasticsearch ? how can i accurate search with setting tokenizer --- ## [Is ILM (index lifecycle management) supported in Elassticsearch-OSS？](https://discuss.elastic.co/t/is-ilm-index-lifecycle-management-supported-in-elassticsearch-oss/299916)
**Author:** [@805728578](https://discuss.elastic.co/u/805728578)\ **Replies:** 1\ **Last updated:** [March 17, 2022, 5:55am UTC](https://discuss.elastic.co/t/is-ilm-index-lifecycle-management-supported-in-elassticsearch-oss/299916 "2022-03-17T05:55:19Z")
version: 6.8.23 --- ## [ERROR: Failed to determine the health of the cluster. Unexpected http status \[403\]](https://discuss.elastic.co/t/error-failed-to-determine-the-health-of-the-cluster-unexpected-http-status-403/299836)
**Author:** [@ArunKumarC](https://discuss.elastic.co/u/ArunKumarC)\ **Replies:** 3\ **Last updated:** [March 17, 2022, 5:14am UTC](https://discuss.elastic.co/t/error-failed-to-determine-the-health-of-the-cluster-unexpected-http-status-403/299836 "2022-03-17T05:14:10Z")
ERROR: Failed to determine the health of the cluster. Unexpected http status \[403\] not able to get the enrollment token getting above error. please help me on this issue --- ## [Does BULK API returns results before task is completed?](https://discuss.elastic.co/t/does-bulk-api-returns-results-before-task-is-completed/299911)
**Author:** [@lonewolf](https://discuss.elastic.co/u/lonewolf)\ **Replies:** 3\ **Last updated:** [March 17, 2022, 4:33am UTC](https://discuss.elastic.co/t/does-bulk-api-returns-results-before-task-is-completed/299911 "2022-03-17T04:33:07Z")
I am using Elasticsearch-python bulk helpers to update a index and run a search query with a script. The query executes successfully only if add some timeout (say 10s) between bulk update and script. Is this because bulk… --- ## [Elastic search Add additional condition if type is different](https://discuss.elastic.co/t/elastic-search-add-additional-condition-if-type-is-different/299706)
**Author:** [@painless\_elastic](https://discuss.elastic.co/u/painless_elastic)\ **Replies:** 3\ **Last updated:** [March 17, 2022, 2:32am UTC](https://discuss.elastic.co/t/elastic-search-add-additional-condition-if-type-is-different/299706 "2022-03-17T02:32:05Z")
I have 2 sets of documents, which are joined by fragmentId . I have written a query that pulls both documents, but I am thinking is there any other way to write it. Parent Document - There could be only 1 such document … --- ## [What is the difference between force merge and freeze index on ILM actions?](https://discuss.elastic.co/t/what-is-the-difference-between-force-merge-and-freeze-index-on-ilm-actions/299811)
**Author:** [@m-amano](https://discuss.elastic.co/u/m-amano)\ **Replies:** 2\ **Last updated:** [March 17, 2022, 1:28am UTC](https://discuss.elastic.co/t/what-is-the-difference-between-force-merge-and-freeze-index-on-ilm-actions/299811 "2022-03-17T01:28:31Z")
Is there any difference between force merge and freeze index action in ILM? My entire ILM is under below. In warm phase, the index is merged to a single segment which makes the index read only. { "policy": { "ph… --- ## [During a rolling restart sometimes all replicas of a single shard go into PRIMARY\_FAILED](https://discuss.elastic.co/t/during-a-rolling-restart-sometimes-all-replicas-of-a-single-shard-go-into-primary-failed/299269)
**Author:** [@rmb938](https://discuss.elastic.co/u/rmb938)\ **Replies:** 3\ **Last updated:** [March 16, 2022, 11:43pm UTC](https://discuss.elastic.co/t/during-a-rolling-restart-sometimes-all-replicas-of-a-single-shard-go-into-primary-failed/299269 "2022-03-16T23:43:28Z")
I have an issue where sometimes during a rolling restart when it gets to a node that has a primary replica once the node is offline the replica shards go into a PRIMARY\_FAILED state. i.e my-index 11 p UNA… --- ## [Kibana stack monitoring dashboard not showing data](https://discuss.elastic.co/t/kibana-stack-monitoring-dashboard-not-showing-data/299902)
**Author:** [@Satya\_Graha](https://discuss.elastic.co/u/Satya_Graha)\ **Replies:** 0\ **Last updated:** [March 16, 2022, 9:24pm UTC](https://discuss.elastic.co/t/kibana-stack-monitoring-dashboard-not-showing-data/299902 "2022-03-16T21:24:42Z")
We are using Elasticsearch 7.9.3 and have enabled monitoring data collection locally. This is our cluster's setting "xpack" : { "monitoring" : { "elasticsearch" : { "collection" : { … --- ## [Sum of values from Nested field as per the Global filter for Currency unit in Bar chart](https://discuss.elastic.co/t/sum-of-values-from-nested-field-as-per-the-global-filter-for-currency-unit-in-bar-chart/299892)
**Author:** [@Kirubanandhan](https://discuss.elastic.co/u/Kirubanandhan)\ **Replies:** 0\ **Last updated:** [March 16, 2022, 6:39pm UTC](https://discuss.elastic.co/t/sum-of-values-from-nested-field-as-per-the-global-filter-for-currency-unit-in-bar-chart/299892 "2022-03-16T18:39:35Z")
I have different types of currency values in each record as per user selects the Currency\_unit, Bar chart should make sum of Currency\_value. How to acheive this. PFB for the result. If the index data type needs to me mod… --- ## [Upgrading 6.2.4 to 8.1](https://discuss.elastic.co/t/upgrading-6-2-4-to-8-1/299887)
**Author:** [@Foggie](https://discuss.elastic.co/u/Foggie)\ **Replies:** 3\ **Last updated:** [March 16, 2022, 6:26pm UTC](https://discuss.elastic.co/t/upgrading-6-2-4-to-8-1/299887 "2022-03-16T18:26:31Z")
We have developed an application based on Elasticsearch. The data held is currently relatively small and the user interaction is very low. The application was first developed a few years ago based on Elasticsearch 6.2.4.… --- ## [Ingest vs Data](https://discuss.elastic.co/t/ingest-vs-data/299662)
**Author:** [@Tim\_Mobley](https://discuss.elastic.co/u/Tim_Mobley)\ **Replies:** 3\ **Last updated:** [March 16, 2022, 3:57pm UTC](https://discuss.elastic.co/t/ingest-vs-data/299662 "2022-03-16T15:57:55Z")
I have read the Node Roles documentation, but am still unclear on the difference between the ingest and data roles. In particular, if a node has the data role but not the ingest role, does that mean that incoming data (e… --- ## [Best compression codec](https://discuss.elastic.co/t/best-compression-codec/299869)
**Author:** [@Rollup\_eval](https://discuss.elastic.co/u/Rollup_eval)\ **Replies:** 1\ **Last updated:** [March 16, 2022, 2:47pm UTC](https://discuss.elastic.co/t/best-compression-codec/299869 "2022-03-16T14:47:36Z")
Hello, I'm using Elasticsearch 7.10.2. I have created a new index with index.codec: best\_compression in its settings. Is the best\_compression for this new index taken on account during hot phase ? (or only during the… --- ## [Elasticsearch SQL sub query: IN query not supported yet](https://discuss.elastic.co/t/elasticsearch-sql-sub-query-in-query-not-supported-yet/299864)
**Author:** [@tg295](https://discuss.elastic.co/u/tg295)\ **Replies:** 0\ **Last updated:** [March 16, 2022, 1:42pm UTC](https://discuss.elastic.co/t/elasticsearch-sql-sub-query-in-query-not-supported-yet/299864 "2022-03-16T13:42:14Z")
I'm trying to learn to learn how to use Elasticsearch SQL for use in the Kibana canvas. What I would like to do is aggregate sales by some metric over country and date, but filter those results so i'm looking at two spe… --- ## [Sql query cannot be cancelled and long running](https://discuss.elastic.co/t/sql-query-cannot-be-cancelled-and-long-running/299070)
**Author:** [@Sathish\_smart](https://discuss.elastic.co/u/Sathish_smart)\ **Replies:** 2\ **Last updated:** [March 16, 2022, 1:39pm UTC](https://discuss.elastic.co/t/sql-query-cannot-be-cancelled-and-long-running/299070 "2022-03-16T13:39:35Z")
I am unable to cancel the Elasticsearch sql query which is long running and I would like to know whether there is any option to make 'cancellable' true in the sql API. { "completed": false, "task": { "node": "5yiolpw… --- ## [Data Stream Backing Index Naming](https://discuss.elastic.co/t/data-stream-backing-index-naming/299861)
**Author:** [@omer](https://discuss.elastic.co/u/omer)\ **Replies:** 0\ **Last updated:** [March 16, 2022, 1:24pm UTC](https://discuss.elastic.co/t/data-stream-backing-index-naming/299861 "2022-03-16T13:24:26Z")
Hi, I am using data stream to index my log records. In documentation, it is said that the backing index is named using the following convention: .ds-\[data-stream\]-\[yyyy.MM.dd\]-\[generation\] but in my case, time segment… --- ## [Discovery 8.1](https://discuss.elastic.co/t/discovery-8-1/299789)
**Author:** [@Vurijano\_Pinas](https://discuss.elastic.co/u/Vurijano_Pinas)\ **Replies:** 5\ **Last updated:** [March 16, 2022, 1:03pm UTC](https://discuss.elastic.co/t/discovery-8-1/299789 "2022-03-16T13:03:35Z")
Hi, so i installing 8.1 and struggeling to get my node active after editting the config file. Now i cannot find any good guide to help me to the process. I would like to know howto install multi-node whitout having my n… --- ## [ConnectException using REST client in Java](https://discuss.elastic.co/t/connectexception-using-rest-client-in-java/299853)
**Author:** [@Chaitanya\_Varanasi](https://discuss.elastic.co/u/Chaitanya_Varanasi)\ **Replies:** 2\ **Last updated:** [March 16, 2022, 12:20pm UTC](https://discuss.elastic.co/t/connectexception-using-rest-client-in-java/299853 "2022-03-16T12:20:24Z")
RestClient is initialised well, but while trying to use the high level client , getting the following error java.net.ConnectException: null at org.apache.http.nio.pool.RouteSpecificPool.timeout(RouteSpecificPool… --- ## [Query DSL count distinct](https://discuss.elastic.co/t/query-dsl-count-distinct/299751)
**Author:** [@avnere](https://discuss.elastic.co/u/avnere)\ **Replies:** 15\ **Last updated:** [March 16, 2022, 11:09am UTC](https://discuss.elastic.co/t/query-dsl-count-distinct/299751 "2022-03-16T11:09:35Z")
Hi, I am looking for precise count results for index with over 70 millions documents. Equal to this: SQL: select count(distinct column) from table; I already tried Terms-aggregation, composite-aggregation, cardinality… --- ## [How to update a field with null using NEST and the Update API](https://discuss.elastic.co/t/how-to-update-a-field-with-null-using-nest-and-the-update-api/299390)
**Author:** [@xef](https://discuss.elastic.co/u/xef)\ **Replies:** 3\ **Last updated:** [March 16, 2022, 11:06am UTC](https://discuss.elastic.co/t/how-to-update-a-field-with-null-using-nest-and-the-update-api/299390 "2022-03-16T11:06:35Z")
We are using the NEST library with Elasticsearch versions 7.14. Lets say we have assigned a field Greeting with a value of "hello World". The filed is mapped as a Keyword type and Not Indexed. If you update that docum… --- ## [Use per field analyzer wrapper in elasticsearch](https://discuss.elastic.co/t/use-per-field-analyzer-wrapper-in-elasticsearch/299850)
**Author:** [@dishant.sharma](https://discuss.elastic.co/u/dishant.sharma)\ **Replies:** 0\ **Last updated:** [March 16, 2022, 10:48am UTC](https://discuss.elastic.co/t/use-per-field-analyzer-wrapper-in-elasticsearch/299850 "2022-03-16T10:48:50Z")
I am creating an Elasticsearch plugin where I am writing code for tokenizer and analyzer in java. There is a case scenario where I have to use the multi fields to analyze something. There are some examples available to u… --- ## [The fastest way to export to Text](https://discuss.elastic.co/t/the-fastest-way-to-export-to-text/299849)
**Author:** [@xodn0812](https://discuss.elastic.co/u/xodn0812)\ **Replies:** 0\ **Last updated:** [March 16, 2022, 10:23am UTC](https://discuss.elastic.co/t/the-fastest-way-to-export-to-text/299849 "2022-03-16T10:23:24Z")
Hi. I want to create a function to export logs stored in Elasticsearch to Text using Java APIs. Currently, I have used the Scroll API to implement it, but I want it to be more than twice as fast. Is the Scroll API the… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=473) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=475)