# Elasticsearch

**URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=476

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 477

---

## [Elasticsearch scoring Issue for same data](https://discuss.elastic.co/t/elasticsearch-scoring-issue-for-same-data/299690)

<div class="topic-metadata">

**Author:** [@painless\_elastic](https://discuss.elastic.co/u/painless_elastic)\
**Replies:** 2\
**Last updated:** [March 15, 2022, 9:01am UTC](https://discuss.elastic.co/t/elasticsearch-scoring-issue-for-same-data/299690 "2022-03-15T09:01:56Z")

</div>

I have an Elastic Index with the below 4 documents. PUT test/\_doc/1 { "tag" : "prove" } PUT test/\_doc/2 { "tag" : "prove" } PUT test/\_doc/3 { "tag" : "freckle" } PUT test/\_doc/4 { "tag" : "freckle" } On this i am runni…

---

## [How to re-insert json data retrieved in Elasticsearch](https://discuss.elastic.co/t/how-to-re-insert-json-data-retrieved-in-elasticsearch/299695)

<div class="topic-metadata">

**Author:** [@111505](https://discuss.elastic.co/u/111505)\
**Replies:** 2\
**Last updated:** [March 15, 2022, 7:37am UTC](https://discuss.elastic.co/t/how-to-re-insert-json-data-retrieved-in-elasticsearch/299695 "2022-03-15T07:37:54Z")

</div>

I want to put the searched Json Data as below in Elasticsearch of another cluster. Will it be possible? Json file "\_type" : "\_doc", "\_id" : "1", "\_score" : 1.0, "\_source" : { "helpMe" : "hi hi hi …

---

## [Combine data from different index in kibana](https://discuss.elastic.co/t/combine-data-from-different-index-in-kibana/299647)

<div class="topic-metadata">

**Author:** [@Lumiere](https://discuss.elastic.co/u/Lumiere)\
**Replies:** 2\
**Last updated:** [March 15, 2022, 7:44am UTC](https://discuss.elastic.co/t/combine-data-from-different-index-in-kibana/299647 "2022-03-15T07:44:53Z")

</div>

Hello, i'm new user and i use kibana (v 7.14.2). I am trying to combine data from differents index in the another index or view. Please, it is possible? For exemple, First index : { "\_index":" index-1", "\_source":…

---

## [Error multiple index templates may not match during index creation](https://discuss.elastic.co/t/error-multiple-index-templates-may-not-match-during-index-creation/299666)

<div class="topic-metadata">

**Author:** [@Guif](https://discuss.elastic.co/u/Guif)\
**Replies:** 1\
**Last updated:** [March 15, 2022, 7:28am UTC](https://discuss.elastic.co/t/error-multiple-index-templates-may-not-match-during-index-creation/299666 "2022-03-15T07:28:23Z")

</div>

Hi, I got the following error message in kibana.log {"type":"log","@timestamp":"2022-03-14T21:31:34+01:00","tags":\["error","plugins","security","session","index"\],"pid":14270,"message":"Failed to create session index t…

---

## [Elasticsearch Error "Authentication using apikey failed"](https://discuss.elastic.co/t/elasticsearch-error-authentication-using-apikey-failed/299684)

<div class="topic-metadata">

**Author:** [@BoKu](https://discuss.elastic.co/u/BoKu)\
**Replies:** 0\
**Last updated:** [March 15, 2022, 6:09am UTC](https://discuss.elastic.co/t/elasticsearch-error-authentication-using-apikey-failed/299684 "2022-03-15T06:09:00Z")

</div>

Hello, i'm running Elasticsearch 8.1.0 and have many error entries like this on in the elastic logs: \[2022-03-15T07:02:15,222\]\[WARN \]\[o.e.x.s.a.ApiKeyAuthenticator\] \[NODENAMEE\] Authentication using apikey failed - unab…

---

## [Effect of increasing index.mapping.nested\_objects.limit](https://discuss.elastic.co/t/effect-of-increasing-index-mapping-nested-objects-limit/299608)

<div class="topic-metadata">

**Author:** [@csdev](https://discuss.elastic.co/u/csdev)\
**Replies:** 3\
**Last updated:** [March 15, 2022, 5:37am UTC](https://discuss.elastic.co/t/effect-of-increasing-index-mapping-nested-objects-limit/299608 "2022-03-15T05:37:01Z")

</div>

Hi Everyone, As per Elasticsearch documentation available at link Mapping limit settings | Elasticsearch Guide \[8.1\] | Elastic, the limit of 10k on index.mapping.nested\_objects.limit is kept to prevent out of memory err…

---

## [Dropped Netflow Data](https://discuss.elastic.co/t/dropped-netflow-data/299609)

<div class="topic-metadata">

**Author:** [@Alif](https://discuss.elastic.co/u/Alif)\
**Replies:** 0\
**Last updated:** [March 14, 2022, 11:23am UTC](https://discuss.elastic.co/t/dropped-netflow-data/299609 "2022-03-14T11:23:53Z")

</div>

Me and my team currently having an issue with netflow data ingestion using logstash / filebeat. The data seems to be massively dropped to around 1/7 (using logstash) and 1/100 (using filebeat) when we compare to the actu…

---

## [Options for analytics on ES](https://discuss.elastic.co/t/options-for-analytics-on-es/299657)

<div class="topic-metadata">

**Author:** [@yosiasz](https://discuss.elastic.co/u/yosiasz)\
**Replies:** 2\
**Last updated:** [March 15, 2022, 1:37am UTC](https://discuss.elastic.co/t/options-for-analytics-on-es/299657 "2022-03-15T01:37:10Z")

</div>

Greetings, We have tons of data coming into our ES from devices across the whole US. We need to do a lot of analytical research on this data. We do not want to do this on the live data but would like to do it on copies …

---

## [Cannot read configured pem certificate](https://discuss.elastic.co/t/cannot-read-configured-pem-certificate/299545)

<div class="topic-metadata">

**Author:** [@tehfcae](https://discuss.elastic.co/u/tehfcae)\
**Replies:** 3\
**Last updated:** [March 15, 2022, 12:23am UTC](https://discuss.elastic.co/t/cannot-read-configured-pem-certificate/299545 "2022-03-15T00:23:04Z")

</div>

I generated a PEM certificate for my Elasticsearch however, I am getting an error that it cannot read configured PEM certificate due to a permissions issue, however, I verified the permissions and it should have read/wri…

---

## [Hesitation between three Elasticsearch-based Architectures](https://discuss.elastic.co/t/hesitation-between-three-elasticsearch-based-architectures/299625)

<div class="topic-metadata">

**Author:** [@bechir-jamoussi](https://discuss.elastic.co/u/bechir-jamoussi)\
**Replies:** 2\
**Last updated:** [March 14, 2022, 9:51pm UTC](https://discuss.elastic.co/t/hesitation-between-three-elasticsearch-based-architectures/299625 "2022-03-14T21:51:16Z")

</div>

Hello everyone, Let me present to you my Use Case: I am trying to develop an algorithm that chooses the best communication channel(SMS, RCS, Messenger, Whatsapp, E-mail) and the best moment to communicate with the clie…

---

## [NGINX as revers proxy to elasticsearch coordinator nodes](https://discuss.elastic.co/t/nginx-as-revers-proxy-to-elasticsearch-coordinator-nodes/299656)

<div class="topic-metadata">

**Author:** [@INS](https://discuss.elastic.co/u/INS)\
**Replies:** 1\
**Last updated:** [March 14, 2022, 8:06pm UTC](https://discuss.elastic.co/t/nginx-as-revers-proxy-to-elasticsearch-coordinator-nodes/299656 "2022-03-14T20:06:10Z")

</div>

Hi I'm forcing in my environment setup on nginx for Elasticsearch: -what I have a problem with the correct configuration for connect NGINX over TLS to my nodes below You can find my configuration,maybe You can point m…

---

## [Elasticsearch terms aggregation with partition does not retuning equal bucket](https://discuss.elastic.co/t/elasticsearch-terms-aggregation-with-partition-does-not-retuning-equal-bucket/299346)

<div class="topic-metadata">

**Author:** [@truptir](https://discuss.elastic.co/u/truptir)\
**Replies:** 5\
**Last updated:** [March 14, 2022, 8:03pm UTC](https://discuss.elastic.co/t/elasticsearch-terms-aggregation-with-partition-does-not-retuning-equal-bucket/299346 "2022-03-14T20:03:56Z")

</div>

I have an ES index and I fetch data using term aggregation and partition. I am using the cardinality aggregation to get the total number of buckets and calculating num\_partitions, using default size values 10. E.g. Ca…

---

## [Delay in a hourly logfiles](https://discuss.elastic.co/t/delay-in-a-hourly-logfiles/299659)

<div class="topic-metadata">

**Author:** [@oren](https://discuss.elastic.co/u/oren)\
**Replies:** 0\
**Last updated:** [March 14, 2022, 7:26pm UTC](https://discuss.elastic.co/t/delay-in-a-hourly-logfiles/299659 "2022-03-14T19:26:47Z")

</div>

hi I have windows system with file beat 7.4.1 and I load hourly big log files to elastic throw Logstash I have delay with the data only in this system what should be beat configuration ?

---

## [Deletions in reindex](https://discuss.elastic.co/t/deletions-in-reindex/299650)

<div class="topic-metadata">

**Author:** [@Aditya\_Verma1](https://discuss.elastic.co/u/Aditya_Verma1)\
**Replies:** 1\
**Last updated:** [March 14, 2022, 4:55pm UTC](https://discuss.elastic.co/t/deletions-in-reindex/299650 "2022-03-14T16:55:27Z")

</div>

I have an index which i want to reindex to a new index increasing the no of primary shards. So i started reindexing. I didn't make the source index read only so ingestions, updations and deletions were happening on the s…

---

## [Kibana to Elastic node xpack.security.http.ssl.enabled](https://discuss.elastic.co/t/kibana-to-elastic-node-xpack-security-http-ssl-enabled/299645)

<div class="topic-metadata">

**Author:** [@mwoods269](https://discuss.elastic.co/u/mwoods269)\
**Replies:** 0\
**Last updated:** [March 14, 2022, 4:26pm UTC](https://discuss.elastic.co/t/kibana-to-elastic-node-xpack-security-http-ssl-enabled/299645 "2022-03-14T16:26:01Z")

</div>

Looking for some insight on the following Current configuration Elasticnodes (using internal CA) configured with xpack.security.http.ssl.enabled:true so things like kibana and logstash outputs can connect via https. Al…

---

## [Dont disable merges?](https://discuss.elastic.co/t/dont-disable-merges/299646)

<div class="topic-metadata">

**Author:** [@Kevin\_Comer](https://discuss.elastic.co/u/Kevin_Comer)\
**Replies:** 0\
**Last updated:** [March 14, 2022, 4:30pm UTC](https://discuss.elastic.co/t/dont-disable-merges/299646 "2022-03-14T16:30:26Z")

</div>

So I found an interesting bit of info in a post and wanted to know more information "The best answer to those is don't disable merging as I mentioned. Otherwise yes merges use IO, if you disable them then they won't ha…

---

## [High CPU Usage across entire cluster](https://discuss.elastic.co/t/high-cpu-usage-across-entire-cluster/299508)

<div class="topic-metadata">

**Author:** [@Kevin\_Comer](https://discuss.elastic.co/u/Kevin_Comer)\
**Replies:** 8\
**Last updated:** [March 14, 2022, 4:14pm UTC](https://discuss.elastic.co/t/high-cpu-usage-across-entire-cluster/299508 "2022-03-14T16:14:33Z")

</div>

We have a version 5.6 100 plus node cluster which has been suffering from high cpu usage for a sometime now. The hot threads show several different threads which are usually taking 100% cpu. 3 masters 6i.xlarge 38 node…

---

## [java.lang.OutOfMemoryError: Java heap space](https://discuss.elastic.co/t/java-lang-outofmemoryerror-java-heap-space/299620)

<div class="topic-metadata">

**Author:** [@Ahmed\_El\_bendary](https://discuss.elastic.co/u/Ahmed_El_bendary)\
**Replies:** 1\
**Last updated:** [March 14, 2022, 2:55pm UTC](https://discuss.elastic.co/t/java-lang-outofmemoryerror-java-heap-space/299620 "2022-03-14T14:55:32Z")

</div>

when using prefix query with large text give exception then service will stop. { "track\_total\_hits": true, "from": 0, "query": { "bool": { "minimum\_should\_match": 1, "must": \[ { "…

---

## [Geoip losing type geo\_point for location (v8.1)](https://discuss.elastic.co/t/geoip-losing-type-geo-point-for-location-v8-1/299623)

<div class="topic-metadata">

**Author:** [@fedora35](https://discuss.elastic.co/u/fedora35)\
**Replies:** 0\
**Last updated:** [March 14, 2022, 1:20pm UTC](https://discuss.elastic.co/t/geoip-losing-type-geo-point-for-location-v8-1/299623 "2022-03-14T13:20:44Z")

</div>

Hello, I'm a beginner with ELK and i have the following problem: I send apache's logs with filebeat to logstash. All is working except the fact when I check the location mapping in kibana, it has no type : it appears l…

---

## [How to overwrite system generated .monitoring-\* templates in elasticsearch 8.0](https://discuss.elastic.co/t/how-to-overwrite-system-generated-monitoring-templates-in-elasticsearch-8-0/299618)

<div class="topic-metadata">

**Author:** [@BhawanaSharma](https://discuss.elastic.co/u/BhawanaSharma)\
**Replies:** 0\
**Last updated:** [March 14, 2022, 12:33pm UTC](https://discuss.elastic.co/t/how-to-overwrite-system-generated-monitoring-templates-in-elasticsearch-8-0/299618 "2022-03-14T12:33:33Z")

</div>

In Elasticsearch 8.0 few system generated templates are coming by default named with ".monitoring-\*" in that "number\_of\_replicas: 1" with default value 1, because of that replica is set to 1 and health of data stream is …

---

## [Reindex change shard number](https://discuss.elastic.co/t/reindex-change-shard-number/299337)

<div class="topic-metadata">

**Author:** [@gabbar](https://discuss.elastic.co/u/gabbar)\
**Replies:** 4\
**Last updated:** [March 14, 2022, 12:02pm UTC](https://discuss.elastic.co/t/reindex-change-shard-number/299337 "2022-03-14T12:02:39Z")

</div>

Hello community! I'm running Elasticsearch 6.8 to store logs collected using graylog and I would like to reduce the amount of shards of the older indices. Using curator I've been able to shrink the shards from 6 to 1, …

---

## [Net Client NEST 8 download?](https://discuss.elastic.co/t/net-client-nest-8-download/298558)

<div class="topic-metadata">

**Author:** [@agonzalez](https://discuss.elastic.co/u/agonzalez)\
**Replies:** 3\
**Last updated:** [March 14, 2022, 10:07am UTC](https://discuss.elastic.co/t/net-client-nest-8-download/298558 "2022-03-14T10:07:49Z")

</div>

Elastic 8 was released few weeks ago and NEST 8 documentation is online but I cant find NEST 8 nuget package. When it is going to be published or where I can download final release or a beta?

---

## [Can we use Elasticsearch-dsl-py 7.4 with Elasticsearch-8.x?](https://discuss.elastic.co/t/can-we-use-elasticsearch-dsl-py-7-4-with-elasticsearch-8-x/299402)

<div class="topic-metadata">

**Author:** [@Dheeraj\_Gupta](https://discuss.elastic.co/u/Dheeraj_Gupta)\
**Replies:** 2\
**Last updated:** [March 14, 2022, 10:05am UTC](https://discuss.elastic.co/t/can-we-use-elasticsearch-dsl-py-7-4-with-elasticsearch-8-x/299402 "2022-03-14T10:05:03Z")

</div>

We have some Python programs that use Elasticsearch-dsl-py and Elasticsearch-py Python clients to process Elasticsearch data. We are considering upgrading to Elasticsearch-8. From PyPI we can see that elasticsearch-py-8.…

---

## [Discrepancy (bug or misunderstanding) in how simple\_query\_string handles queries?](https://discuss.elastic.co/t/discrepancy-bug-or-misunderstanding-in-how-simple-query-string-handles-queries/299351)

<div class="topic-metadata">

**Author:** [@ndtreviv](https://discuss.elastic.co/u/ndtreviv)\
**Replies:** 2\
**Last updated:** [March 14, 2022, 9:52am UTC](https://discuss.elastic.co/t/discrepancy-bug-or-misunderstanding-in-how-simple-query-string-handles-queries/299351 "2022-03-14T09:52:22Z")

</div>

I have a field, let's call it MyField mapped as a keyword type. If I search using simple\_query\_string, like so: GET /my-index/\_search { "from": 0, "size": 1000, "query": { "bool": { "filter": \[ …

---

## [Elasticsearch 8 disable BEGIN SECURITY AUTO CONFIGURATION](https://discuss.elastic.co/t/elasticsearch-8-disable-begin-security-auto-configuration/299507)

<div class="topic-metadata">

**Author:** [@VamPikmin](https://discuss.elastic.co/u/VamPikmin)\
**Replies:** 2\
**Last updated:** [March 14, 2022, 7:52am UTC](https://discuss.elastic.co/t/elasticsearch-8-disable-begin-security-auto-configuration/299507 "2022-03-14T07:52:00Z")

</div>

Is there a way to disable this during install? or even have a yes and no option I'm trying to create an automated install with my own certificates and sometimes during testing I don't want to have user authentication en…

---

## [How to fix kafka fatal error when running](https://discuss.elastic.co/t/how-to-fix-kafka-fatal-error-when-running/299582)

<div class="topic-metadata">

**Author:** [@leyleynewt](https://discuss.elastic.co/u/leyleynewt)\
**Replies:** 1\
**Last updated:** [March 14, 2022, 2:48am UTC](https://discuss.elastic.co/t/how-to-fix-kafka-fatal-error-when-running/299582 "2022-03-14T02:48:39Z")

</div>

Please see screenshots below: Thanks in advance!!!

---

## [NetApp reports Elasticsearch High Latency alerts](https://discuss.elastic.co/t/netapp-reports-elasticsearch-high-latency-alerts/299570)

<div class="topic-metadata">

**Author:** [@KrishnaCh](https://discuss.elastic.co/u/KrishnaCh)\
**Replies:** 0\
**Last updated:** [March 13, 2022, 5:20pm UTC](https://discuss.elastic.co/t/netapp-reports-elasticsearch-high-latency-alerts/299570 "2022-03-13T17:20:27Z")

</div>

Hi All, We have NetApp storage in our environment. And there is one cluster which is hardly being used by the application, and there is very minimal data traffic coming into this cluster We are using Zabbix monitoring …

---

## [Collapse results by multipli fields( highRestClient java](https://discuss.elastic.co/t/collapse-results-by-multipli-fields-highrestclient-java/298740)

<div class="topic-metadata">

**Author:** [@Anna\_Kuranda](https://discuss.elastic.co/u/Anna_Kuranda)\
**Replies:** 4\
**Last updated:** [March 13, 2022, 2:26pm UTC](https://discuss.elastic.co/t/collapse-results-by-multipli-fields-highrestclient-java/298740 "2022-03-13T14:26:06Z")

</div>

Hi I need do collapse by two fields :field1 and field2 I use java collapse by field1 searchSourceBuilder.collapse(new CollapseBuilder("field1").setInnerHits(innerHitBuilder)); In my case I need additional colla…

---

## [Elasticsearch 8.1 fail to start](https://discuss.elastic.co/t/elasticsearch-8-1-fail-to-start/299524)

<div class="topic-metadata">

**Author:** [@mayayisim](https://discuss.elastic.co/u/mayayisim)\
**Replies:** 1\
**Last updated:** [March 13, 2022, 12:37pm UTC](https://discuss.elastic.co/t/elasticsearch-8-1-fail-to-start/299524 "2022-03-13T12:37:27Z")

</div>

Good day Please assist with Elasticsearch failing to start, I checked the logs and its complaining about access denied on /var/run/Elasticsearch. I then created the path and now it's complaining about the Elasticsearch.…

---

## [Output format](https://discuss.elastic.co/t/output-format/299558)

<div class="topic-metadata">

**Author:** [@avnere](https://discuss.elastic.co/u/avnere)\
**Replies:** 0\
**Last updated:** [March 13, 2022, 8:20am UTC](https://discuss.elastic.co/t/output-format/299558 "2022-03-13T08:20:47Z")

</div>

Hi, Is there a way to get csv output format when querying by DSL? I show that when querying by SQL, you have to option to do it. Thanks...

[Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=475)

[Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=477)
