# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=475 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 476 --- ## [Failed to restore the incdices](https://discuss.elastic.co/t/failed-to-restore-the-incdices/299848)
**Author:** [@kannan\_raj](https://discuss.elastic.co/u/kannan_raj)\ **Replies:** 0\ **Last updated:** [March 16, 2022, 10:16am UTC](https://discuss.elastic.co/t/failed-to-restore-the-incdices/299848 "2022-03-16T10:16:29Z")
we are unable to restore some indices and get json\_parse\_exception. repo is in S3 bucket. curl -u user:passwd - H 'Content-Type: application/json' -XPOST https://\:9200/\_snapshot/\/\/\_res… --- ## [Relationship between Elasticsearch and Nagios](https://discuss.elastic.co/t/relationship-between-elasticsearch-and-nagios/299844)
**Author:** [@nour41\_nour41](https://discuss.elastic.co/u/nour41_nour41)\ **Replies:** 6\ **Last updated:** [March 16, 2022, 10:04am UTC](https://discuss.elastic.co/t/relationship-between-elasticsearch-and-nagios/299844 "2022-03-16T10:04:35Z")
relationship between Elasticsearch and Nagios and communication . thanks --- ## [Unable to upgrade elasticsearch from 6.8.1 to 7.16.3](https://discuss.elastic.co/t/unable-to-upgrade-elasticsearch-from-6-8-1-to-7-16-3/299697)
**Author:** [@karthik\_s4](https://discuss.elastic.co/u/karthik_s4)\ **Replies:** 13\ **Last updated:** [March 16, 2022, 9:54am UTC](https://discuss.elastic.co/t/unable-to-upgrade-elasticsearch-from-6-8-1-to-7-16-3/299697 "2022-03-16T09:54:18Z")
Hi, Unable to upgrade Elasticsearch to 7.16.3 from 6.81 in our elastic cluster with 4 nodes. getting below messages in log file with this. please help. \[2022-03-12T17:04:36,236\]\[INFO \]\[o.e.x.m.e.l.LocalExporter\] \[10.4.… --- ## [Elasticsearch user creation fails](https://discuss.elastic.co/t/elasticsearch-user-creation-fails/299478)
**Author:** [@nandatibco](https://discuss.elastic.co/u/nandatibco)\ **Replies:** 2\ **Last updated:** [March 16, 2022, 8:50am UTC](https://discuss.elastic.co/t/elasticsearch-user-creation-fails/299478 "2022-03-16T08:50:50Z")
Hello team, When I try to create user with below command getting below error in ES version:7.17.0, please help.... ./elasticsearch-setup-passwords interactive -u "https://test.com:9085" But following settings are in e… --- ## [Elasticsearch - solving \`No space left on device\`](https://discuss.elastic.co/t/elasticsearch-solving-no-space-left-on-device/299838)
**Author:** [@sokolmateusz](https://discuss.elastic.co/u/sokolmateusz)\ **Replies:** 0\ **Last updated:** [March 16, 2022, 8:34am UTC](https://discuss.elastic.co/t/elasticsearch-solving-no-space-left-on-device/299838 "2022-03-16T08:34:34Z")
Hi! I'm using ELK (Elasticsearch, kibana, filebeat, metricbeat) deployed via Helm. I'm collecting small amount logs from a few containers and PVC for Elasticsearch is set to 2Gi. For some reason this space after one n… --- ## [Keycloak Elasticsearch/Kibana Configuration](https://discuss.elastic.co/t/keycloak-elasticsearch-kibana-configuration/299624)
**Author:** [@pkward](https://discuss.elastic.co/u/pkward)\ **Replies:** 8\ **Last updated:** [March 16, 2022, 7:42am UTC](https://discuss.elastic.co/t/keycloak-elasticsearch-kibana-configuration/299624 "2022-03-16T07:42:27Z")
Hi, I'm having trouble configuring Kibana and Keycloak to use SSO. I am getting an error like the one below: Failed to authenticate user with OpenID Connect (Caused by ElasticsearchSecurityException\[Failed to exchange … --- ## [Run elasticsearch without initial master nodes configured](https://discuss.elastic.co/t/run-elasticsearch-without-initial-master-nodes-configured/299812)
**Author:** [@auto\_reply\_007](https://discuss.elastic.co/u/auto_reply_007)\ **Replies:** 0\ **Last updated:** [March 16, 2022, 4:24am UTC](https://discuss.elastic.co/t/run-elasticsearch-without-initial-master-nodes-configured/299812 "2022-03-16T04:24:24Z")
Hi! i have 3 node cluster ( 7.16.2 ) with this config ( example from first node ) cluster.name: sactions cluster.routing.allocation.awareness.attributes: zone cluster.routing.allocation.awareness.force.zone.values: zo… --- ## [How to collect all types of logs from my fortinet firewall using ELK](https://discuss.elastic.co/t/how-to-collect-all-types-of-logs-from-my-fortinet-firewall-using-elk/296830)
**Author:** [@randyvinoth](https://discuss.elastic.co/u/randyvinoth)\ **Replies:** 20\ **Last updated:** [March 16, 2022, 4:20am UTC](https://discuss.elastic.co/t/how-to-collect-all-types-of-logs-from-my-fortinet-firewall-using-elk/296830 "2022-03-16T04:20:54Z")
I configured Elasticsearch, Logstash and Kibana after lots of errors. I also configured my fortinet firewall for syslogd server to send the logs to ELK server. But I am not getting any data from my firewall. Also I confi… --- ## [Applying slowlog setting on daily rotated search index](https://discuss.elastic.co/t/applying-slowlog-setting-on-daily-rotated-search-index/299298)
**Author:** [@Nobuaki\_Ito](https://discuss.elastic.co/u/Nobuaki_Ito)\ **Replies:** 4\ **Last updated:** [March 16, 2022, 2:58am UTC](https://discuss.elastic.co/t/applying-slowlog-setting-on-daily-rotated-search-index/299298 "2022-03-16T02:58:45Z")
My team currently own an Elasticsearch with daily rotated index. The index name changes once the daily rotation completes, and hence it requires to have slowlog threshold configured after each daily rotation completes. W… --- ## [Elasticsearch 8.1.0 on Windows VM running in Azure not showing or creating Indices](https://discuss.elastic.co/t/elasticsearch-8-1-0-on-windows-vm-running-in-azure-not-showing-or-creating-indices/299561)
**Author:** [@ddynamight](https://discuss.elastic.co/u/ddynamight)\ **Replies:** 5\ **Last updated:** [March 16, 2022, 12:04am UTC](https://discuss.elastic.co/t/elasticsearch-8-1-0-on-windows-vm-running-in-azure-not-showing-or-creating-indices/299561 "2022-03-16T00:04:01Z")
I have just set up Elasticsearch 8.1.0 on a Windows Server 2022 VM running inside Azure, but the indexing is not working. I am unable to create new indices or view the default indices. A get request to localhost:9200/\_c… --- ## [How to deal with Elastic Cloud?](https://discuss.elastic.co/t/how-to-deal-with-elastic-cloud/299670)
**Author:** [@iNikolas](https://discuss.elastic.co/u/iNikolas)\ **Replies:** 8\ **Last updated:** [March 15, 2022, 11:38pm UTC](https://discuss.elastic.co/t/how-to-deal-with-elastic-cloud/299670 "2022-03-15T23:38:21Z")
Hi all. I have studied Elasticsearch for a while by means of DevTools, where everything worked just fine: index creation; tweaking search and data Analyzers; data population with CSV files. But for now, I decided to … --- ## [Column event.dataset is empty](https://discuss.elastic.co/t/column-event-dataset-is-empty/299792)
**Author:** [@Guif](https://discuss.elastic.co/u/Guif)\ **Replies:** 0\ **Last updated:** [March 15, 2022, 9:29pm UTC](https://discuss.elastic.co/t/column-event-dataset-is-empty/299792 "2022-03-15T21:29:05Z")
Hi, Inside ELK when goes to check the logs (/app/logs/stream) column "event.dataset" is empty but if I click on certain event (View Details) the value of "fields.event.dataset" are correctly informed (mylog) Value of "… --- ## [Searching on keywords that have spaces fail using simple\_query\_string](https://discuss.elastic.co/t/searching-on-keywords-that-have-spaces-fail-using-simple-query-string/298577)
**Author:** [@JJK](https://discuss.elastic.co/u/JJK)\ **Replies:** 7\ **Last updated:** [March 15, 2022, 7:30pm UTC](https://discuss.elastic.co/t/searching-on-keywords-that-have-spaces-fail-using-simple-query-string/298577 "2022-03-15T19:30:08Z")
I have a tags keyword field defined simply as: 'tags' =\> \[ 'type' =\> 'keyword' \], I have a tag field that stores: "tags" : \[ "523", "523 az" \], I have a simple search set… --- ## [Mounted Searchable Snapshot Delay Reallocation/Recovery](https://discuss.elastic.co/t/mounted-searchable-snapshot-delay-reallocation-recovery/299757)
**Author:** [@BenB196](https://discuss.elastic.co/u/BenB196)\ **Replies:** 13\ **Last updated:** [March 15, 2022, 7:07pm UTC](https://discuss.elastic.co/t/mounted-searchable-snapshot-delay-reallocation-recovery/299757 "2022-03-15T19:07:30Z")
Hi All, I'm using searchable snapshots on a cluster and was wondering if there is a way to delay whether a searchable snapshot gets reallocated for a period of time. Example problem, if I have a cold node which gets hi… --- ## [What "Cumulative Time" exactly means?](https://discuss.elastic.co/t/what-cumulative-time-exactly-means/299679)
**Author:** [@Seo](https://discuss.elastic.co/u/Seo)\ **Replies:** 2\ **Last updated:** [March 15, 2022, 4:59pm UTC](https://discuss.elastic.co/t/what-cumulative-time-exactly-means/299679 "2022-03-15T16:59:40Z")
Hello, It's my first time using Elasticsearch, and I measured the ES performance with rally. I have some quick questions about interpreting the results. My purpose is to compare the performance of ES in different envir… --- ## [8.1.0 Java Client - SearchRequest example](https://discuss.elastic.co/t/8-1-0-java-client-searchrequest-example/299640)
**Author:** [@Valh](https://discuss.elastic.co/u/Valh)\ **Replies:** 2\ **Last updated:** [March 14, 2022, 6:08pm UTC](https://discuss.elastic.co/t/8-1-0-java-client-searchrequest-example/299640 "2022-03-14T18:08:40Z")
Hi, I'm struggling to understand how to do convert my code from the HLRC to the new Elasticsearch Java API Client. Could someone please give me an example? The documentation is very unclear on this subject. Fonctional … --- ## [Anomaly Score \< 1, despite a big difference between actual and typical detections](https://discuss.elastic.co/t/anomaly-score-1-despite-a-big-difference-between-actual-and-typical-detections/299743)
**Author:** [@Shahzaib\_Abid](https://discuss.elastic.co/u/Shahzaib_Abid)\ **Replies:** 1\ **Last updated:** [March 15, 2022, 2:54pm UTC](https://discuss.elastic.co/t/anomaly-score-1-despite-a-big-difference-between-actual-and-typical-detections/299743 "2022-03-15T14:54:13Z")
We have created an anomaly detection job using elastic machine learning. For this particular case, we have no detections at times where we normally have detections. The anomaly score is less than 1 here, despite havin… --- ## [Elasticsearch won't start after upgrade to 8.1.0](https://discuss.elastic.co/t/elasticsearch-wont-start-after-upgrade-to-8-1-0/299721)
**Author:** [@mralians](https://discuss.elastic.co/u/mralians)\ **Replies:** 5\ **Last updated:** [March 15, 2022, 2:52pm UTC](https://discuss.elastic.co/t/elasticsearch-wont-start-after-upgrade-to-8-1-0/299721 "2022-03-15T14:52:43Z")
I upgraded Elasticsearch from 7.17 to 8.1.0 but since then I can start Elasticsearch. When I run systemctl status Elasticsearch.service I get this error. How can I fix this? org.elasticsearch.bootstrap.StartupException:… --- ## [Alias applogs-team1 has more than one write index \[ applogs-team1-000001 , applogs-team1-000002\]](https://discuss.elastic.co/t/alias-applogs-team1-has-more-than-one-write-index-applogs-team1-000001-applogs-team1-000002/299737)
**Author:** [@sam7](https://discuss.elastic.co/u/sam7)\ **Replies:** 0\ **Last updated:** [March 15, 2022, 1:22pm UTC](https://discuss.elastic.co/t/alias-applogs-team1-has-more-than-one-write-index-applogs-team1-000001-applogs-team1-000002/299737 "2022-03-15T13:22:19Z")
I have created Index pattern,ILM Policies(HOT and Warm tier), templates and aliases using the following settings. PUT \_index\_template/applogs\_template { "index\_patterns": \["applogs-team1-\*"\], "template": { "settings": {… --- ## [ElasticsearchErrorhandler 400 - Validation Failed due to max shards open](https://discuss.elastic.co/t/elasticsearcherrorhandler-400-validation-failed-due-to-max-shards-open/299734)
**Author:** [@barceloniak1](https://discuss.elastic.co/u/barceloniak1)\ **Replies:** 1\ **Last updated:** [March 15, 2022, 1:07pm UTC](https://discuss.elastic.co/t/elasticsearcherrorhandler-400-validation-failed-due-to-max-shards-open/299734 "2022-03-15T13:07:24Z")
Hi Guys, Kibana 7.7.0 I would be, so grateful for advising in shaping proper configuration for Elastic. Logs are shipped through fluentd.conf. Out of sudden, stopped to fetch logs. Instance is clustered and hosted on AW… --- ## [ILM policies for multiple auto-generated indexes](https://discuss.elastic.co/t/ilm-policies-for-multiple-auto-generated-indexes/299732)
**Author:** [@sam7](https://discuss.elastic.co/u/sam7)\ **Replies:** 0\ **Last updated:** [March 15, 2022, 1:00pm UTC](https://discuss.elastic.co/t/ilm-policies-for-multiple-auto-generated-indexes/299732 "2022-03-15T13:00:07Z")
Hi Team, I have a logstash which is sending data streams to indexes created automatically in the process over Elasticsearch. We have configured Logstash output section with index configuration as index =\> "applogs-%{\[f… --- ## [Making an Opaque Search Request](https://discuss.elastic.co/t/making-an-opaque-search-request/299726)
**Author:** [@Adeisbright](https://discuss.elastic.co/u/Adeisbright)\ **Replies:** 0\ **Last updated:** [March 15, 2022, 12:18pm UTC](https://discuss.elastic.co/t/making-an-opaque-search-request/299726 "2022-03-15T12:18:32Z")
Hello, I am working in an environment with many services. We are introducing Elasticsearch as an after-thought; it means we need to do this in a way that does not impact on already existing service. To achieve this, we… --- ## [Elasticsearch 404](https://discuss.elastic.co/t/elasticsearch-404/299694)
**Author:** [@Murat\_KOC](https://discuss.elastic.co/u/Murat_KOC)\ **Replies:** 11\ **Last updated:** [March 15, 2022, 11:20am UTC](https://discuss.elastic.co/t/elasticsearch-404/299694 "2022-03-15T11:20:13Z")
I am presenting the data with Elasticsearch on a system I use. The page gives 404 while the bot is pulling the data. But when I enter the link from the browser, there is no problem. I index the data in the database via E… --- ## [Deleted documents force-merge](https://discuss.elastic.co/t/deleted-documents-force-merge/299717)
**Author:** [@Sandeep\_Raju](https://discuss.elastic.co/u/Sandeep_Raju)\ **Replies:** 1\ **Last updated:** [March 15, 2022, 11:08am UTC](https://discuss.elastic.co/t/deleted-documents-force-merge/299717 "2022-03-15T11:08:34Z")
Hi all, I have an index showing 1000 deleted documents. It is said that deleted documents occupy some amount of memory and we have to force merge them to empty space. Which steps or command should we use to achieve this… --- ## [Reindex Problem](https://discuss.elastic.co/t/reindex-problem/299720)
**Author:** [@Busra\_Duygu](https://discuss.elastic.co/u/Busra_Duygu)\ **Replies:** 1\ **Last updated:** [March 15, 2022, 11:06am UTC](https://discuss.elastic.co/t/reindex-problem/299720 "2022-03-15T11:06:27Z")
Hello dear friends i have a problem. While reindexing, a question occurred and data transfer was interrupted. How do I replace the missing data in the target index? (I have no chance to reindex.) --- ## [Count Each word in a text Field](https://discuss.elastic.co/t/count-each-word-in-a-text-field/299605)
**Author:** [@vishesh08](https://discuss.elastic.co/u/vishesh08)\ **Replies:** 7\ **Last updated:** [March 15, 2022, 11:02am UTC](https://discuss.elastic.co/t/count-each-word-in-a-text-field/299605 "2022-03-15T11:02:07Z")
I have tweets stored in a text field with field Data True. I want to remove the english stopwords and get a count of each word in the tweets. Data Mapping: { "tweets" : { "mappings" : { "properties" : { … --- ## [Is there any way to check the relocation progress of shards?](https://discuss.elastic.co/t/is-there-any-way-to-check-the-relocation-progress-of-shards/299719)
**Author:** [@wajika](https://discuss.elastic.co/u/wajika)\ **Replies:** 2\ **Last updated:** [March 15, 2022, 10:55am UTC](https://discuss.elastic.co/t/is-there-any-way-to-check-the-relocation-progress-of-shards/299719 "2022-03-15T10:55:57Z")
I plan to migrate the data in a cluster with three nodes to another cluster. After I add the exclusion parameter (cluster.routing.allocation.exclude.\_ip) to the cluster, check the status of shards through /\_cat/shards It… --- ## [Mapping conflict with Elastic Agent](https://discuss.elastic.co/t/mapping-conflict-with-elastic-agent/298677)
**Author:** [@ARDiver86](https://discuss.elastic.co/u/ARDiver86)\ **Replies:** 7\ **Last updated:** [March 15, 2022, 9:52am UTC](https://discuss.elastic.co/t/mapping-conflict-with-elastic-agent/298677 "2022-03-15T09:52:09Z")
I am using the Fleet server with policies/integrations but I am running into some mapping conflicts that I am unsure how to resolve. For my "logs-\*" index pattern I see I have a conflict of keyword,object on the "source"… --- ## [Facing issue while configuring TLS](https://discuss.elastic.co/t/facing-issue-while-configuring-tls/299691)
**Author:** [@shivendra95](https://discuss.elastic.co/u/shivendra95)\ **Replies:** 3\ **Last updated:** [March 15, 2022, 9:29am UTC](https://discuss.elastic.co/t/facing-issue-while-configuring-tls/299691 "2022-03-15T09:29:40Z")
Hi, I'm, configuring Elasticsearch with TLS but facing error when I restart the Elasticsearch server This is my Elasticsearch.yml configuration for security xpack.security.enabled: true xpack.security.transport.ssl.en… --- ## [Is it safe to ingest data while tiebreaker node is stopped?](https://discuss.elastic.co/t/is-it-safe-to-ingest-data-while-tiebreaker-node-is-stopped/299708)
**Author:** [@Conor\_Hennessy](https://discuss.elastic.co/u/Conor_Hennessy)\ **Replies:** 0\ **Last updated:** [March 15, 2022, 9:26am UTC](https://discuss.elastic.co/t/is-it-safe-to-ingest-data-while-tiebreaker-node-is-stopped/299708 "2022-03-15T09:26:39Z")
Hi, I have an Elastic Cloud deployment with two data nodes and a tiebreaker node. The tiebreaker node was stopped during a deployment configuration change, and I can't seem to restart it. The data nodes are still operat… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=474) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=476)