# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=507 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 508 --- ## [Bind errors on startup](https://discuss.elastic.co/t/bind-errors-on-startup/294886)
**Author:** [@Russell\_Fulton](https://discuss.elastic.co/u/Russell_Fulton)\ **Replies:** 2\ **Last updated:** [January 20, 2022, 7:39pm UTC](https://discuss.elastic.co/t/bind-errors-on-startup/294886 "2022-01-20T19:39:23Z")
I am adding a new node to the cluster for the first time and I get the following error: \[2022-01-20T12:56:40,832\]\[INFO \]\[o.e.x.d.l.DeprecationIndexingComponent\] \[secmonprd01\] deprecation component started \[2022-01-20T12… --- ## [Elastic Stack Architecture](https://discuss.elastic.co/t/elastic-stack-architecture/294849)
**Author:** [@baddack](https://discuss.elastic.co/u/baddack)\ **Replies:** 4\ **Last updated:** [January 20, 2022, 5:04pm UTC](https://discuss.elastic.co/t/elastic-stack-architecture/294849 "2022-01-20T17:04:56Z")
Hello everyone, /!\\ NB: First I would say that I am really really sorry for the ASCII Art but I can't upload images since this morning and I don't know why. :sweat\_smile: I read a lot about how an Elastic cluster shoul… --- ## [Upgrade elastic agent trough Fleet server fails](https://discuss.elastic.co/t/upgrade-elastic-agent-trough-fleet-server-fails/294717)
**Author:** [@Mr.Winter](https://discuss.elastic.co/u/Mr.Winter)\ **Replies:** 1\ **Last updated:** [January 20, 2022, 5:02pm UTC](https://discuss.elastic.co/t/upgrade-elastic-agent-trough-fleet-server-fails/294717 "2022-01-20T17:02:45Z")
Hi Folks, we are running a ELK Stack in version 7.16 with several elastic-agents managed by the fleet server. After we upgraded to 7.16 the elastic-agents needs to be upgraded also. Some upgrades for several elastic… --- ## [Directories of indices in Backup Storage](https://discuss.elastic.co/t/directories-of-indices-in-backup-storage/294958)
**Author:** [@ttttien](https://discuss.elastic.co/u/ttttien)\ **Replies:** 1\ **Last updated:** [January 20, 2022, 4:48pm UTC](https://discuss.elastic.co/t/directories-of-indices-in-backup-storage/294958 "2022-01-20T16:48:59Z")
Hello everyone, I would like to know that if there are a method to verify what folder in the Backup Storage that correspondent with each index in Elasticsearch: For example: consider 3 index "audit\_trail", "index\_log"… --- ## [Error while doing suggest query for java-client](https://discuss.elastic.co/t/error-while-doing-suggest-query-for-java-client/294828)
**Author:** [@2393747135](https://discuss.elastic.co/u/2393747135)\ **Replies:** 3\ **Last updated:** [January 20, 2022, 4:07pm UTC](https://discuss.elastic.co/t/error-while-doing-suggest-query-for-java-client/294828 "2022-01-20T16:07:03Z")
Regarding the java-client of suguest, the prompts need to be as follows when using: Missing required property 'TermSuggestOption.score Below is my code SearchResponse\ se… --- ## [Elastic users api: beginner questions](https://discuss.elastic.co/t/elastic-users-api-beginner-questions/294901)
**Author:** [@Emile\_Plas](https://discuss.elastic.co/u/Emile_Plas)\ **Replies:** 0\ **Last updated:** [January 20, 2022, 7:24am UTC](https://discuss.elastic.co/t/elastic-users-api-beginner-questions/294901 "2022-01-20T07:24:38Z")
Hey everyone! I am quite new to Elasticsearch and I have some beginners questions, please forgive me. I hope you can shortly take the time to validate my questions regarding the elastic users API. I am currently buildi… --- ## [Can I improve this aggregation query?](https://discuss.elastic.co/t/can-i-improve-this-aggregation-query/294843)
**Author:** [@elasticshane](https://discuss.elastic.co/u/elasticshane)\ **Replies:** 3\ **Last updated:** [January 20, 2022, 3:49pm UTC](https://discuss.elastic.co/t/can-i-improve-this-aggregation-query/294843 "2022-01-20T15:49:34Z")
Hello, I'm quite new to Elasticsearch, but have made some progress with a query, and I'd really appreciate your feedback/ideas about how I've approached my requirement. Introduction/Mappings I'm writing a query to det… --- ## [Remove duplicate tokens after edge\_ngram on array](https://discuss.elastic.co/t/remove-duplicate-tokens-after-edge-ngram-on-array/294945)
**Author:** [@timon](https://discuss.elastic.co/u/timon)\ **Replies:** 2\ **Last updated:** [January 20, 2022, 3:31pm UTC](https://discuss.elastic.co/t/remove-duplicate-tokens-after-edge-ngram-on-array/294945 "2022-01-20T15:31:41Z")
I have a field where multiple values are stored: field: \["testOneTwo", "testThreeFour"\] I would like to analyze this field with an edge\_ngram filter, but also remove duplicate tokens. I tried the unique and remove\_dupl… --- ## [Generating shingles with synonyms in Elasticsearch](https://discuss.elastic.co/t/generating-shingles-with-synonyms-in-elasticsearch/294964)
**Author:** [@Yawan\_Gupta](https://discuss.elastic.co/u/Yawan_Gupta)\ **Replies:** 0\ **Last updated:** [January 20, 2022, 2:58pm UTC](https://discuss.elastic.co/t/generating-shingles-with-synonyms-in-elasticsearch/294964 "2022-01-20T14:58:09Z")
I have a file of alternate spellings for the terms in my index. I want to produce bigrams containing those alternate spellings for particular terms. For example, I have biriyani, biryani, briyani in my alternate spelling… --- ## [The error response for search\_geometry query with ES 6.7.2](https://discuss.elastic.co/t/the-error-response-for-search-geometry-query-with-es-6-7-2/294914)
**Author:** [@Eduardo\_Montes](https://discuss.elastic.co/u/Eduardo_Montes)\ **Replies:** 1\ **Last updated:** [January 20, 2022, 2:37pm UTC](https://discuss.elastic.co/t/the-error-response-for-search-geometry-query-with-es-6-7-2/294914 "2022-01-20T14:37:46Z")
Hello, I sent the search\_geometry query to ES V6.7.2 and got error (see below). With another ES server V6.2.4 I got correct response without error. Is there any bug in version 6.7.2? Or could be this error caused by the… --- ## [Logstash EVTX Ingestion](https://discuss.elastic.co/t/logstash-evtx-ingestion/294947)
**Author:** [@rusty\_cole](https://discuss.elastic.co/u/rusty_cole)\ **Replies:** 0\ **Last updated:** [January 20, 2022, 1:00pm UTC](https://discuss.elastic.co/t/logstash-evtx-ingestion/294947 "2022-01-20T13:00:22Z")
Hi Guys, Is there a way to ingest cold EVTX files with logstash? The reason I am asking, is that winlogbeat is really slow. I have big files, some of them takes hours to upload into ELK with winlogbeat. Thanks --- ## [Updating a mapping in existing indicese](https://discuss.elastic.co/t/updating-a-mapping-in-existing-indicese/294918)
**Author:** [@pruttle](https://discuss.elastic.co/u/pruttle)\ **Replies:** 6\ **Last updated:** [January 20, 2022, 11:14am UTC](https://discuss.elastic.co/t/updating-a-mapping-in-existing-indicese/294918 "2022-01-20T11:14:42Z")
Hi I have added a new mapping to an Index Template and it is updating new Indices as they are created. I need to update all the pre-existing retrospective Indices with the new mapping. What is the best approach to this… --- ## [ES sort in server end when given fileds are equal](https://discuss.elastic.co/t/es-sort-in-server-end-when-given-fileds-are-equal/294517)
**Author:** [@LIU\_HAI](https://discuss.elastic.co/u/LIU_HAI)\ **Replies:** 4\ **Last updated:** [January 20, 2022, 11:04am UTC](https://discuss.elastic.co/t/es-sort-in-server-end-when-given-fileds-are-equal/294517 "2022-01-20T11:04:53Z")
Very simple case, I need to sort docs by one field, say, 'money'. What will the order be if the money of several docs are equal. I use filter to query cuz scores are not necessary. Here's my query example: GET /index/\_s… --- ## [NEST - Create a custom function score to use a custom plugin](https://discuss.elastic.co/t/nest-create-a-custom-function-score-to-use-a-custom-plugin/294935)
**Author:** [@SimNightmare](https://discuss.elastic.co/u/SimNightmare)\ **Replies:** 0\ **Last updated:** [January 20, 2022, 10:52am UTC](https://discuss.elastic.co/t/nest-create-a-custom-function-score-to-use-a-custom-plugin/294935 "2022-01-20T10:52:49Z")
Hi, We are migrating our application from NEST 6 to NEST 7.13.2 and now we can't call our plugin score function the way we do before. So with NEST 6 we have a function extending FunctionScoreFunctionBase, and with that… --- ## [Migration to Elasticsearch 6 : request with script and params not working](https://discuss.elastic.co/t/migration-to-elasticsearch-6-request-with-script-and-params-not-working/294570)
**Author:** [@drapej](https://discuss.elastic.co/u/drapej)\ **Replies:** 2\ **Last updated:** [January 20, 2022, 10:50am UTC](https://discuss.elastic.co/t/migration-to-elasticsearch-6-request-with-script-and-params-not-working/294570 "2022-01-20T10:50:04Z")
Hello, I am migrating my Elasticsearch from v5.16 to 6.8 (and after to 7.16) but I have some problem with this type of request (see below) : using params\['\_source'\] in a script I don't understand why. I didn't find any… --- ## [Elastic search not starting](https://discuss.elastic.co/t/elastic-search-not-starting/294789)
**Author:** [@rohit45](https://discuss.elastic.co/u/rohit45)\ **Replies:** 12\ **Last updated:** [January 20, 2022, 9:49am UTC](https://discuss.elastic.co/t/elastic-search-not-starting/294789 "2022-01-20T09:49:53Z")
at org.elasticsearch.bootstrap.Bootstrap$5.\(Bootstrap.java:234) ~\[elasticsearch-7.16.3.jar:7.16.3\] at org.elasticsearch.bootstrap.Bootstrap.setup(Bootstrap.java:234) ~\[elasticsearch-7.16.3.jar:7.16… --- ## [Is there a list of files that get changes for account creation/disabling, login and connection attempts as well as api calls etc. for ELK?](https://discuss.elastic.co/t/is-there-a-list-of-files-that-get-changes-for-account-creation-disabling-login-and-connection-attempts-as-well-as-api-calls-etc-for-elk/294005)
**Author:** [@Huseyin\_Tunctepe](https://discuss.elastic.co/u/Huseyin_Tunctepe)\ **Replies:** 2\ **Last updated:** [January 20, 2022, 9:24am UTC](https://discuss.elastic.co/t/is-there-a-list-of-files-that-get-changes-for-account-creation-disabling-login-and-connection-attempts-as-well-as-api-calls-etc-for-elk/294005 "2022-01-20T09:24:42Z")
How are creating/disabling an Elasticsearch account, logging in to Elasticsearch, network connection to ELK or API calls are logged? Also, interested to know if there is a ELK specific audit logging. The purpose of thi… --- ## [Irrelevant field search results](https://discuss.elastic.co/t/irrelevant-field-search-results/293188)
**Author:** [@ethical20](https://discuss.elastic.co/u/ethical20)\ **Replies:** 10\ **Last updated:** [January 20, 2022, 9:12am UTC](https://discuss.elastic.co/t/irrelevant-field-search-results/293188 "2022-01-20T09:12:58Z")
Hi, I've made this Lucene query in Kibana to search if Nginx access logs contain a URL with the word "malware": source.as.organization.name: (/.\*\[Mm\]\[Aa\]\[Ll\]\[Ww\]\[Aa\]\[Rr\]\[Ee\].\*/) But in Kibana I'm getting the results … --- ## [ES 7.16.0 and 7.16.1 Upgrade single node health yellow](https://discuss.elastic.co/t/es-7-16-0-and-7-16-1-upgrade-single-node-health-yellow/291875)
**Author:** [@VamPikmin](https://discuss.elastic.co/u/VamPikmin)\ **Replies:** 1\ **Last updated:** [January 20, 2022, 8:26am UTC](https://discuss.elastic.co/t/es-7-16-0-and-7-16-1-upgrade-single-node-health-yellow/291875 "2022-01-20T08:26:01Z")
Hello boys and girls I have a single ES node which has one index turn yellow curl -XGET localhost:9200/\_cat/health 1639519203 22:00:03 ndelastic yellow 1 1 317 317 0 0 1 0 - 99.7% curl -XGET localhost:9200/\_cluster/a… --- ## [Elasticsearch CCR synchronization](https://discuss.elastic.co/t/elasticsearch-ccr-synchronization/294902)
**Author:** [@fabry](https://discuss.elastic.co/u/fabry)\ **Replies:** 0\ **Last updated:** [January 20, 2022, 7:43am UTC](https://discuss.elastic.co/t/elasticsearch-ccr-synchronization/294902 "2022-01-20T07:43:49Z")
I have a couple of questions about how the CCR works. Does it uses a polling strategy? or whenever there is a new log it will be pushed to the remote cluster? In case is a polling strategy how can reduce the polling de… --- ## [Installable plugin checkbox disabled in Elastic Cloud due to subscription level](https://discuss.elastic.co/t/installable-plugin-checkbox-disabled-in-elastic-cloud-due-to-subscription-level/294899)
**Author:** [@likejazz](https://discuss.elastic.co/u/likejazz)\ **Replies:** 1\ **Last updated:** [January 20, 2022, 7:36am UTC](https://discuss.elastic.co/t/installable-plugin-checkbox-disabled-in-elastic-cloud-due-to-subscription-level/294899 "2022-01-20T07:36:02Z")
Same question here: I have ENTERPRISE subscription level in Elastic Cloud and cannot install custom plugin due to disabled option as shown above. https://cloud.elastic.co/deployment-features/extensions/create The m… --- ## [Upgrade of elastic, name of indices and data streams](https://discuss.elastic.co/t/upgrade-of-elastic-name-of-indices-and-data-streams/294850)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 6\ **Last updated:** [January 20, 2022, 7:27am UTC](https://discuss.elastic.co/t/upgrade-of-elastic-name-of-indices-and-data-streams/294850 "2022-01-20T07:27:05Z")
Hi, we have installed version 7.5 of the stack and we want to upgrade to the latest version, but our custom indexes are already called: metrics-\ example : metrics-interfaces . what problems could ari… --- ## [How to get meassages and send them by email](https://discuss.elastic.co/t/how-to-get-meassages-and-send-them-by-email/294893)
**Author:** [@rrrr](https://discuss.elastic.co/u/rrrr)\ **Replies:** 3\ **Last updated:** [January 20, 2022, 7:09am UTC](https://discuss.elastic.co/t/how-to-get-meassages-and-send-them-by-email/294893 "2022-01-20T07:09:49Z")
In the watcher, how to get all messages and send them by email --- ## [Need help to understand how standard tokenizer works](https://discuss.elastic.co/t/need-help-to-understand-how-standard-tokenizer-works/294860)
**Author:** [@jsjs2](https://discuss.elastic.co/u/jsjs2)\ **Replies:** 1\ **Last updated:** [January 20, 2022, 1:12am UTC](https://discuss.elastic.co/t/need-help-to-understand-how-standard-tokenizer-works/294860 "2022-01-20T01:12:42Z")
In the following two examples, I had hard time to understand why the outputs are different: POST \_analyze { "tokenizer": "standard", "text": "mark.cuban" } terms produced: \["mark.cuban"\] POST \_analyze { "tokeniz… --- ## [GROK | Problem ingest Pipeline | replace](https://discuss.elastic.co/t/grok-problem-ingest-pipeline-replace/294881)
**Author:** [@Walli](https://discuss.elastic.co/u/Walli)\ **Replies:** 1\ **Last updated:** [January 20, 2022, 12:59am UTC](https://discuss.elastic.co/t/grok-problem-ingest-pipeline-replace/294881 "2022-01-20T00:59:19Z")
Hello, I am new in the Commutiy and new in the topic GROK. I have a message where I want to replace a certain string. The problem the string contains the GROK meta character ^. The whole thing is supposed to happen in… --- ## [QueryCacheMemorySize increased to 9.2EB then dropped to 0. How to debug QueryCache issues?](https://discuss.elastic.co/t/querycachememorysize-increased-to-9-2eb-then-dropped-to-0-how-to-debug-querycache-issues/294885)
**Author:** [@ztesky](https://discuss.elastic.co/u/ztesky)\ **Replies:** 0\ **Last updated:** [January 19, 2022, 11:41pm UTC](https://discuss.elastic.co/t/querycachememorysize-increased-to-9-2eb-then-dropped-to-0-how-to-debug-querycache-issues/294885 "2022-01-19T23:41:57Z")
I'm using Elasticsearch version 6.3 in production. We have a shard with size \> 200GB in a data node. Recently, we did a "cluster reroute" wherein we moved this shard from node A (which had QueryCacheMemorySize = 3GB) to … --- ## [Configuring SSL over http](https://discuss.elastic.co/t/configuring-ssl-over-http/294883)
**Author:** [@jayjayp2](https://discuss.elastic.co/u/jayjayp2)\ **Replies:** 0\ **Last updated:** [January 19, 2022, 11:09pm UTC](https://discuss.elastic.co/t/configuring-ssl-over-http/294883 "2022-01-19T23:09:50Z")
Hi, I'm new to Elasticsearch. I couldn't find an existing post. I'm trying to setup ssl over http. I have a .p12 file that is trusted over our network. I set: xpack.security.http.ssl.enabled: true xpack.security.http.s… --- ## [Mget too slow for large amount of documents](https://discuss.elastic.co/t/mget-too-slow-for-large-amount-of-documents/294586)
**Author:** [@Benjamin\_Elkrieff](https://discuss.elastic.co/u/Benjamin_Elkrieff)\ **Replies:** 8\ **Last updated:** [January 19, 2022, 9:26pm UTC](https://discuss.elastic.co/t/mget-too-slow-for-large-amount-of-documents/294586 "2022-01-19T21:26:16Z")
Hello There. I use opensearch on AWS to store embeddings generated by a ML model. We need to use it for similarity search. I use 5 nodes of 4 CPU, 8 GB Ram, 1 shard per index, 5 replicas. The data we currently have in … --- ## [Move elasticsearch data from frozen tier back to cold or warm tier](https://discuss.elastic.co/t/move-elasticsearch-data-from-frozen-tier-back-to-cold-or-warm-tier/294874)
**Author:** [@dimitris\_sb](https://discuss.elastic.co/u/dimitris_sb)\ **Replies:** 0\ **Last updated:** [January 19, 2022, 8:38pm UTC](https://discuss.elastic.co/t/move-elasticsearch-data-from-frozen-tier-back-to-cold-or-warm-tier/294874 "2022-01-19T20:38:06Z")
Hi All, How do you handle cases that you have already applied ILM policy to a set of indices (by its legacy index template) and you revise your strategy and you want to move data which are in the frozen tier back to co… --- ## [Combined\_fields + dfs\_query\_then\_fetch causes error](https://discuss.elastic.co/t/combined-fields-dfs-query-then-fetch-causes-error/294410)
**Author:** [@cyradin](https://discuss.elastic.co/u/cyradin)\ **Replies:** 2\ **Last updated:** [January 19, 2022, 5:04pm UTC](https://discuss.elastic.co/t/combined-fields-dfs-query-then-fetch-causes-error/294410 "2022-01-19T17:04:46Z")
Using combined\_fields query with dfs\_query\_then\_fetch causes "docCount must not exceed maxDoc" error if the request goes to multiple shards. Quick example to reproduce the issue (Elasticsearch v7.13.4, v7.15.0) PUT /my… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=506) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=508)