# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=486 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 487 --- ## [High disk READ](https://discuss.elastic.co/t/high-disk-read/298221)
**Author:** [@bknv](https://discuss.elastic.co/u/bknv)\ **Replies:** 0\ **Last updated:** [February 24, 2022, 9:33pm UTC](https://discuss.elastic.co/t/high-disk-read/298221 "2022-02-24T21:33:26Z")
Hello everybody. I have a problem with high activity (read) on the disk. Disk SSD load on 90%. "iostat" show me, what reading from disk 400-500+ M/s . in "iotop" i see process "java -Xshare:auto -Des.networkaddres… --- ## [Elastic Cloud Console Showing Unhealthy Deployment](https://discuss.elastic.co/t/elastic-cloud-console-showing-unhealthy-deployment/298076)
**Author:** [@daniel.talbot](https://discuss.elastic.co/u/daniel.talbot)\ **Replies:** 9\ **Last updated:** [February 24, 2022, 8:26pm UTC](https://discuss.elastic.co/t/elastic-cloud-console-showing-unhealthy-deployment/298076 "2022-02-24T20:26:16Z")
I currently am seeing in my cloud ELK stack (2 hot, 2 warm, 1 Integration, 1 Kibana, 1 Master instance) showing that one of the warm instances and the master instance are both unhealthy. Both are under 30% JVM memory pr… --- ## [Elasticsearch can't recognise \_ec2\_](https://discuss.elastic.co/t/elasticsearch-cant-recognise-ec2/298128)
**Author:** [@rachit\_upadhyay](https://discuss.elastic.co/u/rachit_upadhyay)\ **Replies:** 4\ **Last updated:** [February 24, 2022, 8:19pm UTC](https://discuss.elastic.co/t/elasticsearch-cant-recognise-ec2/298128 "2022-02-24T20:19:38Z")
Getting the following error "org.Elasticsearch.bootstrap.StartupException: java.lang.IllegalArgumentException: Failed to parse value \[ec2\] for setting \[transport.publish\_port\]". This is where in the Elasticsearch.yml, t… --- ## [Null Values Being Ignored by Elasticsearch](https://discuss.elastic.co/t/null-values-being-ignored-by-elasticsearch/298199)
**Author:** [@xef](https://discuss.elastic.co/u/xef)\ **Replies:** 0\ **Last updated:** [February 24, 2022, 5:24pm UTC](https://discuss.elastic.co/t/null-values-being-ignored-by-elasticsearch/298199 "2022-02-24T17:24:24Z")
We are using the NEST library with Elasticsearch versions 7.14. Lets say we have assigned a field a value of "hello World". The filed is mapped as a Keyword type and Not Indexed. If you update that document using the … --- ## [Update values based on previous documents](https://discuss.elastic.co/t/update-values-based-on-previous-documents/296406)
**Author:** [@SKraine](https://discuss.elastic.co/u/SKraine)\ **Replies:** 2\ **Last updated:** [February 24, 2022, 4:34pm UTC](https://discuss.elastic.co/t/update-values-based-on-previous-documents/296406 "2022-02-24T16:34:48Z")
Hey Everyone! So I am very new to the elastic stack and am currently working on my first application using it. I have data that comes from different files via filebeat. They then go through logstash to parse out the fie… --- ## [How to perform sum aggregation and term aggregation in single query?](https://discuss.elastic.co/t/how-to-perform-sum-aggregation-and-term-aggregation-in-single-query/298151)
**Author:** [@Harish\_fragger](https://discuss.elastic.co/u/Harish_fragger)\ **Replies:** 1\ **Last updated:** [February 24, 2022, 3:52pm UTC](https://discuss.elastic.co/t/how-to-perform-sum-aggregation-and-term-aggregation-in-single-query/298151 "2022-02-24T15:52:44Z")
I want to know if there is a method to write a query that can get the sum of a field value and such type of fields top 10 occurrences. For example, if I have 20 IP address in 100 documents and each document also tells me… --- ## [ICU sorting of terms aggregation with multi-valued fields](https://discuss.elastic.co/t/icu-sorting-of-terms-aggregation-with-multi-valued-fields/297886)
**Author:** [@mhugo](https://discuss.elastic.co/u/mhugo)\ **Replies:** 6\ **Last updated:** [February 24, 2022, 3:35pm UTC](https://discuss.elastic.co/t/icu-sorting-of-terms-aggregation-with-multi-valued-fields/297886 "2022-02-24T15:35:32Z")
Hi. I struggle to sort buckets of a terms aggregation based on ICU collation to respect the ordering of accented words. And especially when the text field to sort is indexed with arrays. I started with a simple term ag… --- ## [Multisearch requests in new Java API do not support "sort" or "\_source" properties](https://discuss.elastic.co/t/multisearch-requests-in-new-java-api-do-not-support-sort-or-source-properties/297489)
**Author:** [@babayotakun](https://discuss.elastic.co/u/babayotakun)\ **Replies:** 4\ **Last updated:** [February 24, 2022, 3:28pm UTC](https://discuss.elastic.co/t/multisearch-requests-in-new-java-api-do-not-support-sort-or-source-properties/297489 "2022-02-24T15:28:13Z")
With brand new Elasticsearch Java API I cannot write multisearch requests like: curl -H 'Content-type: application/x-ndjson' -XGET 'http://localhost:9200/myindex/\_msearch' -d '{} { "sort": \[ { "text": { … --- ## [Master node Rejecting the data node request](https://discuss.elastic.co/t/master-node-rejecting-the-data-node-request/298168)
**Author:** [@Arunkumar\_Chandran](https://discuss.elastic.co/u/Arunkumar_Chandran)\ **Replies:** 1\ **Last updated:** [February 24, 2022, 1:33pm UTC](https://discuss.elastic.co/t/master-node-rejecting-the-data-node-request/298168 "2022-02-24T13:33:39Z")
We are using Elasticsearch version 7.0 can someone pleasse help us to resolve this issue. Error: "error":{"root\_cause":\[{"type":"master\_not\_discovered\_exception","reason":null}\],"type":"master\_not\_discovered\_exception"… --- ## [Search performance issue on Elasticsearch cluster](https://discuss.elastic.co/t/search-performance-issue-on-elasticsearch-cluster/298156)
**Author:** [@alpernka](https://discuss.elastic.co/u/alpernka)\ **Replies:** 1\ **Last updated:** [February 24, 2022, 11:57am UTC](https://discuss.elastic.co/t/search-performance-issue-on-elasticsearch-cluster/298156 "2022-02-24T11:57:03Z")
In an 14 node, RAID 5 based Elasticsearch cluster, the search performance does not improve no matter how simple the full-text query is. There are two indices: one is 30 shard, 1 replica, 1.1tb and 110M document size. Th… --- ## [Unassigned Shards after Master node restart](https://discuss.elastic.co/t/unassigned-shards-after-master-node-restart/297929)
**Author:** [@krishnav1](https://discuss.elastic.co/u/krishnav1)\ **Replies:** 3\ **Last updated:** [February 24, 2022, 11:37am UTC](https://discuss.elastic.co/t/unassigned-shards-after-master-node-restart/297929 "2022-02-24T11:37:35Z")
Hello, I am new to elastic cluster, sorry for the long post and I am looking for help to revive some unassigned shards which are a result of me abruptly shutting the master node. This has an impact on Kibana as it has pr… --- ## [Index disk size issue](https://discuss.elastic.co/t/index-disk-size-issue/297805)
**Author:** [@Nisarg\_Pandya](https://discuss.elastic.co/u/Nisarg_Pandya)\ **Replies:** 3\ **Last updated:** [February 24, 2022, 11:10am UTC](https://discuss.elastic.co/t/index-disk-size-issue/297805 "2022-02-24T11:10:55Z")
Hi, We are using the Elasticsearch version 7.9.3 We have two Elasticsearch cluster with the same configuration. Which is storing some data. We are periodically updating the data in both clusters. e.g. adding newdata, r… --- ## [Could not write file \[/usr/share/elasticsearch/config/users\] bind mounted using docker-compose](https://discuss.elastic.co/t/could-not-write-file-usr-share-elasticsearch-config-users-bind-mounted-using-docker-compose/298046)
**Author:** [@ndtreviv](https://discuss.elastic.co/u/ndtreviv)\ **Replies:** 2\ **Last updated:** [February 24, 2022, 10:35am UTC](https://discuss.elastic.co/t/could-not-write-file-usr-share-elasticsearch-config-users-bind-mounted-using-docker-compose/298046 "2022-02-24T10:35:51Z")
Continuing the discussion from "Device or resource busy" when adding to keystore in Docker Compose: I received a similar exception trying to execute a bin/elasticsearch-users useradd command: Exception in thread "main"… --- ## [Install elasticsearch stack TLS/SSL through Docker Swarm](https://discuss.elastic.co/t/install-elasticsearch-stack-tls-ssl-through-docker-swarm/298146)
**Author:** [@INS](https://discuss.elastic.co/u/INS)\ **Replies:** 0\ **Last updated:** [February 24, 2022, 10:11am UTC](https://discuss.elastic.co/t/install-elasticsearch-stack-tls-ssl-through-docker-swarm/298146 "2022-02-24T10:11:54Z")
Would anyone like to join a session on teams to install the Elasticsearch and kibana stacks today? I would love if someone could help me with my first attempt. --- ## [Using the Java Client API to perform a query using JSON?](https://discuss.elastic.co/t/using-the-java-client-api-to-perform-a-query-using-json/297872)
**Author:** [@vmassol](https://discuss.elastic.co/u/vmassol)\ **Replies:** 9\ **Last updated:** [February 24, 2022, 10:11am UTC](https://discuss.elastic.co/t/using-the-java-client-api-to-perform-a-query-using-json/297872 "2022-02-24T10:11:36Z")
Hi guys, I'm slowly learning the new Java Client API and I got good results. I'm now implementing some code where the use of the API is passing the JSON for the search request. So far I cannot figure out how to pass th… --- ## [Where is the index saved on disk?](https://discuss.elastic.co/t/where-is-the-index-saved-on-disk/297968)
**Author:** [@jordane95](https://discuss.elastic.co/u/jordane95)\ **Replies:** 5\ **Last updated:** [February 24, 2022, 9:26am UTC](https://discuss.elastic.co/t/where-is-the-index-saved-on-disk/297968 "2022-02-24T09:26:08Z")
Hello, I recently used the python toolkit elasticsearch to build a IR system on my server. May I know the path where the index is saved on my disk? Thank you! --- ## [Trying to search for '$'](https://discuss.elastic.co/t/trying-to-search-for/298064)
**Author:** [@joneswac](https://discuss.elastic.co/u/joneswac)\ **Replies:** 1\ **Last updated:** [February 24, 2022, 9:25am UTC](https://discuss.elastic.co/t/trying-to-search-for/298064 "2022-02-24T09:25:12Z")
I'm attempting to search for a '$' in a string field. I've tried all of the types of queries listed in the documentation, as well as the analyzers too. I can get a regex match for things like this: { "query": { "q… --- ## [Structure for query with multiple sub queries with the same structure but different parameters](https://discuss.elastic.co/t/structure-for-query-with-multiple-sub-queries-with-the-same-structure-but-different-parameters/297939)
**Author:** [@GavinBeattie](https://discuss.elastic.co/u/GavinBeattie)\ **Replies:** 3\ **Last updated:** [February 24, 2022, 8:50am UTC](https://discuss.elastic.co/t/structure-for-query-with-multiple-sub-queries-with-the-same-structure-but-different-parameters/297939 "2022-02-24T08:50:13Z")
I am trying to analyse speed exceedances along a route, and what I would like is a query that returns all results together (all speed exceedances), which is the result of individual section by section queries (because ea… --- ## [Index and search node(s) (multinode cluster)](https://discuss.elastic.co/t/index-and-search-node-s-multinode-cluster/298032)
**Author:** [@dev\_test](https://discuss.elastic.co/u/dev_test)\ **Replies:** 4\ **Last updated:** [February 24, 2022, 8:22am UTC](https://discuss.elastic.co/t/index-and-search-node-s-multinode-cluster/298032 "2022-02-24T08:22:32Z")
Hi, I'm creating a cluster for Elasticsearch having 3 nodes (one acting as master) I was to ask that while indexing or searching (considering we have a single index) will i be providing the IP-Address of same node for … --- ## [Connection Error (NodejsClient 8.0)](https://discuss.elastic.co/t/connection-error-nodejsclient-8-0/298028)
**Author:** [@dev\_test](https://discuss.elastic.co/u/dev_test)\ **Replies:** 4\ **Last updated:** [February 24, 2022, 7:35am UTC](https://discuss.elastic.co/t/connection-error-nodejsclient-8-0/298028 "2022-02-24T07:35:36Z")
Hi, I am trying to connect to my Elasticsearch 8.0 cluster through a Javascript client 8.0 and I am having this error ConnectionError: other side closed - Local: 172.31.0.1:60684, Remote: 172.31.0.4:9200 at Sniffin… --- ## [I want to rebuild the old runtime environment](https://discuss.elastic.co/t/i-want-to-rebuild-the-old-runtime-environment/297829)
**Author:** [@TANIGUCHIK](https://discuss.elastic.co/u/TANIGUCHIK)\ **Replies:** 5\ **Last updated:** [February 24, 2022, 1:49am UTC](https://discuss.elastic.co/t/i-want-to-rebuild-the-old-runtime-environment/297829 "2022-02-24T01:49:20Z")
I want to install an old plugin for 1.5.x to reproduce an old validation environment, but I could not install the plugin from the command line. Are there any pre-built plugin URLs left? Elasticsearch-cloud-aws 2.5.x E… --- ## [Elasticsearch 8.0 RPM Install error when adding new node](https://discuss.elastic.co/t/elasticsearch-8-0-rpm-install-error-when-adding-new-node/297967)
**Author:** [@soarendev](https://discuss.elastic.co/u/soarendev)\ **Replies:** 4\ **Last updated:** [February 24, 2022, 1:46am UTC](https://discuss.elastic.co/t/elasticsearch-8-0-rpm-install-error-when-adding-new-node/297967 "2022-02-24T01:46:02Z")
I'm installing Elasticsearch 8.0 on a new 3-node cluster on Amazon Linux 2. I have Elasticsearch running on the first node. I created a new enrollment key on this node. When I try to enroll the 2nd node I get the follow… --- ## [Design Question - Better to have a summary text field or index each field as keyword and text](https://discuss.elastic.co/t/design-question-better-to-have-a-summary-text-field-or-index-each-field-as-keyword-and-text/297815)
**Author:** [@johnrodey](https://discuss.elastic.co/u/johnrodey)\ **Replies:** 1\ **Last updated:** [February 24, 2022, 1:03am UTC](https://discuss.elastic.co/t/design-question-better-to-have-a-summary-text-field-or-index-each-field-as-keyword-and-text/297815 "2022-02-24T01:03:39Z")
So I have a general design question. I have long been indexing documents where all string fields generally are stored as keywords. However now we are wanting to add the capability to allow users to enter a string and t… --- ## [Data enrichment](https://discuss.elastic.co/t/data-enrichment/298099)
**Author:** [@cyberzlo](https://discuss.elastic.co/u/cyberzlo)\ **Replies:** 2\ **Last updated:** [February 24, 2022, 12:35am UTC](https://discuss.elastic.co/t/data-enrichment/298099 "2022-02-24T00:35:51Z")
How is best way for data enrichment? I have events with IDs of employees in ES, and want change them on their surname. How do it best way? Should I do it in logstash? Most helpful would be to change static lookup but I … --- ## [Should Data Nodes still be the same size?](https://discuss.elastic.co/t/should-data-nodes-still-be-the-same-size/298059)
**Author:** [@bunste](https://discuss.elastic.co/u/bunste)\ **Replies:** 2\ **Last updated:** [February 23, 2022, 11:20pm UTC](https://discuss.elastic.co/t/should-data-nodes-still-be-the-same-size/298059 "2022-02-23T23:20:53Z")
Hello all, In our company we run a small Elasticsearch cluster with meanwhile 6 data nodes. These have been added over time and are therefore equipped quite differently - especially in terms of disk capacity. Now we ar… --- ## [Pivot transform copying values](https://discuss.elastic.co/t/pivot-transform-copying-values/297919)
**Author:** [@iamtheschmitzer](https://discuss.elastic.co/u/iamtheschmitzer)\ **Replies:** 10\ **Last updated:** [February 23, 2022, 11:05pm UTC](https://discuss.elastic.co/t/pivot-transform-copying-values/297919 "2022-02-23T23:05:21Z")
I'm attempting my first pivot transform with a goal of calculating duration between timestamps. In the group\_by clause, it results in a two documents, each with a timestamp. I have been able to calculate the duration u… --- ## [Python Elasticsearch](https://discuss.elastic.co/t/python-elasticsearch/298053)
**Author:** [@Achraf\_MENSI](https://discuss.elastic.co/u/Achraf_MENSI)\ **Replies:** 4\ **Last updated:** [February 23, 2022, 10:02pm UTC](https://discuss.elastic.co/t/python-elasticsearch/298053 "2022-02-23T22:02:53Z")
Hello it's possible to update ILM policy directly with python? --- ## [Explanation of terms in a search](https://discuss.elastic.co/t/explanation-of-terms-in-a-search/297523)
**Author:** [@MrFantastic2022](https://discuss.elastic.co/u/MrFantastic2022)\ **Replies:** 7\ **Last updated:** [February 23, 2022, 8:36pm UTC](https://discuss.elastic.co/t/explanation-of-terms-in-a-search/297523 "2022-02-23T20:36:19Z")
Hello. I am trying to understand this passage, which is in the 6.8 REST API docs: By default, all terms are optional, as long as one term matches. A search for foo bar baz will find any document that contains one or mo… --- ## [Using eql to query for custom log](https://discuss.elastic.co/t/using-eql-to-query-for-custom-log/297834)
**Author:** [@lusynda](https://discuss.elastic.co/u/lusynda)\ **Replies:** 1\ **Last updated:** [February 23, 2022, 5:20pm UTC](https://discuss.elastic.co/t/using-eql-to-query-for-custom-log/297834 "2022-02-23T17:20:40Z")
Hi all, I have question on the ability to query data for eql, Can eql be used to query for any log source other than from elastic-agent or winlogbeat. For example: i use filebeat to collect log from iis server then pu… --- ## [Multiple Must queries not working inside a should query as expected](https://discuss.elastic.co/t/multiple-must-queries-not-working-inside-a-should-query-as-expected/298024)
**Author:** [@Venkat\_Pavan](https://discuss.elastic.co/u/Venkat_Pavan)\ **Replies:** 1\ **Last updated:** [February 23, 2022, 4:51pm UTC](https://discuss.elastic.co/t/multiple-must-queries-not-working-inside-a-should-query-as-expected/298024 "2022-02-23T16:51:41Z")
I am trying to write a query of the form A or B or C or D where condition A is of the form A11 and A12, similarly B = B11 and B12 and so on. I am using elastic version 6.8 and executing the queries in Kibana. I have add… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=485) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=487)