# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=480 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 481 --- ## [ML datafeed bucket aggregation/script challenge](https://discuss.elastic.co/t/ml-datafeed-bucket-aggregation-script-challenge/297552)
**Author:** [@rcowart](https://discuss.elastic.co/u/rcowart)\ **Replies:** 6\ **Last updated:** [March 7, 2022, 9:35pm UTC](https://discuss.elastic.co/t/ml-datafeed-bucket-aggregation-script-challenge/297552 "2022-03-07T21:35:41Z")
I would like to create an anomaly detection job for the ratio of two counts. The logic is as follows... A = count filtered by condition X B = count filtered by condition Y C = A/B The datafeed would need to produce C… --- ## [Best practices for Elastic DB deployment for 100TB data](https://discuss.elastic.co/t/best-practices-for-elastic-db-deployment-for-100tb-data/298918)
**Author:** [@noamsh88](https://discuss.elastic.co/u/noamsh88)\ **Replies:** 4\ **Last updated:** [March 7, 2022, 8:35pm UTC](https://discuss.elastic.co/t/best-practices-for-elastic-db-deployment-for-100tb-data/298918 "2022-03-07T20:35:19Z")
Hello, We are designing new product that based on Elasticsearch that suppose to have around 100TB data Deployment will be on-prem (bare metal with Linux OS installed on it) and would like to ask: What is best practic… --- ## [Error while starting ES7.17.0](https://discuss.elastic.co/t/error-while-starting-es7-17-0/298989)
**Author:** [@nandatibco](https://discuss.elastic.co/u/nandatibco)\ **Replies:** 1\ **Last updated:** [March 7, 2022, 7:52pm UTC](https://discuss.elastic.co/t/error-while-starting-es7-17-0/298989 "2022-03-07T19:52:11Z")
Hello team, While starting Elasticsearch 7.17.0 with security enabled, getting below error. Please suggest where we need set the password and how. Thanks in advance. Error: \[o.e.b.ElasticsearchUncaughtExceptionHandl… --- ## [SQL match function](https://discuss.elastic.co/t/sql-match-function/298922)
**Author:** [@avnere](https://discuss.elastic.co/u/avnere)\ **Replies:** 3\ **Last updated:** [March 7, 2022, 5:39pm UTC](https://discuss.elastic.co/t/sql-match-function/298922 "2022-03-07T17:39:23Z")
Hi, I am looking how to perform LIKE on text type. I found a way by MATCH. Is MATCH is Elasticsearch SQL unique function or native SQL? for example: MATCH(foo, 'bar') Are there more options to perform LIKE on text… --- ## [Time zones in query string query not working](https://discuss.elastic.co/t/time-zones-in-query-string-query-not-working/298995)
**Author:** [@Bostjan\_Kovac](https://discuss.elastic.co/u/Bostjan_Kovac)\ **Replies:** 0\ **Last updated:** [March 7, 2022, 5:08pm UTC](https://discuss.elastic.co/t/time-zones-in-query-string-query-not-working/298995 "2022-03-07T17:08:36Z")
I believe that the query string queries are not acknowledging the time\_zone property in the query. I have tested with range query and they are working as expected. My test index: PUT test { "mappings": { "dynamic… --- ## [Pulling aggregations for use in watchers](https://discuss.elastic.co/t/pulling-aggregations-for-use-in-watchers/298977)
**Author:** [@walshe06](https://discuss.elastic.co/u/walshe06)\ **Replies:** 0\ **Last updated:** [March 7, 2022, 2:31pm UTC](https://discuss.elastic.co/t/pulling-aggregations-for-use-in-watchers/298977 "2022-03-07T14:31:38Z")
Hi all In the below example, I have added terms to pull out the referer in the aggregation so I can use it in my watcher action. I can pull each referer individually with the following 'referer': e.per\_15m.buckets\[0\].re… --- ## [Master node role cannot be removed in 8.0.0](https://discuss.elastic.co/t/master-node-role-cannot-be-removed-in-8-0-0/298526)
**Author:** [@jean.bissonnette](https://discuss.elastic.co/u/jean.bissonnette)\ **Replies:** 28\ **Last updated:** [March 7, 2022, 2:24pm UTC](https://discuss.elastic.co/t/master-node-role-cannot-be-removed-in-8-0-0/298526 "2022-03-07T14:24:38Z")
I have 5 nodes, 3 of them are master. Running on podman on RHEL as systemD service. By error, I set the 2 others as master and ran the cluster but they should be data only. When I change their Elasticsearch.yml to rem… --- ## [Unbalanced shards](https://discuss.elastic.co/t/unbalanced-shards/298520)
**Author:** [@Sashi](https://discuss.elastic.co/u/Sashi)\ **Replies:** 6\ **Last updated:** [March 7, 2022, 2:17pm UTC](https://discuss.elastic.co/t/unbalanced-shards/298520 "2022-03-07T14:17:40Z")
Hello, I have a cluster of over 25 nodes and the indices are balanced on all the nodes except for one node. Let's call the node as problematic node. The problematic node has less indices and shards when compared to othe… --- ## [Errors with High Level Rest Client After Upgrading to Elasticsearch 8.0.1](https://discuss.elastic.co/t/errors-with-high-level-rest-client-after-upgrading-to-elasticsearch-8-0-1/298972)
**Author:** [@chris.stack.bb](https://discuss.elastic.co/u/chris.stack.bb)\ **Replies:** 1\ **Last updated:** [March 7, 2022, 1:56pm UTC](https://discuss.elastic.co/t/errors-with-high-level-rest-client-after-upgrading-to-elasticsearch-8-0-1/298972 "2022-03-07T13:56:50Z")
Hello, After upgrading to Elasticsearch 8.0.1, I am having a variety of errors interfacing from my Java High Level Rest Client version 7.17.1 (originally tried with 7.15.2). The code now seems extremely sensitive to nul… --- ## [Flush syncing on rotated indicies](https://discuss.elastic.co/t/flush-syncing-on-rotated-indicies/298911)
**Author:** [@stefws](https://discuss.elastic.co/u/stefws)\ **Replies:** 4\ **Last updated:** [March 7, 2022, 11:30am UTC](https://discuss.elastic.co/t/flush-syncing-on-rotated-indicies/298911 "2022-03-07T11:30:48Z")
Thinking about running an operation procedure that should do flushed sync on daily 'rotated' indices and wondering... Would this be a feasible and good idea and what to avoid? If we after midnight do synced flush per i… --- ## [Two DC cluster setup](https://discuss.elastic.co/t/two-dc-cluster-setup/298912)
**Author:** [@stefws](https://discuss.elastic.co/u/stefws)\ **Replies:** 2\ **Last updated:** [March 7, 2022, 11:29am UTC](https://discuss.elastic.co/t/two-dc-cluster-setup/298912 "2022-03-07T11:29:34Z")
Have startedin a new position where we currently have a two Data Center cluster with 5 master/data nodes + 1 master-only node and indices having replication of 1. Wondering if we better ought to do few (+3) dedicated ma… --- ## [Elasticsearch-dsl python connection timeout](https://discuss.elastic.co/t/elasticsearch-dsl-python-connection-timeout/293762)
**Author:** [@maph](https://discuss.elastic.co/u/maph)\ **Replies:** 6\ **Last updated:** [March 7, 2022, 10:19am UTC](https://discuss.elastic.co/t/elasticsearch-dsl-python-connection-timeout/293762 "2022-03-07T10:19:42Z")
Hi all, Fairly new to Elasticsearch and hoping that some of you might be able to help me troubleshoot an attempt to use the python Elasticsearch-dsl to perform a search in a public database? I am able to access the dat… --- ## [Create a dashboard using two different Data stream index](https://discuss.elastic.co/t/create-a-dashboard-using-two-different-data-stream-index/298388)
**Author:** [@niveditakathal](https://discuss.elastic.co/u/niveditakathal)\ **Replies:** 3\ **Last updated:** [March 7, 2022, 9:57am UTC](https://discuss.elastic.co/t/create-a-dashboard-using-two-different-data-stream-index/298388 "2022-03-07T09:57:48Z")
Hi Experts, I want to create a dashboard using two different Data stream index {as mentioned below under notes}. when I checked the available options to do so , I read about \_aliases option; however in my use-case that … --- ## [Elasticsearch automatic reindex](https://discuss.elastic.co/t/elasticsearch-automatic-reindex/298847)
**Author:** [@bianca6](https://discuss.elastic.co/u/bianca6)\ **Replies:** 3\ **Last updated:** [March 7, 2022, 8:25am UTC](https://discuss.elastic.co/t/elasticsearch-automatic-reindex/298847 "2022-03-07T08:25:38Z")
Hello, I am using a pipeline with Filebeat / Logstash / Elasticsearch / Kibana version 8 to deal with logs. One of the field is a nano second timestamp. Long story, I can't send it as a 'date\_nanos', so, what I'm doin… --- ## [Elasticsearch startup problemse](https://discuss.elastic.co/t/elasticsearch-startup-problemse/298831)
**Author:** [@zx\_emo](https://discuss.elastic.co/u/zx_emo)\ **Replies:** 5\ **Last updated:** [March 7, 2022, 7:20am UTC](https://discuss.elastic.co/t/elasticsearch-startup-problemse/298831 "2022-03-07T07:20:59Z")
Hello, my Yml file looks like this #xpack.license.self\_generated.type: basic xpack.security.enabled: true #xpack.security.enrollment.enabled: true #xpack.security.enrollment.enabled: true # Enable encryption for HTTP … --- ## [How to use field-value-factor when mapping missing field in java?](https://discuss.elastic.co/t/how-to-use-field-value-factor-when-mapping-missing-field-in-java/298930)
**Author:** [@ifree-zm](https://discuss.elastic.co/u/ifree-zm)\ **Replies:** 1\ **Last updated:** [March 7, 2022, 2:56am UTC](https://discuss.elastic.co/t/how-to-use-field-value-factor-when-mapping-missing-field-in-java/298930 "2022-03-07T02:56:38Z")
If mapping does not have a field, field-value-factor is used; otherwise, field-value-factor is not used --- ## [Migration data from a cluster to another cluster](https://discuss.elastic.co/t/migration-data-from-a-cluster-to-another-cluster/298915)
**Author:** [@alicango](https://discuss.elastic.co/u/alicango)\ **Replies:** 6\ **Last updated:** [March 6, 2022, 11:41pm UTC](https://discuss.elastic.co/t/migration-data-from-a-cluster-to-another-cluster/298915 "2022-03-06T23:41:53Z")
Hello, dear community, Assume that I have got 2 different clusters(Cluster-A and Cluster-B). Each cluster has 3 master nodes, 2 hot nodes, 2 warm nodes, and 2 cold nodes. My goal is to migrate all data from Cluster-A t… --- ## [ElasticSearch to Analysis Services](https://discuss.elastic.co/t/elasticsearch-to-analysis-services/298727)
**Author:** [@LSCZZ](https://discuss.elastic.co/u/LSCZZ)\ **Replies:** 0\ **Last updated:** [March 3, 2022, 11:07am UTC](https://discuss.elastic.co/t/elasticsearch-to-analysis-services/298727 "2022-03-03T11:07:52Z")
is it possible to connect Elasticsearch to Analysis Services? I already got a ODBC Elastic Driver installed which is working fine because I'm able to pull data into Power BI, however I'd like to connect on Analysis Serv… --- ## [General question about Elasticsearch cluster](https://discuss.elastic.co/t/general-question-about-elasticsearch-cluster/298913)
**Author:** [@cyberzlo](https://discuss.elastic.co/u/cyberzlo)\ **Replies:** 1\ **Last updated:** [March 6, 2022, 10:19pm UTC](https://discuss.elastic.co/t/general-question-about-elasticsearch-cluster/298913 "2022-03-06T22:19:02Z")
Hi, I am using ELK 8, if I have 4 servers with Logstash and one of them have also additionally Elasticsearch and Kibana... ..and if I will create Elasticsearch cluster, can each of Logstash report to local Elasticsearch… --- ## [Slow search in Kibana / ElasticSearch](https://discuss.elastic.co/t/slow-search-in-kibana-elasticsearch/297368)
**Author:** [@notgurev](https://discuss.elastic.co/u/notgurev)\ **Replies:** 14\ **Last updated:** [March 6, 2022, 10:44am UTC](https://discuss.elastic.co/t/slow-search-in-kibana-elasticsearch/297368 "2022-03-06T10:44:29Z")
When trying to visualize data, it takes a lot of time to get even the most recent data. I'm trying to figure out what's wrong with our setup that causes this: 3 nodes (1 hot, 2 cold) Hourly indices, 1 shard per index (… --- ## [ElasticSearch aggregate on a scripted nested field](https://discuss.elastic.co/t/elasticsearch-aggregate-on-a-scripted-nested-field/298841)
**Author:** [@doogyatnesta](https://discuss.elastic.co/u/doogyatnesta)\ **Replies:** 2\ **Last updated:** [March 6, 2022, 10:32am UTC](https://discuss.elastic.co/t/elasticsearch-aggregate-on-a-scripted-nested-field/298841 "2022-03-06T10:32:30Z")
I have the following mapping in my Elasticsearch index (simplified as the other fields are irrelevant: { "test": { "mappings": { "properties": { "name": { "type": "keyword" }, … --- ## [How to create a index from \_security\\user so nonpriv user could view](https://discuss.elastic.co/t/how-to-create-a-index-from-security-user-so-nonpriv-user-could-view/298908)
**Author:** [@stobbe99](https://discuss.elastic.co/u/stobbe99)\ **Replies:** 0\ **Last updated:** [March 6, 2022, 9:52am UTC](https://discuss.elastic.co/t/how-to-create-a-index-from-security-user-so-nonpriv-user-could-view/298908 "2022-03-06T09:52:41Z")
Hello, To access \_security\\user you need full priv. I found \_reindex does not work on this. Does anybody know what the best way is to create an index that contains the native users so that it becomes accessable for non … --- ## [Elastic upgrade results in spikes of IOPS](https://discuss.elastic.co/t/elastic-upgrade-results-in-spikes-of-iops/298874)
**Author:** [@Idan\_Koch](https://discuss.elastic.co/u/Idan_Koch)\ **Replies:** 2\ **Last updated:** [March 6, 2022, 9:11am UTC](https://discuss.elastic.co/t/elastic-upgrade-results-in-spikes-of-iops/298874 "2022-03-06T09:11:47Z")
Hi, We recently upgraded from v6 to v7. We hold 400M documents. in the processor the upgrade we: reduced document size by half made schema strict increased number of shards from 20 to 30 in v6 we used elastic4s clie… --- ## [Rejecting mapping update to \[xxx\] as the final mapping would have more than 1 type: \[\_doc, xxx\]](https://discuss.elastic.co/t/rejecting-mapping-update-to-xxx-as-the-final-mapping-would-have-more-than-1-type-doc-xxx/298839)
**Author:** [@Ramesh\_balasubramani](https://discuss.elastic.co/u/Ramesh_balasubramani)\ **Replies:** 11\ **Last updated:** [March 5, 2022, 6:57pm UTC](https://discuss.elastic.co/t/rejecting-mapping-update-to-xxx-as-the-final-mapping-would-have-more-than-1-type-doc-xxx/298839 "2022-03-05T18:57:31Z")
I am using Elasticsearch 7.10.2 version. I need to create one index, Index name = device \_type name = device But I am not able to create getting error. POST device/device/169062 { "device\_name": "DESK… --- ## [Get documents starting at a high from](https://discuss.elastic.co/t/get-documents-starting-at-a-high-from/298714)
**Author:** [@NominaSumpta](https://discuss.elastic.co/u/NominaSumpta)\ **Replies:** 9\ **Last updated:** [March 5, 2022, 6:21pm UTC](https://discuss.elastic.co/t/get-documents-starting-at-a-high-from/298714 "2022-03-05T18:21:26Z")
Hi, I have an with ~ 1.500.000 (million) documents or so. I only want to get 1.000 results from it, but I want to start counting backwards. So, I want to retrieve documents 1.499.000 (- 1.000) through 1.500.000. I've se… --- ## [Multi\_Match Vs Query\_String\_Query?](https://discuss.elastic.co/t/multi-match-vs-query-string-query/298892)
**Author:** [@Nishikant\_Tayade](https://discuss.elastic.co/u/Nishikant_Tayade)\ **Replies:** 0\ **Last updated:** [March 5, 2022, 1:46pm UTC](https://discuss.elastic.co/t/multi-match-vs-query-string-query/298892 "2022-03-05T13:46:49Z")
I am using ES 7.10.2 I have fields with keyword and text mappings. When user specifies the search string, I wanted to parse the pieces of search string, for each specific field, in the specific way that field mapping i… --- ## [How to check if host.ip in particular CIDR](https://discuss.elastic.co/t/how-to-check-if-host-ip-in-particular-cidr/298648)
**Author:** [@Adriann](https://discuss.elastic.co/u/Adriann)\ **Replies:** 1\ **Last updated:** [March 4, 2022, 2:27pm UTC](https://discuss.elastic.co/t/how-to-check-if-host-ip-in-particular-cidr/298648 "2022-03-04T14:27:46Z")
Hello, I want to add an ingest pipeline script that will add particular fields if host.ip falls into the CIDR notation range. I was trying some stuff but still, that does not work The script does not return errors but… --- ## [Elastic search upgrade](https://discuss.elastic.co/t/elastic-search-upgrade/298827)
**Author:** [@aman123](https://discuss.elastic.co/u/aman123)\ **Replies:** 4\ **Last updated:** [March 5, 2022, 8:27am UTC](https://discuss.elastic.co/t/elastic-search-upgrade/298827 "2022-03-05T08:27:14Z")
Hi All, I'm upgrading the Elasticsearch cluster, currently I have 10 node clusters running on individual instances , All nodes are having older version, if I upgrade one by one all nodes starting from data node to maste… --- ## [Runtime\_mapping for aggregation context?](https://discuss.elastic.co/t/runtime-mapping-for-aggregation-context/298886)
**Author:** [@YuWatanabe](https://discuss.elastic.co/u/YuWatanabe)\ **Replies:** 0\ **Last updated:** [March 5, 2022, 5:29am UTC](https://discuss.elastic.co/t/runtime-mapping-for-aggregation-context/298886 "2022-03-05T05:29:12Z")
Hello ! I have a requirement which I would need calculate the total amount spiked compared to previous of latest month. I was able to achieve this by using watcher . However, this would be dependent on watcher so I … --- ## [White Papers on Using Elastic for Unstructured Data Queries on ZFS Filesystem](https://discuss.elastic.co/t/white-papers-on-using-elastic-for-unstructured-data-queries-on-zfs-filesystem/298877)
**Author:** [@minorsatellite](https://discuss.elastic.co/u/minorsatellite)\ **Replies:** 4\ **Last updated:** [March 5, 2022, 4:36am UTC](https://discuss.elastic.co/t/white-papers-on-using-elastic-for-unstructured-data-queries-on-zfs-filesystem/298877 "2022-03-05T04:36:32Z")
Im new to Elastic. Im wondering if anyone has successfully used Elastic alongside a ZFS Dataset in order to perform filesystem searches, and if so, what might that look like, and would it a user-friendly solution for non… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=479) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=481)