# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=502 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 503 --- ## [How to make \_id available for aggs?](https://discuss.elastic.co/t/how-to-make-id-available-for-aggs/295814)
**Author:** [@Emporea](https://discuss.elastic.co/u/Emporea)\ **Replies:** 0\ **Last updated:** [January 31, 2022, 10:03am UTC](https://discuss.elastic.co/t/how-to-make-id-available-for-aggs/295814 "2022-01-31T10:03:42Z")
Upon indexing I overwrote \_id with my own unique \_id field filled with integers. How can I aggregate something like max on my \_id field? max\_id: { max: { field: "\_id" } } This only throws an error. Currently I am usi… --- ## [Hi all, I want to Index data into elasticsearch using PHP. Can anyone guide me?](https://discuss.elastic.co/t/hi-all-i-want-to-index-data-into-elasticsearch-using-php-can-anyone-guide-me/295652)
**Author:** [@Chinmay\_Bhusate](https://discuss.elastic.co/u/Chinmay_Bhusate)\ **Replies:** 4\ **Last updated:** [January 31, 2022, 4:23am UTC](https://discuss.elastic.co/t/hi-all-i-want-to-index-data-into-elasticsearch-using-php-can-anyone-guide-me/295652 "2022-01-31T04:23:45Z")
I want to Index data Using PHP . But not able to configure the settings. --- ## [Return documents that matches : Filter nested record with Max Start date and match a keyword : Search for candidate having last job with a keyword](https://discuss.elastic.co/t/return-documents-that-matches-filter-nested-record-with-max-start-date-and-match-a-keyword-search-for-candidate-having-last-job-with-a-keyword/295786)
**Author:** [@aloksharma](https://discuss.elastic.co/u/aloksharma)\ **Replies:** 0\ **Last updated:** [January 30, 2022, 7:51pm UTC](https://discuss.elastic.co/t/return-documents-that-matches-filter-nested-record-with-max-start-date-and-match-a-keyword-search-for-candidate-having-last-job-with-a-keyword/295786 "2022-01-30T19:51:50Z")
Hi, After all tries I am here to seek help. I have following structure of the document: { "candidate\_id" : 1234, "location" : { "city" : "NY", "country" : "US" }, "age" : 32, "highest\_education" : "Graduate", "job\_his… --- ## [Query terms with dash in string?](https://discuss.elastic.co/t/query-terms-with-dash-in-string/295780)
**Author:** [@Emporea](https://discuss.elastic.co/u/Emporea)\ **Replies:** 3\ **Last updated:** [January 30, 2022, 4:01pm UTC](https://discuss.elastic.co/t/query-terms-with-dash-in-string/295780 "2022-01-30T16:01:38Z")
GET /\_search { "query": { "terms": { "user.id": \[ "kimchy", "elkbee-test" \], } } } Result will only include kimchy, because I guess the dash is interpretet as a bool operator. How to fix this? --- ## [How to index anomalous documents in another index?](https://discuss.elastic.co/t/how-to-index-anomalous-documents-in-another-index/295458)
**Author:** [@Ilia](https://discuss.elastic.co/u/Ilia)\ **Replies:** 2\ **Last updated:** [January 30, 2022, 10:11am UTC](https://discuss.elastic.co/t/how-to-index-anomalous-documents-in-another-index/295458 "2022-01-30T10:11:42Z")
It is my first time working with Elasticsearch anomaly detection. I've read the concepts and create a sample index to test it. I've also created these job and datafeed by using kibana for the sample index: { "job\_id"… --- ## [Replacement of CircleBuilder/PolygonBuilder](https://discuss.elastic.co/t/replacement-of-circlebuilder-polygonbuilder/295676)
**Author:** [@UglyBarnacle](https://discuss.elastic.co/u/UglyBarnacle)\ **Replies:** 3\ **Last updated:** [January 30, 2022, 1:31am UTC](https://discuss.elastic.co/t/replacement-of-circlebuilder-polygonbuilder/295676 "2022-01-30T01:31:00Z")
Since the circle was not supported anymore (I think now it is, atleast on query execution), we approximated a circle with the PolygonBuilder from the main Elasticsearch package. Elasticsearch 7.16 did a cleanup, removin… --- ## [Enrich processor missing some documents](https://discuss.elastic.co/t/enrich-processor-missing-some-documents/295722)
**Author:** [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Replies:** 4\ **Last updated:** [January 30, 2022, 12:54am UTC](https://discuss.elastic.co/t/enrich-processor-missing-some-documents/295722 "2022-01-30T00:54:30Z")
Hello, I have an ingest pipeline that has a simple enrich processor, it basically adds a field named host.type based on the host.name. This enrich processor is part of a final\_pipeline that is set in the index, and I'm… --- ## [Filebeat send json data to Elasticsearch & Use file name as index](https://discuss.elastic.co/t/filebeat-send-json-data-to-elasticsearch-use-file-name-as-index/295763)
**Author:** [@Suat\_Bey](https://discuss.elastic.co/u/Suat_Bey)\ **Replies:** 0\ **Last updated:** [January 29, 2022, 8:51pm UTC](https://discuss.elastic.co/t/filebeat-send-json-data-to-elasticsearch-use-file-name-as-index/295763 "2022-01-29T20:51:51Z")
Is it possible to create a Elasticsearch index using a file name. I have the json file named as daily regex, and want to send this data day by day to elsaticsearch. On the Elasticsearch index I want to use file same as i… --- ## [Date histogram aggregation issue for arrays fields](https://discuss.elastic.co/t/date-histogram-aggregation-issue-for-arrays-fields/294965)
**Author:** [@Marek\_Siwiec](https://discuss.elastic.co/u/Marek_Siwiec)\ **Replies:** 1\ **Last updated:** [January 29, 2022, 5:13pm UTC](https://discuss.elastic.co/t/date-histogram-aggregation-issue-for-arrays-fields/294965 "2022-01-29T17:13:57Z")
Hello! I trying to update ES from 7.10.2 to 7.16.3 and I encounter an issue with Date histogram aggregation. When I have a document with a date field as an array with date aggregation by month on that field, then I expe… --- ## [Help on script score query with filter script](https://discuss.elastic.co/t/help-on-script-score-query-with-filter-script/295751)
**Author:** [@scharom16](https://discuss.elastic.co/u/scharom16)\ **Replies:** 7\ **Last updated:** [January 29, 2022, 3:30pm UTC](https://discuss.elastic.co/t/help-on-script-score-query-with-filter-script/295751 "2022-01-29T15:30:57Z")
Hi elastic community, I need some guidance on the following query. I am using the Python Elasticsearch client and when executing the query it returns a 'search\_phase\_execution\_exception' with no further guidance. Can yo… --- ## [Can't use method ensureCapacity for ArrayList](https://discuss.elastic.co/t/cant-use-method-ensurecapacity-for-arraylist/295695)
**Author:** [@arnautov\_evgeny](https://discuss.elastic.co/u/arnautov_evgeny)\ **Replies:** 3\ **Last updated:** [January 29, 2022, 3:08pm UTC](https://discuss.elastic.co/t/cant-use-method-ensurecapacity-for-arraylist/295695 "2022-01-29T15:08:28Z")
Hello. I'm using a script on painless language, and I can't get it working with the ArrayList object. Even example from docs isn't working for me. I've tested it on 7.13.2 and 7.16.3. Thanks in advance for your answer. … --- ## [Minimum number of replica shard ? (do we need 2 replica for recovery?)](https://discuss.elastic.co/t/minimum-number-of-replica-shard-do-we-need-2-replica-for-recovery/295741)
**Author:** [@dan\_kim](https://discuss.elastic.co/u/dan_kim)\ **Replies:** 2\ **Last updated:** [January 29, 2022, 7:54am UTC](https://discuss.elastic.co/t/minimum-number-of-replica-shard-do-we-need-2-replica-for-recovery/295741 "2022-01-29T07:54:12Z")
Hello ! our company is trying to building a new Elasticsearch for service and We are studying ES for a proper service . And I have a question about replica shard. Should we set our replica shard more than 2? Here is… --- ## [Include Friend relations in user search](https://discuss.elastic.co/t/include-friend-relations-in-user-search/295632)
**Author:** [@JonasLevin](https://discuss.elastic.co/u/JonasLevin)\ **Replies:** 1\ **Last updated:** [January 29, 2022, 3:17am UTC](https://discuss.elastic.co/t/include-friend-relations-in-user-search/295632 "2022-01-29T03:17:45Z")
I'm working on creating a search feature for a social network like Mobile App. Users can follow each other and search by username, lastname or firstname. Currently we are just indexing username, lastname and firstname i… --- ## [rollupSearch with new Java Api Client](https://discuss.elastic.co/t/rollupsearch-with-new-java-api-client/295736)
**Author:** [@rfox](https://discuss.elastic.co/u/rfox)\ **Replies:** 0\ **Last updated:** [January 29, 2022, 12:32am UTC](https://discuss.elastic.co/t/rollupsearch-with-new-java-api-client/295736 "2022-01-29T00:32:45Z")
I am struggling to use the new rollupSearch API. I am trying to map this query: GET count\_rollup/\_rollup\_search { "size": 0, "aggregations": { "timeline": { "date\_histogram": { "field": "datetime"… --- ## [ILM Warm Phase Executes on Hot Node](https://discuss.elastic.co/t/ilm-warm-phase-executes-on-hot-node/295727)
**Author:** [@BenB196](https://discuss.elastic.co/u/BenB196)\ **Replies:** 4\ **Last updated:** [January 29, 2022, 12:12am UTC](https://discuss.elastic.co/t/ilm-warm-phase-executes-on-hot-node/295727 "2022-01-29T00:12:46Z")
Hi All, I recently noticed some CPU usage issues on my hot data nodes. When looking at the hot threads (GET /\_nodes/\/hot\_threads). I noticed that the main cause was force merging during rollover from hot -\> war… --- ## [Master not Discovered yet](https://discuss.elastic.co/t/master-not-discovered-yet/295699)
**Author:** [@auasad](https://discuss.elastic.co/u/auasad)\ **Replies:** 3\ **Last updated:** [January 28, 2022, 11:01pm UTC](https://discuss.elastic.co/t/master-not-discovered-yet/295699 "2022-01-28T23:01:40Z")
Hello community, I am facing an issue, I have a cluster consisting 3 nodes in NZ(Master-Data), one node in PK(Data Node) everything is up and running over the public IPs. Now the issue comes when I try to join my new IR… --- ## [Search in Array Field](https://discuss.elastic.co/t/search-in-array-field/295732)
**Author:** [@Sahil5](https://discuss.elastic.co/u/Sahil5)\ **Replies:** 0\ **Last updated:** [January 28, 2022, 8:36pm UTC](https://discuss.elastic.co/t/search-in-array-field/295732 "2022-01-28T20:36:11Z")
Hi Team, I want to enable search on array field but only want to retrieve the value from an array that matches the search query. Example Document 1 - \[A,B\] Document 2 - \[A,C\] Below is the Query { "query": { "… --- ## [Wildcard for source.ip field](https://discuss.elastic.co/t/wildcard-for-source-ip-field/295613)
**Author:** [@francescouk](https://discuss.elastic.co/u/francescouk)\ **Replies:** 4\ **Last updated:** [January 28, 2022, 7:04pm UTC](https://discuss.elastic.co/t/wildcard-for-source-ip-field/295613 "2022-01-28T19:04:51Z")
Hi there, I would like to know how to fix this search (if is possible of course): (winlog.channel:"Security" AND (winlog.event\_id:"4624" AND winlog.event\_data.LogonType:"10") AND (NOT (source.ip:(10.\* OR 192.168.\* OR 1… --- ## [FS Crawler 2.4 on Apache Log4j2 Remote Code Execution (RCE) Vulnerability](https://discuss.elastic.co/t/fs-crawler-2-4-on-apache-log4j2-remote-code-execution-rce-vulnerability/291649)
**Author:** [@joseph-l.amalraj](https://discuss.elastic.co/u/joseph-l.amalraj)\ **Replies:** 16\ **Last updated:** [January 28, 2022, 6:14pm UTC](https://discuss.elastic.co/t/fs-crawler-2-4-on-apache-log4j2-remote-code-execution-rce-vulnerability/291649 "2022-01-28T18:14:21Z")
Hi David, recently we have received about Apache Log4j2 Remote Code Execution (RCE) Vulnerability. I am using FS Crawler 2.4 version along with ELK 6.8.14, we planned to do remediation plan for log4j in ELK. We would l… --- ## [Unified highlighter snippet fragmenter issues](https://discuss.elastic.co/t/unified-highlighter-snippet-fragmenter-issues/295603)
**Author:** [@fsouptes](https://discuss.elastic.co/u/fsouptes)\ **Replies:** 3\ **Last updated:** [January 28, 2022, 6:12pm UTC](https://discuss.elastic.co/t/unified-highlighter-snippet-fragmenter-issues/295603 "2022-01-28T18:12:52Z")
Hello, We are knowing some issues with how snippets are splitted with unified highlighter. We use Elasticsearch in 7.16 Some snippets are very shorts, sometimes the snippet is inconsistent or is only a repetition of u… --- ## [Java Api Client RangeQueryBuilder has JsonData as an attribute for gte etc](https://discuss.elastic.co/t/java-api-client-rangequerybuilder-has-jsondata-as-an-attribute-for-gte-etc/293462)
**Author:** [@Piotr\_Idzikowski](https://discuss.elastic.co/u/Piotr_Idzikowski)\ **Replies:** 2\ **Last updated:** [January 28, 2022, 2:58pm UTC](https://discuss.elastic.co/t/java-api-client-rangequerybuilder-has-jsondata-as-an-attribute-for-gte-etc/293462 "2022-01-28T14:58:17Z")
Hello. I am trying to migrate my java application to use new java api client. Today I realized that RangeQUeryBuildar has these strange types for gte, lte, etc methods. Why is it JsonData type? I am using Elasticsear… --- ## [How can I find is ilm policy been applied to my index?](https://discuss.elastic.co/t/how-can-i-find-is-ilm-policy-been-applied-to-my-index/295708)
**Author:** [@baalchina](https://discuss.elastic.co/u/baalchina)\ **Replies:** 1\ **Last updated:** [January 28, 2022, 2:26pm UTC](https://discuss.elastic.co/t/how-can-i-find-is-ilm-policy-been-applied-to-my-index/295708 "2022-01-28T14:26:09Z")
Hi, I am trying to apply a ILM policy to my index, I created a new index template, all of them are empty except a index pattern(and this pattern has some index include). At last, I assigin the ILM policy to the new index… --- ## [Using rally without GIT and S3 bucket](https://discuss.elastic.co/t/using-rally-without-git-and-s3-bucket/295681)
**Author:** [@marek\_duciuc](https://discuss.elastic.co/u/marek_duciuc)\ **Replies:** 2\ **Last updated:** [January 28, 2022, 1:20pm UTC](https://discuss.elastic.co/t/using-rally-without-git-and-s3-bucket/295681 "2022-01-28T13:20:17Z")
Is there a way to use rally without setting up git and S3? What I mean during track development I do not want it to be committed to git and also I just want to have data locally into in s3 for now. How do I do it? At l… --- ## [Get documents based on some filter conditions](https://discuss.elastic.co/t/get-documents-based-on-some-filter-conditions/295431)
**Author:** [@Khushboo\_Kaul](https://discuss.elastic.co/u/Khushboo_Kaul)\ **Replies:** 1\ **Last updated:** [January 26, 2022, 11:50pm UTC](https://discuss.elastic.co/t/get-documents-based-on-some-filter-conditions/295431 "2022-01-26T23:50:26Z")
Hi, I am trying to use spark ( pyspark) and my goal is to query from the huge Elasticsearch index a subset of data that matches a particular condition of column. For example, if my columns are - name, age, timestamp I… --- ## [Using CoOrdinated nodes in ES cluster](https://discuss.elastic.co/t/using-coordinated-nodes-in-es-cluster/295608)
**Author:** [@sreekanth](https://discuss.elastic.co/u/sreekanth)\ **Replies:** 4\ **Last updated:** [January 28, 2022, 11:42am UTC](https://discuss.elastic.co/t/using-coordinated-nodes-in-es-cluster/295608 "2022-01-28T11:42:12Z")
I have 6 nodes cluster where all nodes marked with "mdi". Now I added 3 more Co-Ordinated nodes and configured with master=false, data=false, ingest=false. Now those nodes shows role as "-". As per doc this indicates th… --- ## [About Synonym toke filter](https://discuss.elastic.co/t/about-synonym-toke-filter/294501)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 2\ **Last updated:** [January 28, 2022, 10:32am UTC](https://discuss.elastic.co/t/about-synonym-toke-filter/294501 "2022-01-28T10:32:49Z")
I am using synonym token filter in my mapping but it has a property called synonyms\_path. PUT /\_template/ise { "index\_patterns" : \["log-ise-\*"\], "settings": { "index.lifecycle.name":"ise\_policy", "ind… --- ## [Automatic heap sizing](https://discuss.elastic.co/t/automatic-heap-sizing/293386)
**Author:** [@rugenl](https://discuss.elastic.co/u/rugenl)\ **Replies:** 9\ **Last updated:** [January 28, 2022, 10:03am UTC](https://discuss.elastic.co/t/automatic-heap-sizing/293386 "2022-01-28T10:03:46Z")
I'm testing the automatic heap size feature in 7.16.2. In a 12G VM I was specifying a 4G heap, I removed that setting, restarted Elasticsearch and it used 1G for heap. That seams small to me. Does it grow the heap if … --- ## [Pagination - re-indexing](https://discuss.elastic.co/t/pagination-re-indexing/295648)
**Author:** [@harsh19](https://discuss.elastic.co/u/harsh19)\ **Replies:** 3\ **Last updated:** [January 28, 2022, 10:03am UTC](https://discuss.elastic.co/t/pagination-re-indexing/295648 "2022-01-28T10:03:11Z")
I have question regarding pagination in Elasticsearch, let i have log record more then 10,000 so i am gone a do pagination on it, so main question is that -- is it required re-indexing when data is more then 10,000 ??? --- ## [Reindex 2.4 to 5.6](https://discuss.elastic.co/t/reindex-2-4-to-5-6/295642)
**Author:** [@mario12](https://discuss.elastic.co/u/mario12)\ **Replies:** 7\ **Last updated:** [January 28, 2022, 7:17am UTC](https://discuss.elastic.co/t/reindex-2-4-to-5-6/295642 "2022-01-28T07:17:19Z")
We are in the process of re-indexing 2.4 to 5.6. During the re-indexing process the application is able to perform inserts/updates/delete operation to 2.4. So, we are planning to re-index again to copy the missing docume… --- ## [Apply ILM on rollup or transform index](https://discuss.elastic.co/t/apply-ilm-on-rollup-or-transform-index/294039)
**Author:** [@Achraf\_MENSI](https://discuss.elastic.co/u/Achraf_MENSI)\ **Replies:** 7\ **Last updated:** [January 28, 2022, 6:50am UTC](https://discuss.elastic.co/t/apply-ilm-on-rollup-or-transform-index/294039 "2022-01-28T06:50:59Z")
Hello, does anyone have successfully applied ILM on a transform or rollup index? or it's possible only with normal index? thanks [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=501) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=503)