# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=498 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 499 --- ## [Translog of index size is huge](https://discuss.elastic.co/t/translog-of-index-size-is-huge/296385)
**Author:** [@Ariel\_Benichou](https://discuss.elastic.co/u/Ariel_Benichou)\ **Replies:** 2\ **Last updated:** [February 7, 2022, 9:14am UTC](https://discuss.elastic.co/t/translog-of-index-size-is-huge/296385 "2022-02-07T09:14:41Z")
TL;DR one of my index in one of my data node got out of end and took all the disk available space making the node crash. The Problem On one of my data nodes, one of my biggest index (~10G) had suddenly a translog the w… --- ## [Indexing latency slowly increases until it's taking hours](https://discuss.elastic.co/t/indexing-latency-slowly-increases-until-its-taking-hours/296324)
**Author:** [@mikehardenize](https://discuss.elastic.co/u/mikehardenize)\ **Replies:** 2\ **Last updated:** [February 7, 2022, 9:10am UTC](https://discuss.elastic.co/t/indexing-latency-slowly-increases-until-its-taking-hours/296324 "2022-02-07T09:10:59Z")
I have a 3 node cluster. Once a day I create a new index and bulk insert some data. Then throughout the day singular docs are slowly added to that same index. Once a new index has been created and fulfilled the previous … --- ## [Percolation with document containing huge geo\_shape](https://discuss.elastic.co/t/percolation-with-document-containing-huge-geo-shape/294557)
**Author:** [@Pingouin](https://discuss.elastic.co/u/Pingouin)\ **Replies:** 3\ **Last updated:** [February 7, 2022, 8:58am UTC](https://discuss.elastic.co/t/percolation-with-document-containing-huge-geo-shape/294557 "2022-02-07T08:58:21Z")
Hello, i have strange error when using percolation with a document containing a huge geo\_shape property. I have an index containing documents (dt\_prior\_lake\_database\_continent\_basin). These documents have a mapped geo\_s… --- ## [Can a field like "name.last" be the target field of "enrich" in the ingest pipeline gui?](https://discuss.elastic.co/t/can-a-field-like-name-last-be-the-target-field-of-enrich-in-the-ingest-pipeline-gui/296418)
**Author:** [@Aloha](https://discuss.elastic.co/u/Aloha)\ **Replies:** 1\ **Last updated:** [February 7, 2022, 6:30am UTC](https://discuss.elastic.co/t/can-a-field-like-name-last-be-the-target-field-of-enrich-in-the-ingest-pipeline-gui/296418 "2022-02-07T06:30:07Z")
Trying to setup an ingest pipeline via the gui after setting up an enrich policy similar to this example. The target field is name.last and testing the pipeline with documents via the GUI works fine but trying to ingest… --- ## [No data for query "exists": { "field": "event.original" }](https://discuss.elastic.co/t/no-data-for-query-exists-field-event-original/296355)
**Author:** [@Slavik\_Fursov](https://discuss.elastic.co/u/Slavik_Fursov)\ **Replies:** 6\ **Last updated:** [February 7, 2022, 4:13am UTC](https://discuss.elastic.co/t/no-data-for-query-exists-field-event-original/296355 "2022-02-07T04:13:46Z")
I'm sending web access logs from Nginx server to Elastic. Everything works. I can see all data in Kibana correctly: However, when I try to add "exists": { "field": "event.original" } I'm getting no data: What … --- ## [Some questions](https://discuss.elastic.co/t/some-questions/296304)
**Author:** [@sandeepmuthathi](https://discuss.elastic.co/u/sandeepmuthathi)\ **Replies:** 4\ **Last updated:** [February 7, 2022, 5:35am UTC](https://discuss.elastic.co/t/some-questions/296304 "2022-02-07T05:35:24Z")
Is it a good idea to use Elasticsearch master nodes IPs(3 nodes) in the logstash or filebeat Or do we need to tell beat to use datanodes directly? Please note that master nodes has lots of resources but master nodes min… --- ## [Elasticsearch-5.5.1 not starting](https://discuss.elastic.co/t/elasticsearch-5-5-1-not-starting/296325)
**Author:** [@Kiranreddyk](https://discuss.elastic.co/u/Kiranreddyk)\ **Replies:** 6\ **Last updated:** [February 7, 2022, 4:43am UTC](https://discuss.elastic.co/t/elasticsearch-5-5-1-not-starting/296325 "2022-02-07T04:43:32Z")
HI , Need help on Elasticsearch-5.5.1.. When i start services on RHEL 7 .. it just hungs without any logs/error message.. where as I am able start Elasticsearch-6.2.2 services on same server.. This is all hapening af… --- ## [How do I restore certificate created on one node to other?](https://discuss.elastic.co/t/how-do-i-restore-certificate-created-on-one-node-to-other/296377)
**Author:** [@Blason](https://discuss.elastic.co/u/Blason)\ **Replies:** 2\ **Last updated:** [February 7, 2022, 2:39am UTC](https://discuss.elastic.co/t/how-do-i-restore-certificate-created-on-one-node-to-other/296377 "2022-02-07T02:39:51Z")
Hi Team, I have created one setup for testing purpose where I installed complete elasticstack on one host with complete certificates. In case if that host is crashed and If I need to resinstall the new host; how do I r… --- ## [Find all the nearest points that lie near linestring data](https://discuss.elastic.co/t/find-all-the-nearest-points-that-lie-near-linestring-data/296400)
**Author:** [@vaseem001](https://discuss.elastic.co/u/vaseem001)\ **Replies:** 1\ **Last updated:** [February 7, 2022, 1:58am UTC](https://discuss.elastic.co/t/find-all-the-nearest-points-that-lie-near-linestring-data/296400 "2022-02-07T01:58:08Z")
Let's say I have an index of points and I query linestring data so how can I find the nearest point that lies near give linestring data --- ## [How to compare index pattern values?](https://discuss.elastic.co/t/how-to-compare-index-pattern-values/296394)
**Author:** [@Travel\_Time](https://discuss.elastic.co/u/Travel_Time)\ **Replies:** 1\ **Last updated:** [February 7, 2022, 1:56am UTC](https://discuss.elastic.co/t/how-to-compare-index-pattern-values/296394 "2022-02-07T01:56:55Z")
Hello. I want to compare index patterns and as a result find the same ones. So for example I have index pattern1 where I have indexes with columns like --\> |pattern1\* \[index-1, index-2\] | col1 | col2 | col3 | ==… --- ## [Aggregations for combinations / permutations?](https://discuss.elastic.co/t/aggregations-for-combinations-permutations/296058)
**Author:** [@Emporea](https://discuss.elastic.co/u/Emporea)\ **Replies:** 2\ **Last updated:** [February 6, 2022, 11:17pm UTC](https://discuss.elastic.co/t/aggregations-for-combinations-permutations/296058 "2022-02-06T23:17:18Z")
Are there aggregations available to calculate combinations or permutations of keywords in one field or more field per document? Or is this a task for some painless script action I should learn? Example: keyword\_field … --- ## [Getting Error while configuring ELK stack Filebeat to remote server via Terraform](https://discuss.elastic.co/t/getting-error-while-configuring-elk-stack-filebeat-to-remote-server-via-terraform/296252)
**Author:** [@MurLeeDas](https://discuss.elastic.co/u/MurLeeDas)\ **Replies:** 0\ **Last updated:** [February 4, 2022, 5:47am UTC](https://discuss.elastic.co/t/getting-error-while-configuring-elk-stack-filebeat-to-remote-server-via-terraform/296252 "2022-02-04T05:47:51Z")
Hello All, My usecase is to deploy ELK stack to AWS ubuntu server. I have all the required installation and configurations commands in .sh file in the local. And while doing apply, I am getting error in the remote exec … --- ## [Concatenating 3 columns using Computed columns in enhanced table](https://discuss.elastic.co/t/concatenating-3-columns-using-computed-columns-in-enhanced-table/296269)
**Author:** [@Sandeep\_Raju](https://discuss.elastic.co/u/Sandeep_Raju)\ **Replies:** 2\ **Last updated:** [February 6, 2022, 9:47pm UTC](https://discuss.elastic.co/t/concatenating-3-columns-using-computed-columns-in-enhanced-table/296269 "2022-02-06T21:47:18Z")
Hi all, There are 3 fields a,b,c . For every document, only 1 of them will have a value. So I'm trying to concatenate 3 columns , but it is showing null with the string. For example : document 1: a=Hi b= c= When … --- ## [Should I have one Index or Multiple Indexes](https://discuss.elastic.co/t/should-i-have-one-index-or-multiple-indexes/296312)
**Author:** [@Pawan\_Misra](https://discuss.elastic.co/u/Pawan_Misra)\ **Replies:** 2\ **Last updated:** [February 6, 2022, 9:46pm UTC](https://discuss.elastic.co/t/should-i-have-one-index-or-multiple-indexes/296312 "2022-02-06T21:46:29Z")
We have a scenario where we have data from multiple clients. some figures to note: No of clients - 100 Data/client - 10GB (avg) With the above data, what should be our Indexing strategy? We know that we will need to… --- ## [Use LVM cache for Elasticsearch](https://discuss.elastic.co/t/use-lvm-cache-for-elasticsearch/296326)
**Author:** [@kannan\_raj](https://discuss.elastic.co/u/kannan_raj)\ **Replies:** 1\ **Last updated:** [February 6, 2022, 9:45pm UTC](https://discuss.elastic.co/t/use-lvm-cache-for-elasticsearch/296326 "2022-02-06T21:45:46Z")
Hello Everyone, can we use the Elasticseacrh with LVM cache logical volume? Cache logical volume The cache logical volume type uses a small and fast LV to improve the performance of a large and slow LV. It does this … --- ## [Couldn't find any Elasticsearch data](https://discuss.elastic.co/t/couldnt-find-any-elasticsearch-data/296330)
**Author:** [@mikemiko](https://discuss.elastic.co/u/mikemiko)\ **Replies:** 1\ **Last updated:** [February 6, 2022, 9:44pm UTC](https://discuss.elastic.co/t/couldnt-find-any-elasticsearch-data/296330 "2022-02-06T21:44:55Z")
I deployed an EFK stack on a 3 Node Kubernetes cluster (kind cluster). The Cluster is also running a custom app that I intend to monitor through the stack. All Pods are running. I can access Kibana at: \\ **Author:** [@Nicolas35](https://discuss.elastic.co/u/Nicolas35)\ **Replies:** 0\ **Last updated:** [February 6, 2022, 12:18am UTC](https://discuss.elastic.co/t/creating-ilm-policies-in-java-using-new-java-api-client/296375 "2022-02-06T00:18:43Z") Hi, I am stuck creating a policy in java using the new java api client. I am using Elasticsearch-java 7.16.2 Here is the faulty code: String json= "{\\"allocate\\" : {\\"number\_of\_replicas\\" : 1}," + "\\"fo… --- ## [ElastisSearch JVM Heap running full](https://discuss.elastic.co/t/elastissearch-jvm-heap-running-full/295928)
**Author:** [@grregm](https://discuss.elastic.co/u/grregm)\ **Replies:** 5\ **Last updated:** [February 6, 2022, 9:00pm UTC](https://discuss.elastic.co/t/elastissearch-jvm-heap-running-full/295928 "2022-02-06T21:00:17Z")
Hey there, We are running a Elasticsearch (7.16.1, Docker inside Kubernetes) cluster which is monitored by a Kibana Stack. After 5-6 days (sometimes sooner) Elasticsearch is running into JVM Heap issues/errors. Is there… --- ## [How to restore snapshot to a different cluster](https://discuss.elastic.co/t/how-to-restore-snapshot-to-a-different-cluster/296182)
**Author:** [@Adityadgr8](https://discuss.elastic.co/u/Adityadgr8)\ **Replies:** 6\ **Last updated:** [February 6, 2022, 2:43pm UTC](https://discuss.elastic.co/t/how-to-restore-snapshot-to-a-different-cluster/296182 "2022-02-06T14:43:02Z")
Hello Guys, I have taken a snapshot of Elasticsearch db in one of the cluster(here Elasticsearch is running as kubernetes pods, 3 pods of Elasticsearch are running) and now I want that snapshot to be restored into a com… --- ## [Script field along with all the other fields using Painless](https://discuss.elastic.co/t/script-field-along-with-all-the-other-fields-using-painless/296384)
**Author:** [@saurab](https://discuss.elastic.co/u/saurab)\ **Replies:** 3\ **Last updated:** [February 6, 2022, 12:10pm UTC](https://discuss.elastic.co/t/script-field-along-with-all-the-other-fields-using-painless/296384 "2022-02-06T12:10:19Z")
I have data indexed as follows: {"index":{"\_id":1}} {"first":"johnny","last":"gaudreau","goals":\[9,27,1\],"born":"1993/08/13"} {"index":{"\_id":2}} {"first":"sean","last":"monohan","goals":\[7,54,26\],"born":"1994/10/12"} W… --- ## [Use one ingest pipeline as default\_pipeline for different indexes](https://discuss.elastic.co/t/use-one-ingest-pipeline-as-default-pipeline-for-different-indexes/296266)
**Author:** [@m-cd](https://discuss.elastic.co/u/m-cd)\ **Replies:** 2\ **Last updated:** [February 6, 2022, 9:15am UTC](https://discuss.elastic.co/t/use-one-ingest-pipeline-as-default-pipeline-for-different-indexes/296266 "2022-02-06T09:15:05Z")
Hi All, I'm a little bit new on the ELK world... So sorry for my newbie question... I setup a working ingest pipeline (policy and processors) and it works like a charm on one index as default\_pipeline. I would like t… --- ## [Query sample of each field in index](https://discuss.elastic.co/t/query-sample-of-each-field-in-index/296370)
**Author:** [@Petr.Simik](https://discuss.elastic.co/u/Petr.Simik)\ **Replies:** 0\ **Last updated:** [February 5, 2022, 10:11pm UTC](https://discuss.elastic.co/t/query-sample-of-each-field-in-index/296370 "2022-02-05T22:11:41Z")
I am trying to develop data-catalog app this app shows all fields (in flat dict format) its mapping type and sample data for instance this index POST test/\_doc { "@timestamp": "2099-11-15T13:12:00", "message": "GE… --- ## [Java client, which libraries, packages](https://discuss.elastic.co/t/java-client-which-libraries-packages/296366)
**Author:** [@mamueIV](https://discuss.elastic.co/u/mamueIV)\ **Replies:** 0\ **Last updated:** [February 5, 2022, 8:25pm UTC](https://discuss.elastic.co/t/java-client-which-libraries-packages/296366 "2022-02-05T20:25:17Z")
Hi, i try to get started with Elasticsearch development in java. Alas still no javadoc as far as i can see and the source examples are quite confusing. No mention of used libraries, not even package names. For example,… --- ## [APIKey retains the cluster privileges at the time is was created](https://discuss.elastic.co/t/apikey-retains-the-cluster-privileges-at-the-time-is-was-created/296359)
**Author:** [@Roger\_Clark](https://discuss.elastic.co/u/Roger_Clark)\ **Replies:** 2\ **Last updated:** [February 5, 2022, 5:39pm UTC](https://discuss.elastic.co/t/apikey-retains-the-cluster-privileges-at-the-time-is-was-created/296359 "2022-02-05T17:39:20Z")
We were testing out migration to APIKeys for application-level API access and I noticed something strange I can't find documented anywhere, this is under a ELK stack running 7.15.1 I created a new user and role, and for… --- ## [What to do with query inside filter query](https://discuss.elastic.co/t/what-to-do-with-query-inside-filter-query/296246)
**Author:** [@JunyaT](https://discuss.elastic.co/u/JunyaT)\ **Replies:** 3\ **Last updated:** [February 5, 2022, 4:26am UTC](https://discuss.elastic.co/t/what-to-do-with-query-inside-filter-query/296246 "2022-02-05T04:26:24Z")
Hi, people from Elasticsearch. I have struggles trying to migrate to Elasticsearch 7.11.1 from very old Elasticsearch 1.3. "The original query" below is used in our codebase to be executed against Elasticsearch 1.3 and… --- ## [Runtime field error](https://discuss.elastic.co/t/runtime-field-error/296234)
**Author:** [@gentle\_ghost](https://discuss.elastic.co/u/gentle_ghost)\ **Replies:** 3\ **Last updated:** [February 4, 2022, 10:45pm UTC](https://discuss.elastic.co/t/runtime-field-error/296234 "2022-02-04T22:45:36Z")
Hello, I'm attempting to create a runtime field that parses values from a field based on a regex. I have a field event\_trigger that contains some various strings. I'm looking to find all values which contain giy2 and … --- ## [Elasticsearch Ability to write to Memory](https://discuss.elastic.co/t/elasticsearch-ability-to-write-to-memory/295586)
**Author:** [@Mohammad\_Etemad](https://discuss.elastic.co/u/Mohammad_Etemad)\ **Replies:** 2\ **Last updated:** [February 4, 2022, 9:07pm UTC](https://discuss.elastic.co/t/elasticsearch-ability-to-write-to-memory/295586 "2022-02-04T21:07:00Z")
Hello I was wondering if its possible to have Elasticsearch write docs to memory and have them roll. The use case is that we have a lot of data on a specific index being written and the writes to disk are using lots of … --- ## [Detecting anomalies on drop of throughput](https://discuss.elastic.co/t/detecting-anomalies-on-drop-of-throughput/296307)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 1\ **Last updated:** [February 4, 2022, 7:39pm UTC](https://discuss.elastic.co/t/detecting-anomalies-on-drop-of-throughput/296307 "2022-02-04T19:39:11Z")
Hi have data of throughput for multiple interfaces in a job, and I want to detect when the throughput drops abruptly, Im using the low\_mean function in the detector to do this, but sometimes there is an abrupt drop of t… --- ## [How to decide on number of Master and data nodes between two data centers](https://discuss.elastic.co/t/how-to-decide-on-number-of-master-and-data-nodes-between-two-data-centers/295097)
**Author:** [@zaeemmasood](https://discuss.elastic.co/u/zaeemmasood)\ **Replies:** 8\ **Last updated:** [February 4, 2022, 2:32pm UTC](https://discuss.elastic.co/t/how-to-decide-on-number-of-master-and-data-nodes-between-two-data-centers/295097 "2022-02-04T14:32:51Z")
Hi All, We have a total of 8 servers (4 in each data center), running ELK 7.6.2 stack. How can we decide on the number of Master (or Master-eligible) nodes and data nodes? Please help --- ## [More\_like\_this not using nested fields?](https://discuss.elastic.co/t/more-like-this-not-using-nested-fields/296311)
**Author:** [@ndtreviv](https://discuss.elastic.co/u/ndtreviv)\ **Replies:** 0\ **Last updated:** [February 4, 2022, 2:27pm UTC](https://discuss.elastic.co/t/more-like-this-not-using-nested-fields/296311 "2022-02-04T14:27:47Z")
I want to use the more like this query type to find similar documents without having to construct a bool. I like the minimum\_should\_match as a percent to identify %-similar documents. My document has lots of nested fiel… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=497) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=499)