# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=477 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 478 --- ## [Elastic agent failing to enroll on a fresh install](https://discuss.elastic.co/t/elastic-agent-failing-to-enroll-on-a-fresh-install/298895)
**Author:** [@epheria](https://discuss.elastic.co/u/epheria)\ **Replies:** 3\ **Last updated:** [March 13, 2022, 6:50am UTC](https://discuss.elastic.co/t/elastic-agent-failing-to-enroll-on-a-fresh-install/298895 "2022-03-13T06:50:03Z")
Hello! I am having trouble getting an elastic agent to enroll on a host for monitoring (more specific details to come below). As an overview, here's what I'm working with: Freshly installed Elasticsearch and kibana (… --- ## [Null Value Replacement in Mapping does not work using NEST](https://discuss.elastic.co/t/null-value-replacement-in-mapping-does-not-work-using-nest/299553)
**Author:** [@xef](https://discuss.elastic.co/u/xef)\ **Replies:** 0\ **Last updated:** [March 13, 2022, 4:09am UTC](https://discuss.elastic.co/t/null-value-replacement-in-mapping-does-not-work-using-nest/299553 "2022-03-13T04:09:42Z")
We have ES version 17.14 and have a mapping for our Index: .Keyword(s =\> s.Name(c =\> c.Website).Index(false).NullValue("")) But if we try to use the update API : var result = await client.UpdateAsync\(post.Id,… --- ## [I regret that I couldn't find an OCR parser to handle image/ocr-png.Please set the OCR\_STRATEGY to NO\_OCR or configure yourOCR parser correctly](https://discuss.elastic.co/t/i-regret-that-i-couldnt-find-an-ocr-parser-to-handle-image-ocr-png-please-set-the-ocr-strategy-to-no-ocr-or-configure-yourocr-parser-correctly/299512)
**Author:** [@Morphus1](https://discuss.elastic.co/u/Morphus1)\ **Replies:** 8\ **Last updated:** [March 13, 2022, 3:18am UTC](https://discuss.elastic.co/t/i-regret-that-i-couldnt-find-an-ocr-parser-to-handle-image-ocr-png-please-set-the-ocr-strategy-to-no-ocr-or-configure-yourocr-parser-correctly/299512 "2022-03-13T03:18:59Z")
Hi Everyone, I'm trying to use OCR when indexing but not getting any results. I've tried using tesseract for images and Tika for the pdfs but not a single one will get indexed with "content". The error message is: 09… --- ## [Elastic Query Bool Logic/Subquery Structure Help](https://discuss.elastic.co/t/elastic-query-bool-logic-subquery-structure-help/299491)
**Author:** [@bsmith](https://discuss.elastic.co/u/bsmith)\ **Replies:** 1\ **Last updated:** [March 12, 2022, 5:09pm UTC](https://discuss.elastic.co/t/elastic-query-bool-logic-subquery-structure-help/299491 "2022-03-12T17:09:51Z")
Need help converting some SQL into elastic and stuck on some of the bool logic and probably isn't structured properly. Goal is to get a count of users that are active at a specified start date and are still active at the… --- ## [Creating a new column from existing columns](https://discuss.elastic.co/t/creating-a-new-column-from-existing-columns/299528)
**Author:** [@carl25en](https://discuss.elastic.co/u/carl25en)\ **Replies:** 1\ **Last updated:** [March 12, 2022, 5:00pm UTC](https://discuss.elastic.co/t/creating-a-new-column-from-existing-columns/299528 "2022-03-12T17:00:40Z")
Dear Elasticsearch community, I was wondering how I can create a DateTime column from 5 columns (forecasted\_year,month,day,hour,minute) as it is shown in the image (after creating a new index). I am not sure if this sh… --- ## [Elasticsearch Index creation time](https://discuss.elastic.co/t/elasticsearch-index-creation-time/299529)
**Author:** [@nunex\_17](https://discuss.elastic.co/u/nunex_17)\ **Replies:** 0\ **Last updated:** [March 12, 2022, 3:26pm UTC](https://discuss.elastic.co/t/elasticsearch-index-creation-time/299529 "2022-03-12T15:26:17Z")
Hi, Somehow my indexes are created each day at around 17pm. Indexes are being rolled over every day. What is happening is, for example, at 17pm of 11/03 the index-name-2022-03-11-00001 is created. Then, at 17pm of 12/0… --- ## [Problems caused by creating replica shards too quickly](https://discuss.elastic.co/t/problems-caused-by-creating-replica-shards-too-quickly/299513)
**Author:** [@slowup](https://discuss.elastic.co/u/slowup)\ **Replies:** 0\ **Last updated:** [March 12, 2022, 7:07am UTC](https://discuss.elastic.co/t/problems-caused-by-creating-replica-shards-too-quickly/299513 "2022-03-12T07:07:29Z")
When we execute batch execution, if the primary shard is indexed, we are increasing the replica shard at that time, But at that time, the search engine creates replica shards, and as you can see from the metrix, a large … --- ## [Cleaning up datastreams' indexes](https://discuss.elastic.co/t/cleaning-up-datastreams-indexes/299499)
**Author:** [@hebph001](https://discuss.elastic.co/u/hebph001)\ **Replies:** 0\ **Last updated:** [March 11, 2022, 8:24pm UTC](https://discuss.elastic.co/t/cleaning-up-datastreams-indexes/299499 "2022-03-11T20:24:27Z")
Hi there Elastic community, I'm really new to Elastic and run into an architectural problem with my cloud cluster. I need to delete unneeded old indices to free up some memory. I would like to know what would be the be… --- ## [Elastic Search Failing on multi tier environment](https://discuss.elastic.co/t/elastic-search-failing-on-multi-tier-environment/299495)
**Author:** [@Ish\_Singh](https://discuss.elastic.co/u/Ish_Singh)\ **Replies:** 0\ **Last updated:** [March 11, 2022, 7:32pm UTC](https://discuss.elastic.co/t/elastic-search-failing-on-multi-tier-environment/299495 "2022-03-11T19:32:47Z")
Hi All , we currently have 2 servers for TFS and 1 server hosts the Elasticsearch but somehow the search keeps on failing while accessing and i see the error in developer tools.. i believe its trying to cluster between 2… --- ## [Search based on runtime boolean calculated from now](https://discuss.elastic.co/t/search-based-on-runtime-boolean-calculated-from-now/299488)
**Author:** [@MarkAllan](https://discuss.elastic.co/u/MarkAllan)\ **Replies:** 0\ **Last updated:** [March 11, 2022, 7:14pm UTC](https://discuss.elastic.co/t/search-based-on-runtime-boolean-calculated-from-now/299488 "2022-03-11T19:14:07Z")
I need to be able to search on a field that is not part of the stored document but is derived from a field on that document. The document field is a timestamp called expiry\_utc\_timestamp. I need to be able to filter on … --- ## [Saving documents in multiple indexes/Retention policy based on documents fields (Looking for ideas)](https://discuss.elastic.co/t/saving-documents-in-multiple-indexes-retention-policy-based-on-documents-fields-looking-for-ideas/299482)
**Author:** [@scott\_stash](https://discuss.elastic.co/u/scott_stash)\ **Replies:** 0\ **Last updated:** [March 11, 2022, 5:31pm UTC](https://discuss.elastic.co/t/saving-documents-in-multiple-indexes-retention-policy-based-on-documents-fields-looking-for-ideas/299482 "2022-03-11T17:31:23Z")
Using 7.17.. currently I read log files in with filebeat or filebeat/logstash saving in ES. Log lines are dissected and we have a field called loglevel, for ERROR, WARN and INFO. If the message is an ERROR a field call… --- ## [Elasticsearch 8.1 normalizer in strings error](https://discuss.elastic.co/t/elasticsearch-8-1-normalizer-in-strings-error/299476)
**Author:** [@willypol](https://discuss.elastic.co/u/willypol)\ **Replies:** 7\ **Last updated:** [March 11, 2022, 5:30pm UTC](https://discuss.elastic.co/t/elasticsearch-8-1-normalizer-in-strings-error/299476 "2022-03-11T17:30:17Z")
Hello, I've been using the next component template in elastic 7. I recently upgraded to elastic 8.1 and it won't let me create the template like before. PUT \_component\_template/keywords { "template": { "mappings":… --- ## [Snapshot - Register repository for Snapshot](https://discuss.elastic.co/t/snapshot-register-repository-for-snapshot/299388)
**Author:** [@Prabakar](https://discuss.elastic.co/u/Prabakar)\ **Replies:** 3\ **Last updated:** [March 11, 2022, 5:00pm UTC](https://discuss.elastic.co/t/snapshot-register-repository-for-snapshot/299388 "2022-03-11T17:00:51Z")
Hello Team, We are using Elastic on Kubernetes (ECK) with elastic Enterprise license. We have created on- premise elastic clusters. We are trying to create repository to take snapshots, but we are getting below error wh… --- ## [How to read group by buckets key values using "ctx" from below query](https://discuss.elastic.co/t/how-to-read-group-by-buckets-key-values-using-ctx-from-below-query/299383)
**Author:** [@srinivasa\_adaboina](https://discuss.elastic.co/u/srinivasa_adaboina)\ **Replies:** 2\ **Last updated:** [March 11, 2022, 4:23pm UTC](https://discuss.elastic.co/t/how-to-read-group-by-buckets-key-values-using-ctx-from-below-query/299383 "2022-03-11T16:23:48Z")
{ "\_shards": { "total": 155, "failed": 0, "successful": 155, "skipped": 0 }, "hits": { "hits": , "total": { "value": 5535, "relation": "eq" }, "max\_score": null }, "took": 44, "timed\_out": false, "aggreg… --- ## [TimeValue error on XContentBuilder](https://discuss.elastic.co/t/timevalue-error-on-xcontentbuilder/299012)
**Author:** [@dancerjohn](https://discuss.elastic.co/u/dancerjohn)\ **Replies:** 7\ **Last updated:** [March 11, 2022, 2:14pm UTC](https://discuss.elastic.co/t/timevalue-error-on-xcontentbuilder/299012 "2022-03-11T14:14:47Z")
Getting IllegalArgumentException ("cannot write xcontent for unknown value of type TimeValue") even though org.Elasticsearch.common.unit.TimeValue is an elastic class and is used in org.Elasticsearch.search.builder.Point… --- ## [Use of ELK to implement AI Algorithm](https://discuss.elastic.co/t/use-of-elk-to-implement-ai-algorithm/299235)
**Author:** [@bechir-jamoussi](https://discuss.elastic.co/u/bechir-jamoussi)\ **Replies:** 2\ **Last updated:** [March 11, 2022, 2:01pm UTC](https://discuss.elastic.co/t/use-of-elk-to-implement-ai-algorithm/299235 "2022-03-11T14:01:14Z")
Dear Community, I want to use only Beats + Logstash (for collecting and processing the data) and Elasticsearch(as a database) and then based on that data, I need to use AI to make a decision, it is not log analysis or a… --- ## [How to find all the queries terminated by elasticsearch when it reaches requestTimeout](https://discuss.elastic.co/t/how-to-find-all-the-queries-terminated-by-elasticsearch-when-it-reaches-requesttimeout/299145)
**Author:** [@jatin\_gupta](https://discuss.elastic.co/u/jatin_gupta)\ **Replies:** 5\ **Last updated:** [March 11, 2022, 1:31pm UTC](https://discuss.elastic.co/t/how-to-find-all-the-queries-terminated-by-elasticsearch-when-it-reaches-requesttimeout/299145 "2022-03-11T13:31:59Z")
We have specified request\_timeout while creating Elasticsearch client using javascript library. Whenever the timeout is reached our understanding is that the query is terminated by Elasticsearch as it does not appear in … --- ## [Unable to create an enrollment token for Kibana. "Elasticsearch node HTTP layer SSL configuration Keystore doesn't contain any PrivateKey entries where the associated certificate is a CA certificate"](https://discuss.elastic.co/t/unable-to-create-an-enrollment-token-for-kibana-elasticsearch-node-http-layer-ssl-configuration-keystore-doesnt-contain-any-privatekey-entries-where-the-associated-certificate-is-a-ca-certificate/297032)
**Author:** [@maof97](https://discuss.elastic.co/u/maof97)\ **Replies:** 6\ **Last updated:** [March 11, 2022, 1:09pm UTC](https://discuss.elastic.co/t/unable-to-create-an-enrollment-token-for-kibana-elasticsearch-node-http-layer-ssl-configuration-keystore-doesnt-contain-any-privatekey-entries-where-the-associated-certificate-is-a-ca-certificate/297032 "2022-03-11T13:09:32Z")
Hello, I tried today to setup my ELK stack securely so I followed the documentation and created all certs that I need using the certutil and encrypted the CA and the node cert with passwords. I placed the http.p12 file… --- ## [After adding Nodes to a Cluster - common Users cannot authenticate on said nodes](https://discuss.elastic.co/t/after-adding-nodes-to-a-cluster-common-users-cannot-authenticate-on-said-nodes/299419)
**Author:** [@Moritz\_Kiesewetter](https://discuss.elastic.co/u/Moritz_Kiesewetter)\ **Replies:** 2\ **Last updated:** [March 11, 2022, 1:05pm UTC](https://discuss.elastic.co/t/after-adding-nodes-to-a-cluster-common-users-cannot-authenticate-on-said-nodes/299419 "2022-03-11T13:05:51Z")
Hi Everyone, i'm currently running a 3 Node Cluster, each Node is running CentOS 7. The Version of all the components is 7.15. We added 2 new nodes - because the old "Data Storing" Nodes were set up without lvm and t… --- ## [Is there an equivalent feature to OpenSearch's "user attributes" in Elasticsearch?](https://discuss.elastic.co/t/is-there-an-equivalent-feature-to-opensearchs-user-attributes-in-elasticsearch/299393)
**Author:** [@catmanjan](https://discuss.elastic.co/u/catmanjan)\ **Replies:** 2\ **Last updated:** [March 11, 2022, 11:24am UTC](https://discuss.elastic.co/t/is-there-an-equivalent-feature-to-opensearchs-user-attributes-in-elasticsearch/299393 "2022-03-11T11:24:47Z")
I want to set up document level security using ABAC I want to set up a role that will mandate that a user has all the necessary attributes, but each user will have a different set of attributes - rather than making many… --- ## [Master not discovred ( multi-nodes cluster )](https://discuss.elastic.co/t/master-not-discovred-multi-nodes-cluster/299422)
**Author:** [@Achraf\_MENSI](https://discuss.elastic.co/u/Achraf_MENSI)\ **Replies:** 5\ **Last updated:** [March 11, 2022, 10:20am UTC](https://discuss.elastic.co/t/master-not-discovred-multi-nodes-cluster/299422 "2022-03-11T10:20:49Z")
my nodes can’t see each other on my Elasticsearch cluster on vm azure \`{"error":{"root\_cause":\[{"type":"master\_not\_discovered\_exception","reason":null}\],"type":"master\_not\_discovered\_exception","reason":null},"status":5… --- ## [Elastic startup exception](https://discuss.elastic.co/t/elastic-startup-exception/299415)
**Author:** [@zx\_emo](https://discuss.elastic.co/u/zx_emo)\ **Replies:** 2\ **Last updated:** [March 11, 2022, 9:05am UTC](https://discuss.elastic.co/t/elastic-startup-exception/299415 "2022-03-11T09:05:29Z")
\[es@localhost elasticsearch-8.0.1\]$ vim config/elasticsearch.yml \[es@localhost elasticsearch-8.0.1\]$ bin/elasticsearch warning: ignoring JAVA\_HOME=/usr/local/java/jdk1.8.0\_311; using bundled JDK warning: ignoring JAVA\_H… --- ## [Unable to use RESTful API in Elastic Cloud with curl](https://discuss.elastic.co/t/unable-to-use-restful-api-in-elastic-cloud-with-curl/299358)
**Author:** [@Conor\_Hennessy](https://discuss.elastic.co/u/Conor_Hennessy)\ **Replies:** 1\ **Last updated:** [March 11, 2022, 8:28am UTC](https://discuss.elastic.co/t/unable-to-use-restful-api-in-elastic-cloud-with-curl/299358 "2022-03-11T08:28:10Z")
Hi, I have a deployment on Elastic Cloud with an endpoint of the form: https://my\_host\_name.es.westusa.azure.elastic-cloud.com I wish to use the api to edit the extensions, specifically to add a synonyms file, using c… --- ## [Elasticsearch can-match phase](https://discuss.elastic.co/t/elasticsearch-can-match-phase/299331)
**Author:** [@qixian](https://discuss.elastic.co/u/qixian)\ **Replies:** 1\ **Last updated:** [March 11, 2022, 7:24am UTC](https://discuss.elastic.co/t/elasticsearch-can-match-phase/299331 "2022-03-11T07:24:09Z")
hello,who can help me with this question,thanks. I konw that the old version of Elasticsearch before 7.16,during the can-match phase,the search’s coordinating node sent an individual request to each shard checked,is it … --- ## [Elasticsearch restore cluster with TLS enabled](https://discuss.elastic.co/t/elasticsearch-restore-cluster-with-tls-enabled/299392)
**Author:** [@auto\_reply\_007](https://discuss.elastic.co/u/auto_reply_007)\ **Replies:** 3\ **Last updated:** [March 11, 2022, 6:42am UTC](https://discuss.elastic.co/t/elasticsearch-restore-cluster-with-tls-enabled/299392 "2022-03-11T06:42:54Z")
Hello! we have Elasticsearch 7.10.2 cluster in Delhi ( with InterNode tls and users enabled ) and we want to move cluster data onto another location ( Dubai ) and how to backup all data except security indices? because … --- ## [How to convert scripted field to runtime field - KIbana \_doc compile error](https://discuss.elastic.co/t/how-to-convert-scripted-field-to-runtime-field-kibana-doc-compile-error/299391)
**Author:** [@rugenl](https://discuss.elastic.co/u/rugenl)\ **Replies:** 1\ **Last updated:** [March 11, 2022, 3:42am UTC](https://discuss.elastic.co/t/how-to-convert-scripted-field-to-runtime-field-kibana-doc-compile-error/299391 "2022-03-11T03:42:02Z")
Some time ago I fought scripted fields in this post: Painless doc values; how to reference grouped fields Now scripted fields are deprecated and I'm trying to convert this to a runtime field. I'm using the KIbana compon… --- ## [How to Update a Field in a document to NULL usiong NEST and the Update API](https://discuss.elastic.co/t/how-to-update-a-field-in-a-document-to-null-usiong-nest-and-the-update-api/299003)
**Author:** [@xef](https://discuss.elastic.co/u/xef)\ **Replies:** 4\ **Last updated:** [March 11, 2022, 3:40am UTC](https://discuss.elastic.co/t/how-to-update-a-field-in-a-document-to-null-usiong-nest-and-the-update-api/299003 "2022-03-11T03:40:40Z")
This is the third time we are posting this in the hope someone can shed some light on it - Please. We are using the NEST library with Elasticsearch versions 7.14. Lets say we have assigned a field a value of "hello Wor… --- ## [Can one specify format of datetime in query?](https://discuss.elastic.co/t/can-one-specify-format-of-datetime-in-query/299263)
**Author:** [@Russell\_Fulton](https://discuss.elastic.co/u/Russell_Fulton)\ **Replies:** 5\ **Last updated:** [March 11, 2022, 1:47am UTC](https://discuss.elastic.co/t/can-one-specify-format-of-datetime-in-query/299263 "2022-03-11T01:47:47Z")
Is there a way of specifying the format of times used in a query? In most of my indexes I convert times to ISO8601 but one data source had a totally non standard format and I decided that it was easier to simply specify… --- ## [Elasticsearch java api tail](https://discuss.elastic.co/t/elasticsearch-java-api-tail/299387)
**Author:** [@111505](https://discuss.elastic.co/u/111505)\ **Replies:** 0\ **Last updated:** [March 11, 2022, 1:35am UTC](https://discuss.elastic.co/t/elasticsearch-java-api-tail/299387 "2022-03-11T01:35:24Z")
Hi. I want to implement the "tail" function with Java. Will the Elasticsearch java API provide similar functions to "tail"? I plan to use it when I look at Log. The Scroll API seems to be difficult to write due to the… --- ## [During bootstrap Created elasticsearch keystore in /usr/share/elasticsearch/config/elasticsearch.keystore](https://discuss.elastic.co/t/during-bootstrap-created-elasticsearch-keystore-in-usr-share-elasticsearch-config-elasticsearch-keystore/299363)
**Author:** [@INS](https://discuss.elastic.co/u/INS)\ **Replies:** 1\ **Last updated:** [March 10, 2022, 8:32pm UTC](https://discuss.elastic.co/t/during-bootstrap-created-elasticsearch-keystore-in-usr-share-elasticsearch-config-elasticsearch-keystore/299363 "2022-03-10T20:32:06Z")
Hi I don't understand I have provisioned 55 nodes over docker compose on 3 host, a few hosts wake up and still alive, but most of them when I've checked logs has a state and a few docker container was created but the b… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=476) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=478)