# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=505 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 506 --- ## [Point In Time creation failure after upgrade](https://discuss.elastic.co/t/point-in-time-creation-failure-after-upgrade/295172)
**Author:** [@RapTvin](https://discuss.elastic.co/u/RapTvin)\ **Replies:** 2\ **Last updated:** [January 25, 2022, 12:50pm UTC](https://discuss.elastic.co/t/point-in-time-creation-failure-after-upgrade/295172 "2022-01-25T12:50:38Z")
Hello, I need some help in an issue, I recently upgraded my Elasticsearch on local setup ( i.e downloaded 7.16.2 ). Now when I try to run a Point in Time API to retrieve the PIT id, on the Elasticsearch logs it gives me … --- ## [Watcher: http input specify current date in path](https://discuss.elastic.co/t/watcher-http-input-specify-current-date-in-path/293391)
**Author:** [@Kevin\_Gonzalez](https://discuss.elastic.co/u/Kevin_Gonzalez)\ **Replies:** 7\ **Last updated:** [January 25, 2022, 12:36pm UTC](https://discuss.elastic.co/t/watcher-http-input-specify-current-date-in-path/293391 "2022-01-25T12:36:15Z")
I'm trying to create a watcher that monitors the size of a specific index. I have daily indices with this naming convention: "indexname-YYYY.MM.dd", example: "test-index-2022.01.03". I want to monitor the size of that s… --- ## [Delete by Query Impact in terms of Data size vs Time taken](https://discuss.elastic.co/t/delete-by-query-impact-in-terms-of-data-size-vs-time-taken/295339)
**Author:** [@yash\_196](https://discuss.elastic.co/u/yash_196)\ **Replies:** 0\ **Last updated:** [January 25, 2022, 11:17am UTC](https://discuss.elastic.co/t/delete-by-query-impact-in-terms-of-data-size-vs-time-taken/295339 "2022-01-25T11:17:05Z")
Hi Everyone, I am trying to understand the impact of using delete by query API in Elasticsearch. I am looking for some formula/metrics in terms of the time taken to delete a certain amount of data. Can anyone please hel… --- ## [Repository creation fails (disk quota)](https://discuss.elastic.co/t/repository-creation-fails-disk-quota/295328)
**Author:** [@pszemesy](https://discuss.elastic.co/u/pszemesy)\ **Replies:** 0\ **Last updated:** [January 25, 2022, 10:24am UTC](https://discuss.elastic.co/t/repository-creation-fails-disk-quota/295328 "2022-01-25T10:24:14Z")
Hi All, I have an issue with creation of snapshot repository. PUT \_snapshot/test-repo { "type": "fs", "settings": { "location": "test\_repo" } } The reply was this: { "error" : { "root\_cause" : \[ … --- ## [Elasticsearch7.x have any solutions to replace existing searchAction or override?](https://discuss.elastic.co/t/elasticsearch7-x-have-any-solutions-to-replace-existing-searchaction-or-override/295334)
**Author:** [@Howells](https://discuss.elastic.co/u/Howells)\ **Replies:** 0\ **Last updated:** [January 25, 2022, 10:57am UTC](https://discuss.elastic.co/t/elasticsearch7-x-have-any-solutions-to-replace-existing-searchaction-or-override/295334 "2022-01-25T10:57:08Z")
I want to do some custom function in RestSearchAction.prepareRequest before "request.withContentOrSourceParamParserOrNull(parser -\> parseSearchRequest(searchRequest, request, parser, setSize));" , like verify query stat… --- ## [Readiness Probe Failing - clusterHealthCheckParams: "wait\_for\_status=yellow&timeout=1s"](https://discuss.elastic.co/t/readiness-probe-failing-clusterhealthcheckparams-wait-for-status-yellow-timeout-1s/295319)
**Author:** [@aniesh.mathew](https://discuss.elastic.co/u/aniesh.mathew)\ **Replies:** 3\ **Last updated:** [January 25, 2022, 10:16am UTC](https://discuss.elastic.co/t/readiness-probe-failing-clusterhealthcheckparams-wait-for-status-yellow-timeout-1s/295319 "2022-01-25T10:16:02Z")
We have a deployed a elastic master with single replica in kubernetes and have added the parameter clusterHealthCheckParams: wait\_for\_status=yellow&timeout=1s as suggested in post. The elastic master was working fine e… --- ## [Data nodes randomly leaving cluster](https://discuss.elastic.co/t/data-nodes-randomly-leaving-cluster/294838)
**Author:** [@jcasals](https://discuss.elastic.co/u/jcasals)\ **Replies:** 11\ **Last updated:** [January 25, 2022, 8:55am UTC](https://discuss.elastic.co/t/data-nodes-randomly-leaving-cluster/294838 "2022-01-25T08:55:30Z")
Hello, I have a problem that I can't seem to be able to fix nor understand. I have an Elasticsearch cluster with three master nodes and 6 (12) data nodes. Master nodes: virtual, with 2CPU and 4GB of memory. Data node… --- ## [Two commands return different segments info of the same index](https://discuss.elastic.co/t/two-commands-return-different-segments-info-of-the-same-index/295151)
**Author:** [@chembohuang](https://discuss.elastic.co/u/chembohuang)\ **Replies:** 1\ **Last updated:** [January 25, 2022, 7:46am UTC](https://discuss.elastic.co/t/two-commands-return-different-segments-info-of-the-same-index/295151 "2022-01-25T07:46:57Z")
ES 7.7.1, jdk 14. A cluster with 3 dedicated master nodes and 100+ data nodes. During the execution of the forcemerge, myindex/\_stats and \_cat/segments/myindex return different segments info. Here is the forcemerge cm… --- ## [Warning "Unable to acquire permit to use snapshot files during recovery…" when restarting elasticsearch node](https://discuss.elastic.co/t/warning-unable-to-acquire-permit-to-use-snapshot-files-during-recovery-when-restarting-elasticsearch-node/293543)
**Author:** [@Gregor\_Weckbecker](https://discuss.elastic.co/u/Gregor_Weckbecker)\ **Replies:** 2\ **Last updated:** [January 25, 2022, 6:02am UTC](https://discuss.elastic.co/t/warning-unable-to-acquire-permit-to-use-snapshot-files-during-recovery-when-restarting-elasticsearch-node/293543 "2022-01-25T06:02:12Z")
When upgrading our elasticsearch cluster to version 7.16.1, we performing a rolling upgarde as described in the documentation. Before the restart we trigger a synced flush and increase cluster.routing.allocation.node\_con… --- ## [Remove \`\_all\` mapping from older indexes](https://discuss.elastic.co/t/remove-all-mapping-from-older-indexes/295263)
**Author:** [@willdennis](https://discuss.elastic.co/u/willdennis)\ **Replies:** 5\ **Last updated:** [January 25, 2022, 1:06am UTC](https://discuss.elastic.co/t/remove-all-mapping-from-older-indexes/295263 "2022-01-25T01:06:50Z")
Upgraded to v6.8 recently; trying to ensure I can now upgrade to v7.x Having an issue when trying to reindex my old logstash indexes created on v5.6.x - getting this message when the system goes to create the new index (… --- ## [Get distinct values from a array in ElasticSearch](https://discuss.elastic.co/t/get-distinct-values-from-a-array-in-elasticsearch/295274)
**Author:** [@smkarnan](https://discuss.elastic.co/u/smkarnan)\ **Replies:** 1\ **Last updated:** [January 25, 2022, 12:27am UTC](https://discuss.elastic.co/t/get-distinct-values-from-a-array-in-elasticsearch/295274 "2022-01-25T00:27:04Z")
Hi, How can I retrieve unique values in the array, i just want to get unique lat from the below collection. "hits" { "function": { "geo\_fence: \[ { "lon": 131.… --- ## [Total shards per node calculation](https://discuss.elastic.co/t/total-shards-per-node-calculation/294829)
**Author:** [@Ryan\_Downey](https://discuss.elastic.co/u/Ryan_Downey)\ **Replies:** 4\ **Last updated:** [January 24, 2022, 8:04pm UTC](https://discuss.elastic.co/t/total-shards-per-node-calculation/294829 "2022-01-24T20:04:57Z")
I've been working on Elastic for a while now but just wanted to do a quick check on learning that may also be useful to others. I've got a customer that would like 4 separate indices for logs. The only difference betwe… --- ## [Winlog beat set up returning the following error](https://discuss.elastic.co/t/winlog-beat-set-up-returning-the-following-error/294999)
**Author:** [@kgood517](https://discuss.elastic.co/u/kgood517)\ **Replies:** 1\ **Last updated:** [January 24, 2022, 6:46pm UTC](https://discuss.elastic.co/t/winlog-beat-set-up-returning-the-following-error/294999 "2022-01-24T18:46:27Z")
Hi all, I'm getting the following error trying to setup my winlogbeat following along the directions from Winlogbeat quick start: installation and configuration | Winlogbeat Reference \[7.16\] | Elastic. ERROR \[esclientle… --- ## [What happens to the original text field?](https://discuss.elastic.co/t/what-happens-to-the-original-text-field/295262)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 3\ **Last updated:** [January 24, 2022, 6:26pm UTC](https://discuss.elastic.co/t/what-happens-to-the-original-text-field/295262 "2022-01-24T18:26:49Z")
When we use custom or built-in analyzer in our mapping it just convert the stream of characters to stream of tokens. For example when we analyze the text like The QUICK brown foxes jumped over the dog!.Here i am using c… --- ## [Use Date Histogram to group data by day of the week](https://discuss.elastic.co/t/use-date-histogram-to-group-data-by-day-of-the-week/295255)
**Author:** [@TomTom](https://discuss.elastic.co/u/TomTom)\ **Replies:** 1\ **Last updated:** [January 24, 2022, 6:09pm UTC](https://discuss.elastic.co/t/use-date-histogram-to-group-data-by-day-of-the-week/295255 "2022-01-24T18:09:36Z")
My case is as follows, I am conducting a search for sales that occurred between 2021-12-23 to 2022-01-23, and I need to know the total sales by day of the week, regardless of the week and year. So I can theoretically kn… --- ## [Why does ClusterState class need need a data member named stateUUID?](https://discuss.elastic.co/t/why-does-clusterstate-class-need-need-a-data-member-named-stateuuid/295196)
**Author:** [@armsword](https://discuss.elastic.co/u/armsword)\ **Replies:** 1\ **Last updated:** [January 24, 2022, 5:48pm UTC](https://discuss.elastic.co/t/why-does-clusterstate-class-need-need-a-data-member-named-stateuuid/295196 "2022-01-24T17:48:05Z")
https://github.com/elastic/elasticsearch/blob/master/server/src/main/java/org/elasticsearch/cluster/ClusterState.java#L139 This class ClusterState has two data member, named stateUUID and version. The stateUUID is supp… --- ## [Elastic Search ILM implementation - Upsert issue](https://discuss.elastic.co/t/elastic-search-ilm-implementation-upsert-issue/295192)
**Author:** [@manikantavarma20](https://discuss.elastic.co/u/manikantavarma20)\ **Replies:** 1\ **Last updated:** [January 24, 2022, 2:23pm UTC](https://discuss.elastic.co/t/elastic-search-ilm-implementation-upsert-issue/295192 "2022-01-24T14:23:31Z")
We have 2 indices - "event" and "event-001" "event-001" is created by using ILM Both the indices have the same alias "event\_" It is used to fetch and update the data in the above 2 indices Query: GET event\_/alias R… --- ## [Control phase transition timings in ILM](https://discuss.elastic.co/t/control-phase-transition-timings-in-ilm/294904)
**Author:** [@inhinyera16](https://discuss.elastic.co/u/inhinyera16)\ **Replies:** 1\ **Last updated:** [January 24, 2022, 1:48pm UTC](https://discuss.elastic.co/t/control-phase-transition-timings-in-ilm/294904 "2022-01-24T13:48:45Z")
I'm trying to implement an ilm policy where the index will rollover every month or if the size reached 50GB. And since by default, ilm based the age in index creation date, and creating the index mid december means, we … --- ## [Replace Log4j from 2.x to 2.17.0 or later](https://discuss.elastic.co/t/replace-log4j-from-2-x-to-2-17-0-or-later/292897)
**Author:** [@marisubu](https://discuss.elastic.co/u/marisubu)\ **Replies:** 4\ **Last updated:** [January 24, 2022, 1:16pm UTC](https://discuss.elastic.co/t/replace-log4j-from-2-x-to-2-17-0-or-later/292897 "2022-01-24T13:16:53Z")
Our oldest products includes Elastic stack versions 5.2, 6.2.2 and 7.10.2. We're in situation that we can not perform elastic versions uplift to the latest/fixed versions. Can we replace Log4j 2.x versions with 2.17.x o… --- ## [CA generated without key using instances.yml](https://discuss.elastic.co/t/ca-generated-without-key-using-instances-yml/295221)
**Author:** [@Mamol27](https://discuss.elastic.co/u/Mamol27)\ **Replies:** 0\ **Last updated:** [January 24, 2022, 11:39am UTC](https://discuss.elastic.co/t/ca-generated-without-key-using-instances-yml/295221 "2022-01-24T11:39:34Z")
Hi! I tried to generate certificates like this How to Secure Elasticsearch Clusters - Completely and Effectively, but in folder ca I have got only ca.crt without key. It could be a problem if I need to add some certifica… --- ## [Update ELK 7.14 at 7.16](https://discuss.elastic.co/t/update-elk-7-14-at-7-16/295195)
**Author:** [@marc0069urca](https://discuss.elastic.co/u/marc0069urca)\ **Replies:** 1\ **Last updated:** [January 24, 2022, 10:16am UTC](https://discuss.elastic.co/t/update-elk-7-14-at-7-16/295195 "2022-01-24T10:16:34Z")
Hello, I wanted to know step by step in the order of the Elasticsearch machine to Kibana the implementation of a complete upgrade of an ELK , can you tell me the procedure to upgrade from our tool 7.14 to the current ve… --- ## [Export Elasticsearch Index to local](https://discuss.elastic.co/t/export-elasticsearch-index-to-local/295193)
**Author:** [@AsakaRin](https://discuss.elastic.co/u/AsakaRin)\ **Replies:** 1\ **Last updated:** [January 24, 2022, 9:54am UTC](https://discuss.elastic.co/t/export-elasticsearch-index-to-local/295193 "2022-01-24T09:54:36Z")
I want to make a clone database Elasticsearch from server to my local. I already have permission to access API and create snapshots but I can't access the server direct and download snapshots to my local. Is there any wa… --- ## [Custom Logs Ingest Pipeline](https://discuss.elastic.co/t/custom-logs-ingest-pipeline/294409)
**Author:** [@jsteenkamp](https://discuss.elastic.co/u/jsteenkamp)\ **Replies:** 8\ **Last updated:** [January 24, 2022, 9:34am UTC](https://discuss.elastic.co/t/custom-logs-ingest-pipeline/294409 "2022-01-24T09:34:47Z")
@ruflin This is more or less a duplicate of Fleet Custom Logs Ingest Pipeline, but I still find it hard to figure out which steps I have to follow. I would really appreciate better documentation or some useful direction… --- ## [Right order to stop ELK](https://discuss.elastic.co/t/right-order-to-stop-elk/295199)
**Author:** [@Ram\_N](https://discuss.elastic.co/u/Ram_N)\ **Replies:** 1\ **Last updated:** [January 24, 2022, 9:01am UTC](https://discuss.elastic.co/t/right-order-to-stop-elk/295199 "2022-01-24T09:01:19Z")
Hi What is the recommended to stop Elasticsearch, logstash, kibana? Which should be stopped first? At times if Elasticsearch is stopped first, logstash is trying to establish connection and logstash is not getting stopp… --- ## [ElasticSearch won't search specific field](https://discuss.elastic.co/t/elasticsearch-wont-search-specific-field/295201)
**Author:** [@bert\_coenen](https://discuss.elastic.co/u/bert_coenen)\ **Replies:** 0\ **Last updated:** [January 24, 2022, 8:59am UTC](https://discuss.elastic.co/t/elasticsearch-wont-search-specific-field/295201 "2022-01-24T08:59:30Z")
I have a problem searching a specific field inside my index. little background: On my project we need to search inside a terminology Server like FHIR but then our own. So we have an object that contains a Code (123564/… --- ## [Number of shards and deployment sizing](https://discuss.elastic.co/t/number-of-shards-and-deployment-sizing/294618)
**Author:** [@yelloyonder](https://discuss.elastic.co/u/yelloyonder)\ **Replies:** 4\ **Last updated:** [January 24, 2022, 8:57am UTC](https://discuss.elastic.co/t/number-of-shards-and-deployment-sizing/294618 "2022-01-24T08:57:26Z")
We have created a small deployment on Elastic Cloud which we are testing with non-live data. Reading this blog post How many shards should I have in my Elasticsearch cluster? | Elastic Blog it suggests approximately 20 … --- ## [Getting 502 bad gateway error while creating new index](https://discuss.elastic.co/t/getting-502-bad-gateway-error-while-creating-new-index/295183)
**Author:** [@Nikhil\_Sonkar](https://discuss.elastic.co/u/Nikhil_Sonkar)\ **Replies:** 3\ **Last updated:** [January 24, 2022, 8:23am UTC](https://discuss.elastic.co/t/getting-502-bad-gateway-error-while-creating-new-index/295183 "2022-01-24T08:23:54Z")
502 Bad Gateway 502 Bad Gateway --- ## [Users password expiration or blocked accounts](https://discuss.elastic.co/t/users-password-expiration-or-blocked-accounts/295086)
**Author:** [@d.silwon](https://discuss.elastic.co/u/d.silwon)\ **Replies:** 6\ **Last updated:** [January 24, 2022, 6:35am UTC](https://discuss.elastic.co/t/users-password-expiration-or-blocked-accounts/295086 "2022-01-24T06:35:23Z")
Dears, In our Elastic cluster we have few local users which login to Kibana for browsing indexes with applications logs. Twice a week two users reports me problems with login to Kibana. After password reset these users… --- ## [How to migrate all dashboard, visualization, map, template, kibana settings data?](https://discuss.elastic.co/t/how-to-migrate-all-dashboard-visualization-map-template-kibana-settings-data/295173)
**Author:** [@wajika](https://discuss.elastic.co/u/wajika)\ **Replies:** 7\ **Last updated:** [January 24, 2022, 6:31am UTC](https://discuss.elastic.co/t/how-to-migrate-all-dashboard-visualization-map-template-kibana-settings-data/295173 "2022-01-24T06:31:28Z")
I want to completely migrate the data of the 7.12 cluster to the 7.16 cluster, including all the data, which can be understood as mirroring. I suspect that the data on kibana is all on the kibana index. If it is copied … --- ## [Why do i see multiple nodes in the data folder](https://discuss.elastic.co/t/why-do-i-see-multiple-nodes-in-the-data-folder/295040)
**Author:** [@Saravana37](https://discuss.elastic.co/u/Saravana37)\ **Replies:** 4\ **Last updated:** [January 24, 2022, 5:49am UTC](https://discuss.elastic.co/t/why-do-i-see-multiple-nodes-in-the-data-folder/295040 "2022-01-24T05:49:49Z")
Hello , I have upgraded Elasticsearch last month twice to fix log4j vulnerability . In EMEA i see only one folder and used disk space is 400GB. But in NAFTA i see 3 folders under node and overall it is consuming 750GB w… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=504) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=506)