# Elasticsearch

**URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=483

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 484

---

## [Calculate cosine similarity for nested object in elasticsearch using Python](https://discuss.elastic.co/t/calculate-cosine-similarity-for-nested-object-in-elasticsearch-using-python/298601)

<div class="topic-metadata">

**Author:** [@RiyaP](https://discuss.elastic.co/u/RiyaP)\
**Replies:** 0\
**Last updated:** [March 2, 2022, 9:42am UTC](https://discuss.elastic.co/t/calculate-cosine-similarity-for-nested-object-in-elasticsearch-using-python/298601 "2022-03-02T09:42:15Z")

</div>

I am working on an use case which has documents in following format:- \[{'Fruits': \['Mango', 'Apple'\]}, {'Fruits': \['Banana', 'Guava', 'Mango'\]}, {'Fruits': \['Grapes', 'Apple'\]}\] I am storing the data into Elasticsear…

---

## [Continuous transformation averaging](https://discuss.elastic.co/t/continuous-transformation-averaging/298494)

<div class="topic-metadata">

**Author:** [@sg09](https://discuss.elastic.co/u/sg09)\
**Replies:** 3\
**Last updated:** [March 2, 2022, 10:17am UTC](https://discuss.elastic.co/t/continuous-transformation-averaging/298494 "2022-03-02T10:17:00Z")

</div>

Hi, We collect device behavior/events during the day in a timeline index. Devices are turn on and off by customers and events are sent as they happen and each event provides event name and time consumed for each event. …

---

## [Why percentiles are based on iterations instead of number of requests](https://discuss.elastic.co/t/why-percentiles-are-based-on-iterations-instead-of-number-of-requests/298181)

<div class="topic-metadata">

**Author:** [@Thanin\_Srithai](https://discuss.elastic.co/u/Thanin_Srithai)\
**Replies:** 4\
**Last updated:** [March 2, 2022, 9:09am UTC](https://discuss.elastic.co/t/why-percentiles-are-based-on-iterations-instead-of-number-of-requests/298181 "2022-03-02T09:09:23Z")

</div>

I noticed that the document says it need 1000 iterations or more in order to calculate 99.9th percentile. here I wonder that why it has to base on number of iterations but not the actual amount of requests. In many tra…

---

## [Any alternative method of Searchsearch(SearchRequest request, Class\<TDocument\> tDocumentClass)](https://discuss.elastic.co/t/any-alternative-method-of-searchsearch-searchrequest-request-class-tdocument-tdocumentclass/298591)

<div class="topic-metadata">

**Author:** [@Vaibhav\_Yadav](https://discuss.elastic.co/u/Vaibhav_Yadav)\
**Replies:** 0\
**Last updated:** [March 2, 2022, 8:16am UTC](https://discuss.elastic.co/t/any-alternative-method-of-searchsearch-searchrequest-request-class-tdocument-tdocumentclass/298591 "2022-03-02T08:16:15Z")

</div>

Hello, Is there any alternative method for Searchsearch(SearchRequest request, Class\<TDocument\> tDocumentClass) that does not take Class\<TDocument\> tDocumentClass as an argument, because I do not have such type of mode…

---

## [Docker Volume driver choice](https://discuss.elastic.co/t/docker-volume-driver-choice/298586)

<div class="topic-metadata">

**Author:** [@INS](https://discuss.elastic.co/u/INS)\
**Replies:** 0\
**Last updated:** [March 2, 2022, 7:45am UTC](https://discuss.elastic.co/t/docker-volume-driver-choice/298586 "2022-03-02T07:45:25Z")

</div>

Hi Under creating docker compose file I have come across two vaguely described cases: when I need to use an external disk for example \[ I have a 3 hosts with multiply ssd(/opt/ssd/ds1/hot\_data/) and hdd (/opt/hdd/ds1/…

---

## [Is snapshot restore incremental？](https://discuss.elastic.co/t/is-snapshot-restore-incremental/298474)

<div class="topic-metadata">

**Author:** [@casterQ](https://discuss.elastic.co/u/casterQ)\
**Replies:** 14\
**Last updated:** [March 2, 2022, 7:17am UTC](https://discuss.elastic.co/t/is-snapshot-restore-incremental/298474 "2022-03-02T07:17:50Z")

</div>

As we know, the snapshot process is incremental, so we can take snapshots frequently and It will be very fast after the first time。 My question is how restore work, When I restore snapshots in other clusters, is it incr…

---

## [Shrinked index should have same security settings than original index](https://discuss.elastic.co/t/shrinked-index-should-have-same-security-settings-than-original-index/298512)

<div class="topic-metadata">

**Author:** [@ebuildy](https://discuss.elastic.co/u/ebuildy)\
**Replies:** 0\
**Last updated:** [March 1, 2022, 1:27pm UTC](https://discuss.elastic.co/t/shrinked-index-should-have-same-security-settings-than-original-index/298512 "2022-03-01T13:27:54Z")

</div>

When using ILM to reduce index, the new index change its name: "shrink-zda-original". When using security, we configure some permissions to "original" index. ILM will break permissions, this is really annoying using el…

---

## [Hello elastic - Multiple Pipelines](https://discuss.elastic.co/t/hello-elastic-multiple-pipelines/298484)

<div class="topic-metadata">

**Author:** [@jie](https://discuss.elastic.co/u/jie)\
**Replies:** 9\
**Last updated:** [March 2, 2022, 6:45am UTC](https://discuss.elastic.co/t/hello-elastic-multiple-pipelines/298484 "2022-03-02T06:45:45Z")

</div>

DELETE index PUT index/\_doc/1 { "foo": "bar" } GET index/\_search { "query": { "match": { "foo": "bar" } } }

---

## [Mapping Problem](https://discuss.elastic.co/t/mapping-problem/298521)

<div class="topic-metadata">

**Author:** [@Busra\_Duygu](https://discuss.elastic.co/u/Busra_Duygu)\
**Replies:** 2\
**Last updated:** [March 2, 2022, 6:20am UTC](https://discuss.elastic.co/t/mapping-problem/298521 "2022-03-02T06:20:20Z")

</div>

Hello dear friends, I have a big problem. The problem is ; I have an index that I created by reindexing from another index. The mapping of this index was fine before, but now there are corruptions, I have no idea why. Fi…

---

## [How do synchronization data in es](https://discuss.elastic.co/t/how-do-synchronization-data-in-es/298581)

<div class="topic-metadata">

**Author:** [@YaY](https://discuss.elastic.co/u/YaY)\
**Replies:** 0\
**Last updated:** [March 2, 2022, 5:13am UTC](https://discuss.elastic.co/t/how-do-synchronization-data-in-es/298581 "2022-03-02T05:13:18Z")

</div>

i know i can use 'reindex' to do the synchronization, but it's full synchronization rigth?! even add 'op\_type=create' only will find the missing index in the full index, my requirement is only handle and create increm…

---

## [Dynamically adding runtime fields](https://discuss.elastic.co/t/dynamically-adding-runtime-fields/298427)

<div class="topic-metadata">

**Author:** [@nilei](https://discuss.elastic.co/u/nilei)\
**Replies:** 1\
**Last updated:** [March 2, 2022, 4:55am UTC](https://discuss.elastic.co/t/dynamically-adding-runtime-fields/298427 "2022-03-02T04:55:53Z")

</div>

Dear all, I have a few runtime fields with painless scripts in my mappings that work pretty well. So far I have a list of all the date fields to index. However, things are changing and now I have the problem that there …

---

## [Fleet Server - Certificate Challenges!](https://discuss.elastic.co/t/fleet-server-certificate-challenges/297896)

<div class="topic-metadata">

**Author:** [@praveen\_raju](https://discuss.elastic.co/u/praveen_raju)\
**Replies:** 1\
**Last updated:** [March 2, 2022, 12:33am UTC](https://discuss.elastic.co/t/fleet-server-certificate-challenges/297896 "2022-03-02T00:33:01Z")

</div>

Hello When i try to register Fleet Server using a certificate, it is getting successfully registered. But the problem is, it is throwing "Generating self-signed certificate for Fleet Server" after executing the command …

---

## [Standalone to Cluster Migration - any tips](https://discuss.elastic.co/t/standalone-to-cluster-migration-any-tips/298211)

<div class="topic-metadata">

**Author:** [@PSFletchTheTek](https://discuss.elastic.co/u/PSFletchTheTek)\
**Replies:** 5\
**Last updated:** [March 1, 2022, 10:53pm UTC](https://discuss.elastic.co/t/standalone-to-cluster-migration-any-tips/298211 "2022-03-01T22:53:45Z")

</div>

Hi All, So I've got a nice elk instance working. My first in a very long time ( thanks to the security pack) that I don't want to blow away and rebuild when I want to reconfigure it. But what I had always planned to d…

---

## [Optimal node roles for 100-node cluster](https://discuss.elastic.co/t/optimal-node-roles-for-100-node-cluster/298511)

<div class="topic-metadata">

**Author:** [@Musab\_Dogan](https://discuss.elastic.co/u/Musab_Dogan)\
**Replies:** 1\
**Last updated:** [March 1, 2022, 10:27pm UTC](https://discuss.elastic.co/t/optimal-node-roles-for-100-node-cluster/298511 "2022-03-01T22:27:38Z")

</div>

A cluster of 100 nodes was installed. We want it to serve as a search engine like Google. Servers are located in a data center. Raid-0 structure was preferred for the high-speed requirement. Query traffic will be more…

---

## [Please check if ES service is running properly:ElasticsearchStatusException](https://discuss.elastic.co/t/please-check-if-es-service-is-running-properly-elasticsearchstatusexception/298501)

<div class="topic-metadata">

**Author:** [@navin\_boddu](https://discuss.elastic.co/u/navin_boddu)\
**Replies:** 1\
**Last updated:** [March 1, 2022, 10:24pm UTC](https://discuss.elastic.co/t/please-check-if-es-service-is-running-properly-elasticsearchstatusexception/298501 "2022-03-01T22:24:34Z")

</div>

ERROR Error occured while creating mapping of document into ES. Please check if ES service is running properly:ElasticsearchStatusException\[Elasticsearch exception \[type=validation\_exception, reason=Validation Failed: 1:…

---

## [Apply same settings on all fields that start with the same name in the index template in the Elasticsearch](https://discuss.elastic.co/t/apply-same-settings-on-all-fields-that-start-with-the-same-name-in-the-index-template-in-the-elasticsearch/298528)

<div class="topic-metadata">

**Author:** [@Usman18](https://discuss.elastic.co/u/Usman18)\
**Replies:** 1\
**Last updated:** [March 1, 2022, 10:22pm UTC](https://discuss.elastic.co/t/apply-same-settings-on-all-fields-that-start-with-the-same-name-in-the-index-template-in-the-elasticsearch/298528 "2022-03-01T22:22:41Z")

</div>

n my Elasticsearch index, there is a field for example field\_abc that is an object. The problem is that multiple fields with name field\_abc can exist with different suffix. Like in our index in the same document field\_ab…

---

## [Error elastic search wont find java.dll and java SE](https://discuss.elastic.co/t/error-elastic-search-wont-find-java-dll-and-java-se/298540)

<div class="topic-metadata">

**Author:** [@tom\_Shabtay](https://discuss.elastic.co/u/tom_Shabtay)\
**Replies:** 1\
**Last updated:** [March 1, 2022, 10:19pm UTC](https://discuss.elastic.co/t/error-elastic-search-wont-find-java-dll-and-java-se/298540 "2022-03-01T22:19:49Z")

</div>

When I start Elasticsearch won't work and will not find java.dll and java SE and you can see I have both installed (I reinstalled a couple of times and I reinstalled Elasticsearch as well) see command prompt below C:\\Us…

---

## [Elastich search can not start in vps](https://discuss.elastic.co/t/elastich-search-can-not-start-in-vps/298489)

<div class="topic-metadata">

**Author:** [@poozhan](https://discuss.elastic.co/u/poozhan)\
**Replies:** 4\
**Last updated:** [March 1, 2022, 8:20pm UTC](https://discuss.elastic.co/t/elastich-search-can-not-start-in-vps/298489 "2022-03-01T20:20:01Z")

</div>

Hello I installed java and Elasticsearch in vps my vps have 4g ram and 50g ssd when i start Elasticsearch this error display elasticsearch.service - Elasticsearch Loaded: loaded (/usr/lib/systemd/system/elasticse…

---

## [String json to SearchResponse](https://discuss.elastic.co/t/string-json-to-searchresponse/298543)

<div class="topic-metadata">

**Author:** [@RabBit\_BR](https://discuss.elastic.co/u/RabBit_BR)\
**Replies:** 1\
**Last updated:** [March 1, 2022, 6:38pm UTC](https://discuss.elastic.co/t/string-json-to-searchresponse/298543 "2022-03-01T18:38:53Z")

</div>

Hello. I used the example below to turn the json response into a SearchResponse and it worked fine. I made a change in my json file by adding the "suggest" but now I can't parse it correctly. Does anyone have any tips…

---

## [Alert if any value in a specific field stops appearing](https://discuss.elastic.co/t/alert-if-any-value-in-a-specific-field-stops-appearing/297545)

<div class="topic-metadata">

**Author:** [@duttad](https://discuss.elastic.co/u/duttad)\
**Replies:** 2\
**Last updated:** [March 1, 2022, 5:29pm UTC](https://discuss.elastic.co/t/alert-if-any-value-in-a-specific-field-stops-appearing/297545 "2022-03-01T17:29:36Z")

</div>

In my index, if any value has appeared in a specific field every day in the last 3 days, I expect to see this value at least once every day in the future. I want to receive an alert if any such value suddenly stops showi…

---

## [Ingest Pipline - Multiple Pipelines For Elastic Agent Data](https://discuss.elastic.co/t/ingest-pipline-multiple-pipelines-for-elastic-agent-data/298527)

<div class="topic-metadata">

**Author:** [@m-flow](https://discuss.elastic.co/u/m-flow)\
**Replies:** 0\
**Last updated:** [March 1, 2022, 2:36pm UTC](https://discuss.elastic.co/t/ingest-pipline-multiple-pipelines-for-elastic-agent-data/298527 "2022-03-01T14:36:47Z")

</div>

Hello, I am currently researching for a solution to create a multi pipeline structure with ingest pipelines in elastic. The idea is to have some kind of post processing on the existing elastic-agent logs, for instance f…

---

## [Elasticsearch enrichment, join best practice](https://discuss.elastic.co/t/elasticsearch-enrichment-join-best-practice/298535)

<div class="topic-metadata">

**Author:** [@Petr.Simik](https://discuss.elastic.co/u/Petr.Simik)\
**Replies:** 0\
**Last updated:** [March 1, 2022, 3:57pm UTC](https://discuss.elastic.co/t/elasticsearch-enrichment-join-best-practice/298535 "2022-03-01T15:57:10Z")

</div>

Hi, how would you handle the situation I have a large data source of 1000tis events/sec, which I need to enrich with data so that I can do analytics on it. The data source has a small amount of data (i.e. 100bytes) bu…

---

## [Correct usage of write indices for rolling over](https://discuss.elastic.co/t/correct-usage-of-write-indices-for-rolling-over/298050)

<div class="topic-metadata">

**Author:** [@whisperingstone](https://discuss.elastic.co/u/whisperingstone)\
**Replies:** 8\
**Last updated:** [March 1, 2022, 3:28pm UTC](https://discuss.elastic.co/t/correct-usage-of-write-indices-for-rolling-over/298050 "2022-03-01T15:28:56Z")

</div>

Hello. I collect logs from 10 components on dev, stage & prod envs. I don't write to the same index, the indexes are created every day for every component and environment, like this: componentname\_envYY.MM.DD or backen…

---

## [Can we update to 8.0 without enabling securitys](https://discuss.elastic.co/t/can-we-update-to-8-0-without-enabling-securitys/298275)

<div class="topic-metadata">

**Author:** [@Dheeraj\_Gupta](https://discuss.elastic.co/u/Dheeraj_Gupta)\
**Replies:** 1\
**Last updated:** [February 25, 2022, 12:09pm UTC](https://discuss.elastic.co/t/can-we-update-to-8-0-without-enabling-securitys/298275 "2022-02-25T12:09:23Z")

</div>

We have our filebeat-logstash-Elasticsearch-kibana ecosystem on a private subnet within our organization network. Due to the placement of all components on a fenced subnet, we don't need any security features such as rol…

---

## [Iterat list on watcher elasticsearch](https://discuss.elastic.co/t/iterat-list-on-watcher-elasticsearch/298100)

<div class="topic-metadata">

**Author:** [@Cheroufa](https://discuss.elastic.co/u/Cheroufa)\
**Replies:** 2\
**Last updated:** [March 1, 2022, 2:07pm UTC](https://discuss.elastic.co/t/iterat-list-on-watcher-elasticsearch/298100 "2022-03-01T14:07:43Z")

</div>

hi guys i want to iterat list of indices to add them to e-mail alert and to send for every index one -e-mail alert. action : "send\_email": { "foreach" : "ctx.payload.list", "email": { "profile": "standard", "prior…

---

## [2nd Level Nested aggregation incorrect doc\_count](https://discuss.elastic.co/t/2nd-level-nested-aggregation-incorrect-doc-count/298515)

<div class="topic-metadata">

**Author:** [@Adam\_Whittaker](https://discuss.elastic.co/u/Adam_Whittaker)\
**Replies:** 0\
**Last updated:** [March 1, 2022, 1:38pm UTC](https://discuss.elastic.co/t/2nd-level-nested-aggregation-incorrect-doc-count/298515 "2022-03-01T13:38:16Z")

</div>

Hello, Can anyone point me to why the doc\_count on my 2nd nested aggregation is not correct? The count on the first aggregation is accurate but the 2nd isnt. { "size": 0, "\_source": false, "query": { "match\_…

---

## [What is the best way to manage an index for exact search and normal search](https://discuss.elastic.co/t/what-is-the-best-way-to-manage-an-index-for-exact-search-and-normal-search/298513)

<div class="topic-metadata">

**Author:** [@Leo\_Baby\_Jacob](https://discuss.elastic.co/u/Leo_Baby_Jacob)\
**Replies:** 0\
**Last updated:** [March 1, 2022, 1:28pm UTC](https://discuss.elastic.co/t/what-is-the-best-way-to-manage-an-index-for-exact-search-and-normal-search/298513 "2022-03-01T13:28:36Z")

</div>

I have a use case where I need normal match\_all search i.e it shows me related documents with fuzzy results also, however I need a specific search which needs to do a term query. My mappings are mostly text type: "proj…

---

## [Using top\_hits in sql](https://discuss.elastic.co/t/using-top-hits-in-sql/298517)

<div class="topic-metadata">

**Author:** [@Nirf8](https://discuss.elastic.co/u/Nirf8)\
**Replies:** 0\
**Last updated:** [March 1, 2022, 1:42pm UTC](https://discuss.elastic.co/t/using-top-hits-in-sql/298517 "2022-03-01T13:42:54Z")

</div>

Hello, im using Elasticsearch sql to run aggregations on my data. What im trying to do is devide my data into buckets of time (using histogram) and then get the top docs of each bucket (using somthing similar to top\_hi…

---

## [ILM increasing number of replicas - suboptimal behavior?](https://discuss.elastic.co/t/ilm-increasing-number-of-replicas-suboptimal-behavior/297516)

<div class="topic-metadata">

**Author:** [@nisow95612](https://discuss.elastic.co/u/nisow95612)\
**Replies:** 4\
**Last updated:** [March 1, 2022, 1:12pm UTC](https://discuss.elastic.co/t/ilm-increasing-number-of-replicas-suboptimal-behavior/297516 "2022-03-01T13:12:43Z")

</div>

Hello nice elastic people. I am currently toying with ILM (7.x, not yet upgraded to 8.0) and ran into a surprising behavior. I have configured ILM to increase the number of replicas when transitioning from hot to cold. …

---

## [\_delete\_by\_query not removes messages from another index created in same date](https://discuss.elastic.co/t/delete-by-query-not-removes-messages-from-another-index-created-in-same-date/298503)

<div class="topic-metadata">

**Author:** [@mkobzev](https://discuss.elastic.co/u/mkobzev)\
**Replies:** 0\
**Last updated:** [March 1, 2022, 12:10pm UTC](https://discuss.elastic.co/t/delete-by-query-not-removes-messages-from-another-index-created-in-same-date/298503 "2022-03-01T12:10:51Z")

</div>

Hello, I am removing messages from nonprod kubernetes namespaces using next query --query=app-\*/\_delete\_by\_query -XPOST -d'{ "query": {"bool": {"must": \[{"regexp": {"kubernetes.namespace\_name": {"value": ".\*nonprod"}}}…

[Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=482)

[Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=484)
