# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=494 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 495 --- ## [Remote ES node CPU only in advanced view](https://discuss.elastic.co/t/remote-es-node-cpu-only-in-advanced-view/296913)
**Author:** [@rschirin](https://discuss.elastic.co/u/rschirin)\ **Replies:** 1\ **Last updated:** [February 11, 2022, 6:03pm UTC](https://discuss.elastic.co/t/remote-es-node-cpu-only-in-advanced-view/296913 "2022-02-11T18:03:32Z")
Hey there, I am using legacy mode to monitor remote cluster. I saw a strange behavior regarding the nodes CPU values. I can see it only if I switch to Advanced view otherwise (using standard tab) the timeseries graph wi… --- ## [Curl -x put content-type: application/json throwing error](https://discuss.elastic.co/t/curl-x-put-content-type-application-json-throwing-error/296868)
**Author:** [@byoungman](https://discuss.elastic.co/u/byoungman)\ **Replies:** 7\ **Last updated:** [February 11, 2022, 4:39pm UTC](https://discuss.elastic.co/t/curl-x-put-content-type-application-json-throwing-error/296868 "2022-02-11T16:39:02Z")
I have an Elasticsearch instance that has reached it's default max shards of 1000 and now I'm trying to increase that number using curl but am running into an issue with the -h content-type declaration. Here is my curl … --- ## [Error saving watch \[1:234\] \[script\] unknown field \[query\]](https://discuss.elastic.co/t/error-saving-watch-1-234-script-unknown-field-query/296989)
**Author:** [@Abhi\_Abhishek](https://discuss.elastic.co/u/Abhi_Abhishek)\ **Replies:** 2\ **Last updated:** [February 11, 2022, 4:26pm UTC](https://discuss.elastic.co/t/error-saving-watch-1-234-script-unknown-field-query/296989 "2022-02-11T16:26:32Z")
{ "trigger": { "schedule": { "interval": "10s" } }, "input": { "chain": { "inputs": \[ { "first": { "http": { "request": { "scheme": "https", "host": "", "port": , "method": "get", "path": "llm\_full\_addre… --- ## [Inconsistency between deserialization of number values in \_msearch/\_mget and \_search/\_get - elasticsearch-java client (7.16.2)](https://discuss.elastic.co/t/inconsistency-between-deserialization-of-number-values-in-msearch-mget-and-search-get-elasticsearch-java-client-7-16-2/297001)
**Author:** [@Xupi](https://discuss.elastic.co/u/Xupi)\ **Replies:** 0\ **Last updated:** [February 11, 2022, 4:23pm UTC](https://discuss.elastic.co/t/inconsistency-between-deserialization-of-number-values-in-msearch-mget-and-search-get-elasticsearch-java-client-7-16-2/297001 "2022-02-11T16:23:04Z")
Hi, I have a problem with scientific notation numbers returned from elastic through \_search/\_get and \_msearch/\_mget. Value in elastic \_source is = 1.4778125E7. Queried through dev console is always returned the same = … --- ## [Issue in Offset Rounding in case Offset leads to change in the DST state](https://discuss.elastic.co/t/issue-in-offset-rounding-in-case-offset-leads-to-change-in-the-dst-state/296986)
**Author:** [@PRIYANSHU\_KUSHWAHA](https://discuss.elastic.co/u/PRIYANSHU_KUSHWAHA)\ **Replies:** 0\ **Last updated:** [February 11, 2022, 2:33pm UTC](https://discuss.elastic.co/t/issue-in-offset-rounding-in-case-offset-leads-to-change-in-the-dst-state/296986 "2022-02-11T14:33:35Z")
I am using ES version 7.11. { "size": 0, "query": { "constant\_score": { "filter": { "bool": { "must": \[ { "terms": { "deleted": \[ … --- ## [Permission denied when i'm trying to use elasticsearch command](https://discuss.elastic.co/t/permission-denied-when-im-trying-to-use-elasticsearch-command/296629)
**Author:** [@Arkoos62](https://discuss.elastic.co/u/Arkoos62)\ **Replies:** 5\ **Last updated:** [February 11, 2022, 2:52pm UTC](https://discuss.elastic.co/t/permission-denied-when-im-trying-to-use-elasticsearch-command/296629 "2022-02-11T14:52:07Z")
Hello there, I am trying to configure basic security on my Elasticsearch production but i'm getting error when i try to launch a command from the path /usr/share/Elasticsearch/bin i'm getting this error ./elasticsearch… --- ## [Ingest pipeline set processor error; \[value\] required property is missing](https://discuss.elastic.co/t/ingest-pipeline-set-processor-error-value-required-property-is-missing/296798)
**Author:** [@ben5556](https://discuss.elastic.co/u/ben5556)\ **Replies:** 4\ **Last updated:** [February 11, 2022, 2:48pm UTC](https://discuss.elastic.co/t/ingest-pipeline-set-processor-error-value-required-property-is-missing/296798 "2022-02-11T14:48:13Z")
I am trying to add a field as below within one of our ingest pipelines "set": { "field": "upstream\_response\_time\_int", "copy\_from": "upstream\_response\_time" } But it gives the below error even though t… --- ## [How to find docs that contain the exact specified terms](https://discuss.elastic.co/t/how-to-find-docs-that-contain-the-exact-specified-terms/295758)
**Author:** [@Cholley\_Alexandre](https://discuss.elastic.co/u/Cholley_Alexandre)\ **Replies:** 14\ **Last updated:** [February 11, 2022, 2:29pm UTC](https://discuss.elastic.co/t/how-to-find-docs-that-contain-the-exact-specified-terms/295758 "2022-02-11T14:29:10Z")
Hi, I'm trying to get docs that contain the exact specified terms. Terms query doesn't match because it also returns docs with additional terms. Create index : PUT my-index { "mappings": { "properties": { … --- ## [Master not discovered exception](https://discuss.elastic.co/t/master-not-discovered-exception/296977)
**Author:** [@praveen\_raju](https://discuss.elastic.co/u/praveen_raju)\ **Replies:** 0\ **Last updated:** [February 11, 2022, 1:26pm UTC](https://discuss.elastic.co/t/master-not-discovered-exception/296977 "2022-02-11T13:26:15Z")
Hello, I build a 11 node Elastic cluster (3M, 5D, 3 Ingest nodes), using ansible playbook. Which is working perfectly fine with out SSL & TLS. But when i enable SSL & TLS, i'am getting the below error message in master… --- ## [Custom component template](https://discuss.elastic.co/t/custom-component-template/296974)
**Author:** [@dabo](https://discuss.elastic.co/u/dabo)\ **Replies:** 0\ **Last updated:** [February 11, 2022, 1:05pm UTC](https://discuss.elastic.co/t/custom-component-template/296974 "2022-02-11T13:05:21Z")
Hello, Can see now after upgrading to 7.16.2 that we have a new component template as part of logs-system.application index template. What this component template logs-system.application@custom should be used for? Sho… --- ## [Security information not being output on startup (8.0.0-rc2)](https://discuss.elastic.co/t/security-information-not-being-output-on-startup-8-0-0-rc2/296393)
**Author:** [@Andy0708](https://discuss.elastic.co/u/Andy0708)\ **Replies:** 7\ **Last updated:** [February 11, 2022, 12:53pm UTC](https://discuss.elastic.co/t/security-information-not-being-output-on-startup-8-0-0-rc2/296393 "2022-02-11T12:53:22Z")
Tried setting up Elasticsearch 8.0.0-rc2 on macOS to test the new security configuration. Despite what the documentation says, no password, enrollment token, etc. is being output on first startup. Instead, the following … --- ## [Pipelines for each device source](https://discuss.elastic.co/t/pipelines-for-each-device-source/296962)
**Author:** [@jokem48](https://discuss.elastic.co/u/jokem48)\ **Replies:** 1\ **Last updated:** [February 11, 2022, 10:47am UTC](https://discuss.elastic.co/t/pipelines-for-each-device-source/296962 "2022-02-11T10:47:20Z")
Hi, new to the ELK setup. We are exploring to use ELK as our SIEM. Right now we have a log forwarder collecting syslog from various network sources, like cisco, fortinet and even juniper /f5? In order to break down thos… --- ## [Date format err in query?](https://discuss.elastic.co/t/date-format-err-in-query/296964)
**Author:** [@kin122](https://discuss.elastic.co/u/kin122)\ **Replies:** 0\ **Last updated:** [February 11, 2022, 10:38am UTC](https://discuss.elastic.co/t/date-format-err-in-query/296964 "2022-02-11T10:38:21Z")
hi,i got a error in the following query. but its ok in this format Officially, the two formats are the same. I'm confused, please tell me the reason --- ## [Is it possible for buckets\_path to reference a scripted\_metric aggregation?](https://discuss.elastic.co/t/is-it-possible-for-buckets-path-to-reference-a-scripted-metric-aggregation/296953)
**Author:** [@saurab](https://discuss.elastic.co/u/saurab)\ **Replies:** 0\ **Last updated:** [February 11, 2022, 9:03am UTC](https://discuss.elastic.co/t/is-it-possible-for-buckets-path-to-reference-a-scripted-metric-aggregation/296953 "2022-02-11T09:03:30Z")
I am working on the kibana\_sample\_data\_logs index. I ran the following aggregation: GET kibana\_sample\_data\_logs/\_search?size=0 { "query": { "match\_all": {} }, "aggs": { "doc\_buckets\_for\_terms\_aggregation… --- ## [Netflow v9 upload bytes and download bytes](https://discuss.elastic.co/t/netflow-v9-upload-bytes-and-download-bytes/296951)
**Author:** [@111401](https://discuss.elastic.co/u/111401)\ **Replies:** 0\ **Last updated:** [February 11, 2022, 8:59am UTC](https://discuss.elastic.co/t/netflow-v9-upload-bytes-and-download-bytes/296951 "2022-02-11T08:59:27Z")
Hi all, I have configured netflow v9 and try to use elk to monitor the upload and download bytes. I tried to upload the file (4MB) from local (192.168.x.x ) to the ftp server (211.x.x.x), log is like this Convers… --- ## [PUT "ignore\_malformed" on index\_template](https://discuss.elastic.co/t/put-ignore-malformed-on-index-template/296861)
**Author:** [@yago82](https://discuss.elastic.co/u/yago82)\ **Replies:** 3\ **Last updated:** [February 11, 2022, 8:17am UTC](https://discuss.elastic.co/t/put-ignore-malformed-on-index-template/296861 "2022-02-11T08:17:42Z")
Hi, Is it possible to insert the parameter "ignore\_malformed" on a template by a PUT? My actual config is: GET \_template/http-access { "http-access" : { "order" : 0, "version" : 60001, "index\_patterns" … --- ## [Bitbucket and Elastic security question!](https://discuss.elastic.co/t/bitbucket-and-elastic-security-question/296855)
**Author:** [@Simha\_Gontmaher](https://discuss.elastic.co/u/Simha_Gontmaher)\ **Replies:** 3\ **Last updated:** [February 11, 2022, 8:17am UTC](https://discuss.elastic.co/t/bitbucket-and-elastic-security-question/296855 "2022-02-11T08:17:22Z")
Hi everyone, Your advice would be very much appreciated! Is Elasticsearch version 6.8.22 or Elastic 7.16.2 considered vulnerable? Do we need to perform any manual mitigation? Also, having the Elasticsearch version 6.5… --- ## [NiFi + ElasticSearch + filebeat](https://discuss.elastic.co/t/nifi-elasticsearch-filebeat/296946)
**Author:** [@iconm](https://discuss.elastic.co/u/iconm)\ **Replies:** 0\ **Last updated:** [February 11, 2022, 8:13am UTC](https://discuss.elastic.co/t/nifi-elasticsearch-filebeat/296946 "2022-02-11T08:13:21Z")
I urgently need to create a pipeline in NiFi that accepts syslog on local UDP port 514 and sends it to Elasticsearch. And I have to use filebeat and build a simple Nifi pipeline that collects data from local /var /log/m… --- ## [ES 7.13.2 - Not starting up - elasticsearch.bat error Invalid initial heap size](https://discuss.elastic.co/t/es-7-13-2-not-starting-up-elasticsearch-bat-error-invalid-initial-heap-size/296945)
**Author:** [@Jothi\_Kiruthika](https://discuss.elastic.co/u/Jothi_Kiruthika)\ **Replies:** 1\ **Last updated:** [February 11, 2022, 8:08am UTC](https://discuss.elastic.co/t/es-7-13-2-not-starting-up-elasticsearch-bat-error-invalid-initial-heap-size/296945 "2022-02-11T08:08:16Z")
HI I am trying to start up ES by running Elasticsearch.bat. I have created an options file under JVM.options.d folder setting the heap size to 2 gb as below - -Xms2g -Xmx2g But When running the batch file, i get the … --- ## [Custom rally docker image](https://discuss.elastic.co/t/custom-rally-docker-image/296874)
**Author:** [@amitsa](https://discuss.elastic.co/u/amitsa)\ **Replies:** 2\ **Last updated:** [February 11, 2022, 8:07am UTC](https://discuss.elastic.co/t/custom-rally-docker-image/296874 "2022-02-11T08:07:57Z")
Hi, I am extending rally docker image. getting permission denied issue. for COPY or RUN eg RUN mkfifo /logs ---\> permission denied. I am new to esrally kindly help --- ## [Pipeline aggregation throwing an error](https://discuss.elastic.co/t/pipeline-aggregation-throwing-an-error/296839)
**Author:** [@saurab](https://discuss.elastic.co/u/saurab)\ **Replies:** 2\ **Last updated:** [February 11, 2022, 6:57am UTC](https://discuss.elastic.co/t/pipeline-aggregation-throwing-an-error/296839 "2022-02-11T06:57:50Z")
I am working with the kibana\_sample\_data\_ecommerce index. I will display two queries here: GET kibana\_sample\_data\_ecommerce/\_search?size=0 { "aggs": { "customer\_centric": { "terms": { "field": "custo… --- ## [Elasticsearch Log deletion not happening as per defined days in log4j.pproperties file](https://discuss.elastic.co/t/elasticsearch-log-deletion-not-happening-as-per-defined-days-in-log4j-pproperties-file/296934)
**Author:** [@pratikshatiwari](https://discuss.elastic.co/u/pratikshatiwari)\ **Replies:** 0\ **Last updated:** [February 11, 2022, 5:21am UTC](https://discuss.elastic.co/t/elasticsearch-log-deletion-not-happening-as-per-defined-days-in-log4j-pproperties-file/296934 "2022-02-11T05:21:29Z")
Dear Team, We are facing an issue where Elasticsearch logging with log4j2.properties not performing the log rotation on the basis of lfLastmodified age condition, we want to rotate the logs every after 7days but it is n… --- ## [Elastic Cloud - Out Of Memory restarts](https://discuss.elastic.co/t/elastic-cloud-out-of-memory-restarts/296912)
**Author:** [@gunlomboy](https://discuss.elastic.co/u/gunlomboy)\ **Replies:** 10\ **Last updated:** [February 11, 2022, 1:57am UTC](https://discuss.elastic.co/t/elastic-cloud-out-of-memory-restarts/296912 "2022-02-11T01:57:16Z")
Hi, We are running a small deployment in the Elastic Cloud ingesting very low events per second, however every couple of days we receive an email advising that a node has been restarted as it is out of memory. Checking… --- ## [Elastic indexed data but response has error](https://discuss.elastic.co/t/elastic-indexed-data-but-response-has-error/296859)
**Author:** [@tleduong](https://discuss.elastic.co/u/tleduong)\ **Replies:** 1\ **Last updated:** [February 10, 2022, 11:46pm UTC](https://discuss.elastic.co/t/elastic-indexed-data-but-response-has-error/296859 "2022-02-10T23:46:39Z")
Data was indexed successfully but we got the response below from Elastic. Is there a reason why Elastic returned error but data is still indexed? Error: %{"errors" =\> true, "items" =\> \[%{"index" =\> %{"\_id" =\> "tracts-59… --- ## [3 Single Node Elastic search to 3 Node cluster](https://discuss.elastic.co/t/3-single-node-elastic-search-to-3-node-cluster/296866)
**Author:** [@shivam060897](https://discuss.elastic.co/u/shivam060897)\ **Replies:** 1\ **Last updated:** [February 10, 2022, 11:32pm UTC](https://discuss.elastic.co/t/3-single-node-elastic-search-to-3-node-cluster/296866 "2022-02-10T23:32:04Z")
Hi, I have 3 single-node Elasticsearch nodes on 3 hosts all working file. As of now all my data is on first host (say host-1) and ES on host-2 and host-3 are not being used. Now my requirement is to have all 3 running … --- ## [Nodes out of memory with completion suggester / ngrams](https://discuss.elastic.co/t/nodes-out-of-memory-with-completion-suggester-ngrams/296907)
**Author:** [@ravib](https://discuss.elastic.co/u/ravib)\ **Replies:** 1\ **Last updated:** [February 10, 2022, 10:01pm UTC](https://discuss.elastic.co/t/nodes-out-of-memory-with-completion-suggester-ngrams/296907 "2022-02-10T22:01:32Z")
Hello, I am still using Elasticsearch 5.6 version I have an index with a completion suggest field and also a text field with edge ngram size 3 to 10 \[i don't query both of them at the same time\]…. so I got few queries … --- ## [FsCrawler does not do anything, does not index pfd's](https://discuss.elastic.co/t/fscrawler-does-not-do-anything-does-not-index-pfds/296747)
**Author:** [@jank12](https://discuss.elastic.co/u/jank12)\ **Replies:** 3\ **Last updated:** [February 10, 2022, 11:21pm UTC](https://discuss.elastic.co/t/fscrawler-does-not-do-anything-does-not-index-pfds/296747 "2022-02-10T23:21:16Z")
This n00b is thoroughly confused. I have severa quite large pdf files I want to be able to full text search. They comrpise of raw text and images contaning text. So I want to index the text in the pdf, OCR the images a… --- ## [Indexing 100GB of Dataa](https://discuss.elastic.co/t/indexing-100gb-of-dataa/296891)
**Author:** [@deepakray](https://discuss.elastic.co/u/deepakray)\ **Replies:** 1\ **Last updated:** [February 10, 2022, 9:43pm UTC](https://discuss.elastic.co/t/indexing-100gb-of-dataa/296891 "2022-02-10T21:43:05Z")
Hello, We are trying to index having 83,286,866 documents. It takes around 3 days to index. This is the first time we are creating the indexes. Configuration: Elasticsearch 7.10 Windows Server 2016 Heap Size 16Gb … --- ## [Java regex matcher in painless seems not to be working](https://discuss.elastic.co/t/java-regex-matcher-in-painless-seems-not-to-be-working/296904)
**Author:** [@PascalThalmann](https://discuss.elastic.co/u/PascalThalmann)\ **Replies:** 0\ **Last updated:** [February 10, 2022, 9:42pm UTC](https://discuss.elastic.co/t/java-regex-matcher-in-painless-seems-not-to-be-working/296904 "2022-02-10T21:42:51Z")
Hi i try to match a simple pattern from a string, like this: GET testindex/\_search { "query": { "match\_all": {} }, "script\_fields": { "free\_float": { "script": { "source": """ def m… --- ## [How to automatically set the server date/time when adding data?](https://discuss.elastic.co/t/how-to-automatically-set-the-server-date-time-when-adding-data/296708)
**Author:** [@vmassol](https://discuss.elastic.co/u/vmassol)\ **Replies:** 15\ **Last updated:** [February 10, 2022, 6:14pm UTC](https://discuss.elastic.co/t/how-to-automatically-set-the-server-date-time-when-adding-data/296708 "2022-02-10T18:14:13Z")
Hi there, In old ES versions, I was using the \_timestamp field but it's been removed and it's now recommended to set the date on the client side. However, I'm surprised to not find any easy way to continue to set it on … [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=493) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=495)