# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=495 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 496 --- ## [Query using Runtime Field](https://discuss.elastic.co/t/query-using-runtime-field/296864)
**Author:** [@jkulcsar](https://discuss.elastic.co/u/jkulcsar)\ **Replies:** 1\ **Last updated:** [February 10, 2022, 5:24pm UTC](https://discuss.elastic.co/t/query-using-runtime-field/296864 "2022-02-10T17:24:43Z")
Hello all I've added a runtime field to my logstash indexes to concatenate two fields on the fly (in this context: the Model and Serial Number of a product): PUT logstash-\*/\_mapping { "runtime": { "m\_s\_unique\_id"… --- ## [Any issue store integer values in text field](https://discuss.elastic.co/t/any-issue-store-integer-values-in-text-field/296143)
**Author:** [@jsjs2](https://discuss.elastic.co/u/jsjs2)\ **Replies:** 6\ **Last updated:** [February 10, 2022, 5:21pm UTC](https://discuss.elastic.co/t/any-issue-store-integer-values-in-text-field/296143 "2022-02-10T17:21:26Z")
Hi, I have type text field, the value for this field sometimes comes in as integer, it is store in ES as integer. any issue when querying this field later on? will the integer value be indexed as string value by ES? th… --- ## [Using an aggregation to create histogram in Kibana?](https://discuss.elastic.co/t/using-an-aggregation-to-create-histogram-in-kibana/296697)
**Author:** [@saurab](https://discuss.elastic.co/u/saurab)\ **Replies:** 1\ **Last updated:** [February 10, 2022, 3:57pm UTC](https://discuss.elastic.co/t/using-an-aggregation-to-create-histogram-in-kibana/296697 "2022-02-10T15:57:14Z")
I have an aggregation on a packetbeat index as follows: GET packetbeat-7.16.3-2022.02.07-000001/\_search?size=0 { "query": { "term": { "destination.port": 9200 } }, "aggs": { "myagg1": { "t… --- ## [Store Path Data to Multiple Location FIle](https://discuss.elastic.co/t/store-path-data-to-multiple-location-file/296538)
**Author:** [@Xenial](https://discuss.elastic.co/u/Xenial)\ **Replies:** 7\ **Last updated:** [February 10, 2022, 1:00pm UTC](https://discuss.elastic.co/t/store-path-data-to-multiple-location-file/296538 "2022-02-10T13:00:58Z")
Hello, i've Elasticsearch server, but the storage is full. My server run on vmware, i want to add new disk, and i want to mount on /backup location. When i add to /etc/Elasticsearch/Elasticsearch.yml and add line Path.… --- ## [Error for scripted\_metric aggregation on auto\_date\_histogram aggregation](https://discuss.elastic.co/t/error-for-scripted-metric-aggregation-on-auto-date-histogram-aggregation/296741)
**Author:** [@saurab](https://discuss.elastic.co/u/saurab)\ **Replies:** 3\ **Last updated:** [February 10, 2022, 11:18am UTC](https://discuss.elastic.co/t/error-for-scripted-metric-aggregation-on-auto-date-histogram-aggregation/296741 "2022-02-10T11:18:03Z")
I am working with the sample log dataset. Here is what it looks like: "hits" : \[ { "\_index" : "kibana\_sample\_data\_logs", "\_type" : "\_doc", "\_id" : "nfvc3X4BKbUZuD5M4wWJ", "\_score" :… --- ## [Splunk to ELK Migration](https://discuss.elastic.co/t/splunk-to-elk-migration/296801)
**Author:** [@Arun\_Murugappan](https://discuss.elastic.co/u/Arun_Murugappan)\ **Replies:** 2\ **Last updated:** [February 10, 2022, 11:09am UTC](https://discuss.elastic.co/t/splunk-to-elk-migration/296801 "2022-02-10T11:09:20Z")
There are 2000 dashboards in Splunk. Out of which, some are used and some are not. How to check that?How to migrate it to ELK by filtering out unused or junk dashboards. --- ## [Delete all docs that have duplicate field values](https://discuss.elastic.co/t/delete-all-docs-that-have-duplicate-field-values/296702)
**Author:** [@alfianaf](https://discuss.elastic.co/u/alfianaf)\ **Replies:** 4\ **Last updated:** [February 10, 2022, 10:48am UTC](https://discuss.elastic.co/t/delete-all-docs-that-have-duplicate-field-values/296702 "2022-02-10T10:48:57Z")
Hello, I ingest some data into my cluster, and turned out some of my data has been ingested twice, so some of the data is doubled. My index has unique field, because some of it is doubled, I'm trying to search for dupli… --- ## [Rejected execution of replica operation](https://discuss.elastic.co/t/rejected-execution-of-replica-operation/296818)
**Author:** [@Ariel\_Benichou](https://discuss.elastic.co/u/Ariel_Benichou)\ **Replies:** 0\ **Last updated:** [February 10, 2022, 9:16am UTC](https://discuss.elastic.co/t/rejected-execution-of-replica-operation/296818 "2022-02-10T09:16:50Z")
Can someone explain what this error means? rejected execution of replica operation \[replica\_bytes=1032693097, replica\_operation\_bytes=370889441, max\_replica\_bytes=1288490188\] Info This log has been retrieved from DATA\_… --- ## [How to set-up Hot, Warm and cold for single node Elasticsearch?](https://discuss.elastic.co/t/how-to-set-up-hot-warm-and-cold-for-single-node-elasticsearch/296797)
**Author:** [@Ramesh\_balasubramani](https://discuss.elastic.co/u/Ramesh_balasubramani)\ **Replies:** 8\ **Last updated:** [February 10, 2022, 9:02am UTC](https://discuss.elastic.co/t/how-to-set-up-hot-warm-and-cold-for-single-node-elasticsearch/296797 "2022-02-10T09:02:21Z")
How to set up Hot, Warm and cold for single node Elasticsearch? --- ## [Monthly query performance on too many shards](https://discuss.elastic.co/t/monthly-query-performance-on-too-many-shards/296429)
**Author:** [@alissan](https://discuss.elastic.co/u/alissan)\ **Replies:** 10\ **Last updated:** [February 10, 2022, 8:48am UTC](https://discuss.elastic.co/t/monthly-query-performance-on-too-many-shards/296429 "2022-02-10T08:48:03Z")
Hello, I have an Elasticsearch cluster on 5 nodes. I use Elasticsearch for log management and 3 indexes are created every hour (1 shard, 0 replica) Every log line have 20-70 fields, like IP, port, hostname, user agent… --- ## [Create an index that includes aggs](https://discuss.elastic.co/t/create-an-index-that-includes-aggs/296813)
**Author:** [@b.kaliuzhnyi](https://discuss.elastic.co/u/b.kaliuzhnyi)\ **Replies:** 2\ **Last updated:** [February 10, 2022, 8:39am UTC](https://discuss.elastic.co/t/create-an-index-that-includes-aggs/296813 "2022-02-10T08:39:00Z")
Can I create an index with data obtained with bucket aggregation from another index? For example: old\_index: fox; dog; dog; fox; fox; new\_index: fox, 3; dog, 2; Is it possible to do this for some indexes within ILM… --- ## [Trying to upgrade elasticsearch docker from 1.5.2 to 2.4.6](https://discuss.elastic.co/t/trying-to-upgrade-elasticsearch-docker-from-1-5-2-to-2-4-6/296569)
**Author:** [@Saranya\_V](https://discuss.elastic.co/u/Saranya_V)\ **Replies:** 5\ **Last updated:** [February 10, 2022, 8:26am UTC](https://discuss.elastic.co/t/trying-to-upgrade-elasticsearch-docker-from-1-5-2-to-2-4-6/296569 "2022-02-10T08:26:16Z")
Can you please share the steps to upgarde the Elasticsearch running in docker. Have tried the steps mentioned in the below link. But all indexes were failing to come up. step1: Disable shard alloation(PUT /\_cluster/stt… --- ## [Why scoring is expensive](https://discuss.elastic.co/t/why-scoring-is-expensive/296808)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 1\ **Last updated:** [February 10, 2022, 8:25am UTC](https://discuss.elastic.co/t/why-scoring-is-expensive/296808 "2022-02-10T08:25:47Z")
referring to this doc for example, a score function is computationally expensive and it is sufficient to compute the score on a filtered set of documents. why scoring is expensive in which terms we are talking about. … --- ## [Joins in elasticsearch](https://discuss.elastic.co/t/joins-in-elasticsearch/296810)
**Author:** [@Ernesto\_Rodolfo\_Cast](https://discuss.elastic.co/u/Ernesto_Rodolfo_Cast)\ **Replies:** 1\ **Last updated:** [February 10, 2022, 8:24am UTC](https://discuss.elastic.co/t/joins-in-elasticsearch/296810 "2022-02-10T08:24:00Z")
Hi, I have several index aliases and I need to make a SQL-like join between them. Elasticsearch does not allow to create aliases of aliases. Is there any way to solve this problem. --- ## [How to check the total number of data over 10,000?](https://discuss.elastic.co/t/how-to-check-the-total-number-of-data-over-10-000/296799)
**Author:** [@sramana235](https://discuss.elastic.co/u/sramana235)\ **Replies:** 2\ **Last updated:** [February 10, 2022, 7:26am UTC](https://discuss.elastic.co/t/how-to-check-the-total-number-of-data-over-10-000/296799 "2022-02-10T07:26:00Z")
Hello friends There are more than 1 million docs in the index. At this time, when information is obtained through match\_all, the total value is displayed as 10,000. How can I check the number of doc? I know that more… --- ## [Unassigned replicas with status CLUSTER\_RECOVERED](https://discuss.elastic.co/t/unassigned-replicas-with-status-cluster-recovered/296746)
**Author:** [@Adityadgr8](https://discuss.elastic.co/u/Adityadgr8)\ **Replies:** 2\ **Last updated:** [February 10, 2022, 7:00am UTC](https://discuss.elastic.co/t/unassigned-replicas-with-status-cluster-recovered/296746 "2022-02-10T07:00:18Z")
Hello All, I have a single node Elasticsearch setup. I have unassigned replicas Here is the kibana query through which I am checking: GET \_cat/shards?v=true&h=index,shard,prirep,state,node,unassigned.reason&s=state a… --- ## [Very slow search performance after upgrade to 7.16.1](https://discuss.elastic.co/t/very-slow-search-performance-after-upgrade-to-7-16-1/296152)
**Author:** [@Dheeraj\_Gupta](https://discuss.elastic.co/u/Dheeraj_Gupta)\ **Replies:** 12\ **Last updated:** [February 10, 2022, 5:04am UTC](https://discuss.elastic.co/t/very-slow-search-performance-after-upgrade-to-7-16-1/296152 "2022-02-10T05:04:23Z")
I have noticed that search performance for my cluster has reduced drastically since upgrading to 7.16.1 (from 7.15). As an example consider an index dns-2022.01.31. There are around 56M docs in this and bulk of those do… --- ## [Rollover\_alias XXX does not point to index XXX](https://discuss.elastic.co/t/rollover-alias-xxx-does-not-point-to-index-xxx/296794)
**Author:** [@wajika](https://discuss.elastic.co/u/wajika)\ **Replies:** 1\ **Last updated:** [February 10, 2022, 2:47am UTC](https://discuss.elastic.co/t/rollover-alias-xxx-does-not-point-to-index-xxx/296794 "2022-02-10T02:47:38Z")
I see the following error on kibana Index Management, I have some doubts, these indexes have already pointed to the corresponding alias (index.lifecycle.rollover\_alias) according to the template, why is it prompted that … --- ## [Elasticsearch Software Bill of Materials (SBOM)](https://discuss.elastic.co/t/elasticsearch-software-bill-of-materials-sbom/296763)
**Author:** [@jtp1023](https://discuss.elastic.co/u/jtp1023)\ **Replies:** 1\ **Last updated:** [February 9, 2022, 10:39pm UTC](https://discuss.elastic.co/t/elasticsearch-software-bill-of-materials-sbom/296763 "2022-02-09T22:39:57Z")
Is there a published SBOM anywhere for Elasticsearch or any other document that shares all the components/libraries used within the application? This would be helpful when investigating security vulnerabilities and deter… --- ## [Watcher for nodes in elasticsearch](https://discuss.elastic.co/t/watcher-for-nodes-in-elasticsearch/296387)
**Author:** [@Abhi\_Abhishek](https://discuss.elastic.co/u/Abhi_Abhishek)\ **Replies:** 8\ **Last updated:** [February 9, 2022, 5:29pm UTC](https://discuss.elastic.co/t/watcher-for-nodes-in-elasticsearch/296387 "2022-02-09T17:29:17Z")
Hello guys This I my first time working with watchers. Can anyone help me with building watcher for all Elasticsearch nodes are running or stopped that is we should get alert when the node is stopped or started. I nee… --- ## [Ingest data with GCP Dataflow](https://discuss.elastic.co/t/ingest-data-with-gcp-dataflow/294046)
**Author:** [@gustafkisi](https://discuss.elastic.co/u/gustafkisi)\ **Replies:** 11\ **Last updated:** [February 9, 2022, 5:10pm UTC](https://discuss.elastic.co/t/ingest-data-with-gcp-dataflow/294046 "2022-02-09T17:10:29Z")
Hello. I'm trying to ingest data to ES with the use of GCP Dataflow and the template PubSub to Elasticsearch. So far I've tried a couple of different deployments which are all on GCP using the trial option over at elast… --- ## [Dynamic Templates updates as part of upgrade](https://discuss.elastic.co/t/dynamic-templates-updates-as-part-of-upgrade/296765)
**Author:** [@venkat\_dinesh](https://discuss.elastic.co/u/venkat_dinesh)\ **Replies:** 0\ **Last updated:** [February 9, 2022, 4:57pm UTC](https://discuss.elastic.co/t/dynamic-templates-updates-as-part-of-upgrade/296765 "2022-02-09T16:57:04Z")
Hi, Context : I am upgrading a set of indices with data from Elasticsearch 7.0 to Elasticsearch 7.10 (I do not have much control over the target version). In some of existing indices, mappings use dynamic\_templates. E… --- ## [Migrate legacy templates to index templates](https://discuss.elastic.co/t/migrate-legacy-templates-to-index-templates/296764)
**Author:** [@Roberto\_D\_Arco](https://discuss.elastic.co/u/Roberto_D_Arco)\ **Replies:** 0\ **Last updated:** [February 9, 2022, 4:57pm UTC](https://discuss.elastic.co/t/migrate-legacy-templates-to-index-templates/296764 "2022-02-09T16:57:02Z")
Hello, I can't find any documentation that helps in migrating the legacy templates to the 'new' index templates. A starting point would be apreciated :slight\_smile: Thanks, Roberto D'Arco --- ## [Filter terms aggregation on array field](https://discuss.elastic.co/t/filter-terms-aggregation-on-array-field/296627)
**Author:** [@silarhi](https://discuss.elastic.co/u/silarhi)\ **Replies:** 4\ **Last updated:** [February 9, 2022, 4:56pm UTC](https://discuss.elastic.co/t/filter-terms-aggregation-on-array-field/296627 "2022-02-09T16:56:06Z")
Hello there, I'm looking for a solution to filter some aggregation terms based on an array field. Here's an example of data: PUT /test-index POST /test-index/\_doc/ { "type": "album", "authors": \[1, 2, 3, 4, 5\] } … --- ## [Unable to Create Index using RestHighLevelClient API, ES 7.12.1](https://discuss.elastic.co/t/unable-to-create-index-using-resthighlevelclient-api-es-7-12-1/296757)
**Author:** [@ashishgp11](https://discuss.elastic.co/u/ashishgp11)\ **Replies:** 0\ **Last updated:** [February 9, 2022, 4:31pm UTC](https://discuss.elastic.co/t/unable-to-create-index-using-resthighlevelclient-api-es-7-12-1/296757 "2022-02-09T16:31:54Z")
Hi, I am using \`ES 7.12.1\` and when I am trying to create the Index with the code getting an error: client = new RestHighLevelClient(RestClient.builder(new HttpHost("localhost", 9200, "http"))); CreateIndexReque… --- ## [ILM transfer index to cold, than frozen phase with searchable snapshot](https://discuss.elastic.co/t/ilm-transfer-index-to-cold-than-frozen-phase-with-searchable-snapshot/296755)
**Author:** [@bolemebrige](https://discuss.elastic.co/u/bolemebrige)\ **Replies:** 0\ **Last updated:** [February 9, 2022, 4:25pm UTC](https://discuss.elastic.co/t/ilm-transfer-index-to-cold-than-frozen-phase-with-searchable-snapshot/296755 "2022-02-09T16:25:12Z")
Hi, is it possible to transfer index to cold phase, make snapshot, mount it as fully searchable snapshot and than after some time transfer it to frozen phase while mounting it as partially mounted index. It seems like … --- ## [Openshift elasticsearch image: privileges isues](https://discuss.elastic.co/t/openshift-elasticsearch-image-privileges-isues/296742)
**Author:** [@Sonia1](https://discuss.elastic.co/u/Sonia1)\ **Replies:** 0\ **Last updated:** [February 9, 2022, 3:25pm UTC](https://discuss.elastic.co/t/openshift-elasticsearch-image-privileges-isues/296742 "2022-02-09T15:25:46Z")
Hi, We want to create a restricted space to certain users who can only have certain read permissions. To do this we are doing the following: From the elastic user, we create the new space "users" with the apps limita… --- ## [Snowball token analyzer for Slovenian](https://discuss.elastic.co/t/snowball-token-analyzer-for-slovenian/295589)
**Author:** [@provi](https://discuss.elastic.co/u/provi)\ **Replies:** 1\ **Last updated:** [February 9, 2022, 3:16pm UTC](https://discuss.elastic.co/t/snowball-token-analyzer-for-slovenian/295589 "2022-02-09T15:16:03Z")
Hello there! I'm searching for a Slovenian Snowball (or Stemmer) Analyzer to create a custom plugin (with Java) I already found something for Serbian and Slovak, but I have to recognize, I'm struggling with Slovenian. … --- ## [How to create "index pattern" with C#/NEST API? (creating a saved object) \[7.X\]](https://discuss.elastic.co/t/how-to-create-index-pattern-with-c-nest-api-creating-a-saved-object-7-x/294106)
**Author:** [@jkhadra](https://discuss.elastic.co/u/jkhadra)\ **Replies:** 1\ **Last updated:** [January 17, 2022, 4:26pm UTC](https://discuss.elastic.co/t/how-to-create-index-pattern-with-c-nest-api-creating-a-saved-object-7-x/294106 "2022-01-17T16:26:25Z")
Hi, I'd like to know the proper syntax for creating an index pattern/saved object using the NEST API. I've tried using the code here, but nothing is ever created when I check manually via Kibana. I'm trying to re-… --- ## [Failed to start Elasticsearch](https://discuss.elastic.co/t/failed-to-start-elasticsearch/296727)
**Author:** [@Ivan\_Scorpey](https://discuss.elastic.co/u/Ivan_Scorpey)\ **Replies:** 2\ **Last updated:** [February 9, 2022, 2:50pm UTC](https://discuss.elastic.co/t/failed-to-start-elasticsearch/296727 "2022-02-09T14:50:28Z")
I start ES but have Failed to start Elasticsearch and in log java.security.AccessControlException: access denied ("java.lang.RuntimePermission" "setContextClassLoader") [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=494) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=496)