# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=508 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 509 --- ## [Winlogbeat Manual EVTX Upload - Performance](https://discuss.elastic.co/t/winlogbeat-manual-evtx-upload-performance/294840)
**Author:** [@rusty\_cole](https://discuss.elastic.co/u/rusty_cole)\ **Replies:** 0\ **Last updated:** [January 19, 2022, 3:16pm UTC](https://discuss.elastic.co/t/winlogbeat-manual-evtx-upload-performance/294840 "2022-01-19T15:16:35Z")
Hi Guys, I am using winlogbeat on a regular basis to upload multiple evtx files to elastic(with powershell). The problem is that sometimes it takes a very long time for the upload to complete(hours). Is there a way to… --- ## [How to decrypt data who are encrypted in postgres and pass them to elastic before indexing them](https://discuss.elastic.co/t/how-to-decrypt-data-who-are-encrypted-in-postgres-and-pass-them-to-elastic-before-indexing-them/294852)
**Author:** [@Albi\_Zeqollari](https://discuss.elastic.co/u/Albi_Zeqollari)\ **Replies:** 0\ **Last updated:** [January 19, 2022, 4:19pm UTC](https://discuss.elastic.co/t/how-to-decrypt-data-who-are-encrypted-in-postgres-and-pass-them-to-elastic-before-indexing-them/294852 "2022-01-19T16:19:16Z")
Some examples pls! --- ## [Is there any way to get more than one field from an aggregation?](https://discuss.elastic.co/t/is-there-any-way-to-get-more-than-one-field-from-an-aggregation/294741)
**Author:** [@Maxi\_Donadio](https://discuss.elastic.co/u/Maxi_Donadio)\ **Replies:** 4\ **Last updated:** [January 19, 2022, 2:56pm UTC](https://discuss.elastic.co/t/is-there-any-way-to-get-more-than-one-field-from-an-aggregation/294741 "2022-01-19T14:56:01Z")
Hi! I need to know if it's possible to get more than one value from an aggregation. If I were to write my desired query as SQL it'd be something like: SELECT value1, value2, value3 FROM table WHERE condition. I'd like t… --- ## [Could not find or load main class org.elasticsearch.bootstrap.Elasticsearch Caused by: java.lang.ClassNotFoundException: org.elasticsearch.bootstrap.Elasticsearch](https://discuss.elastic.co/t/could-not-find-or-load-main-class-org-elasticsearch-bootstrap-elasticsearch-caused-by-java-lang-classnotfoundexception-org-elasticsearch-bootstrap-elasticsearch/293451)
**Author:** [@Vivek\_Paralikar](https://discuss.elastic.co/u/Vivek_Paralikar)\ **Replies:** 2\ **Last updated:** [January 19, 2022, 1:44pm UTC](https://discuss.elastic.co/t/could-not-find-or-load-main-class-org-elasticsearch-bootstrap-elasticsearch-caused-by-java-lang-classnotfoundexception-org-elasticsearch-bootstrap-elasticsearch/293451 "2022-01-19T13:44:57Z")
Starting Elasticsearch Server Error: Could not find or load main class org.… --- ## [Troubles starting elasticsearch.service after the upgrade from 6.8.22 to 7.14.2](https://discuss.elastic.co/t/troubles-starting-elasticsearch-service-after-the-upgrade-from-6-8-22-to-7-14-2/294664)
**Author:** [@Penchev](https://discuss.elastic.co/u/Penchev)\ **Replies:** 4\ **Last updated:** [January 19, 2022, 12:35pm UTC](https://discuss.elastic.co/t/troubles-starting-elasticsearch-service-after-the-upgrade-from-6-8-22-to-7-14-2/294664 "2022-01-19T12:35:26Z")
Hi Folks, I have troubles starting Elasticsearch.service after the upgrade from 6.8.22 to 7.14.2. The errors are related to: failed to load plugin class \[org.Elasticsearch.xpack.security.Security\] Realm settings have… --- ## [Elasticsearch CCR, former follower (leader) index is not writable](https://discuss.elastic.co/t/elasticsearch-ccr-former-follower-leader-index-is-not-writable/292962)
**Author:** [@Armen\_Petrosyan](https://discuss.elastic.co/u/Armen_Petrosyan)\ **Replies:** 1\ **Last updated:** [January 19, 2022, 12:29pm UTC](https://discuss.elastic.co/t/elasticsearch-ccr-former-follower-leader-index-is-not-writable/292962 "2022-01-19T12:29:58Z")
I use ES 7.7.1 Below UC that I am trying to test: I have two clusters leader and follower. On leader I have created index, and alias. Starting follow process, I see that index replicated to the follower as well as ali… --- ## [How to update query on multiple indexes](https://discuss.elastic.co/t/how-to-update-query-on-multiple-indexes/294724)
**Author:** [@pk5859](https://discuss.elastic.co/u/pk5859)\ **Replies:** 3\ **Last updated:** [January 19, 2022, 12:08pm UTC](https://discuss.elastic.co/t/how-to-update-query-on-multiple-indexes/294724 "2022-01-19T12:08:49Z")
I have 3 indexes A, B & C i want to update on all three indexes. However python client.update() syntax won't allow it. \_index="A","B","C" query = {"doc": {"cluster":"1" }} client.update(index=\_index, id=id, body=quer… --- ## [Elasticsearch log parser](https://discuss.elastic.co/t/elasticsearch-log-parser/294807)
**Author:** [@dominbdg](https://discuss.elastic.co/u/dominbdg)\ **Replies:** 0\ **Last updated:** [January 19, 2022, 11:55am UTC](https://discuss.elastic.co/t/elasticsearch-log-parser/294807 "2022-01-19T11:55:56Z")
Hello, I'm using latest ubuntu Linux, and I would to ask You which is the best log reader for logs from for example Elasticsearch logs - I'm using Atom as log editor but don't cover my expectations. I would like to ask… --- ## [Elasticsearch behind NAT](https://discuss.elastic.co/t/elasticsearch-behind-nat/294773)
**Author:** [@rudyawall](https://discuss.elastic.co/u/rudyawall)\ **Replies:** 1\ **Last updated:** [January 19, 2022, 11:37am UTC](https://discuss.elastic.co/t/elasticsearch-behind-nat/294773 "2022-01-19T11:37:44Z")
Hi Everybody, I already installed the elasticserach but behind the NAT, i'm using google cloud I wanna configuration elasticserach can access from external network, using 0.0.0.0 but always failed to connect when Iam … --- ## [Elasticsearch modules' releases and repositories](https://discuss.elastic.co/t/elasticsearch-modules-releases-and-repositories/294601)
**Author:** [@bamthomas](https://discuss.elastic.co/u/bamthomas)\ **Replies:** 7\ **Last updated:** [January 19, 2022, 10:57am UTC](https://discuss.elastic.co/t/elasticsearch-modules-releases-and-repositories/294601 "2022-01-19T10:57:54Z")
Hello, We have an embedded node in our java app and 5 modules that are loaded : Netty4 ParentJoin CommonAnalysis Painless Reindex Lately we wanted to upgrade the ES libraries from 7.10 to 7.16. We found the main Elas… --- ## [Error: Invalid string. Length must be a multiple of 4](https://discuss.elastic.co/t/error-invalid-string-length-must-be-a-multiple-of-4/293201)
**Author:** [@mohantychandra](https://discuss.elastic.co/u/mohantychandra)\ **Replies:** 13\ **Last updated:** [January 19, 2022, 10:56am UTC](https://discuss.elastic.co/t/error-invalid-string-length-must-be-a-multiple-of-4/293201 "2022-01-19T10:56:11Z")
Hi Can anyone help to resolve the issue, Any comment is much appreciated. The issue and log is given below. Invalid string. Length must be a multiple of 4 Error: Invalid string. Length must be a multiple of 4 --- ## [Elasticsearchkeystore](https://discuss.elastic.co/t/elasticsearchkeystore/294797)
**Author:** [@harsh19](https://discuss.elastic.co/u/harsh19)\ **Replies:** 0\ **Last updated:** [January 19, 2022, 10:49am UTC](https://discuss.elastic.co/t/elasticsearchkeystore/294797 "2022-01-19T10:49:09Z")
whenever i type ./Elasticsearch-setup-passwords auto then it gives me an error like this Enter password for the elasticsearch keystore : Failed to authenticate user 'elastic' against http://127.0.0.1:9200/\_security/\_… --- ## [Nested time ranges and term in one filter](https://discuss.elastic.co/t/nested-time-ranges-and-term-in-one-filter/294392)
**Author:** [@D1sturbance](https://discuss.elastic.co/u/D1sturbance)\ **Replies:** 9\ **Last updated:** [January 19, 2022, 9:42am UTC](https://discuss.elastic.co/t/nested-time-ranges-and-term-in-one-filter/294392 "2022-01-19T09:42:20Z")
Hello :slight\_smile: My data: shops working hours shops with each of their working hours I have a query which returns shops from first day of the month to last day of the month including working hours. For example: … --- ## [Request to close index fails due to socket timeout](https://discuss.elastic.co/t/request-to-close-index-fails-due-to-socket-timeout/294687)
**Author:** [@Shubham\_M](https://discuss.elastic.co/u/Shubham_M)\ **Replies:** 13\ **Last updated:** [January 19, 2022, 9:08am UTC](https://discuss.elastic.co/t/request-to-close-index-fails-due-to-socket-timeout/294687 "2022-01-19T09:08:42Z")
Scenario: We create new index on daily basis so as to keep the data in the index updated.After creation of new index when close request is made,it times out with Socket failure execption. { class: "org.quartz.simpl.Sim… --- ## [How to determine the correct size for terms aggregation, which will produce accurate aggregation results?](https://discuss.elastic.co/t/how-to-determine-the-correct-size-for-terms-aggregation-which-will-produce-accurate-aggregation-results/294771)
**Author:** [@Nishikant\_Tayade](https://discuss.elastic.co/u/Nishikant_Tayade)\ **Replies:** 3\ **Last updated:** [January 19, 2022, 8:27am UTC](https://discuss.elastic.co/t/how-to-determine-the-correct-size-for-terms-aggregation-which-will-produce-accurate-aggregation-results/294771 "2022-01-19T08:27:13Z")
As I read through document for Terms Aggregation, I came across the fact that the results from Term Aggregation are not always accurate, but we can increase the size to get the accurate results. I know : - How Query-T… --- ## [Circular data overwriting](https://discuss.elastic.co/t/circular-data-overwriting/294768)
**Author:** [@jelns](https://discuss.elastic.co/u/jelns)\ **Replies:** 2\ **Last updated:** [January 19, 2022, 7:51am UTC](https://discuss.elastic.co/t/circular-data-overwriting/294768 "2022-01-19T07:51:38Z")
Hi. Is it possible to cyclically overwrite data in Elasticsearch storage (as Round-robin databases do)? For instance, when the storage is full, new data will overwrite the oldest. Maybe there are some way to organize th… --- ## [Doc\_values: false Not effective?](https://discuss.elastic.co/t/doc-values-false-not-effective/294760)
**Author:** [@S-Dragon0302](https://discuss.elastic.co/u/S-Dragon0302)\ **Replies:** 1\ **Last updated:** [January 19, 2022, 4:00am UTC](https://discuss.elastic.co/t/doc-values-false-not-effective/294760 "2022-01-19T04:00:22Z")
Elasticsearch version:7.15.1 { - "contentindex\_2m\_20211109\_1412": { - "mappings": { - "dynamic": "false", "\_source": { - "enabled": false }, "properties": { - "ContentHtml": { - "type": "keyword", "doc\_values"… --- ## [Setting up basic security plus secured HTTP Traffic](https://discuss.elastic.co/t/setting-up-basic-security-plus-secured-http-traffic/294735)
**Author:** [@Akhil2](https://discuss.elastic.co/u/Akhil2)\ **Replies:** 0\ **Last updated:** [January 18, 2022, 8:43pm UTC](https://discuss.elastic.co/t/setting-up-basic-security-plus-secured-http-traffic/294735 "2022-01-18T20:43:19Z")
Hello all, I have a three node implementation cluster for Elastic stack on three different VMs and I am using version 7.16.2 with basic license. I have set up two layers of security and working on the last one which is … --- ## [Switching from index names to alias - performance impact?](https://discuss.elastic.co/t/switching-from-index-names-to-alias-performance-impact/294633)
**Author:** [@sale](https://discuss.elastic.co/u/sale)\ **Replies:** 4\ **Last updated:** [January 18, 2022, 8:50pm UTC](https://discuss.elastic.co/t/switching-from-index-names-to-alias-performance-impact/294633 "2022-01-18T20:50:53Z")
We use Elasticsearch for time series data with indices created every day. We perform all operations (ingest, search etc) using the REST APIs. We keep 60-days worth of data available to query. Currently, when we do searc… --- ## [Docker-Compose and ELK, inaccessable from web](https://discuss.elastic.co/t/docker-compose-and-elk-inaccessable-from-web/294728)
**Author:** [@userR](https://discuss.elastic.co/u/userR)\ **Replies:** 0\ **Last updated:** [January 18, 2022, 7:01pm UTC](https://discuss.elastic.co/t/docker-compose-and-elk-inaccessable-from-web/294728 "2022-01-18T19:01:39Z")
Below is my Docker-Compose file, I can't seem to access it when I type in the port and IP. version: '2.2' services: elasticsearch: image: docker.elastic.co/elasticsearch/elasticsearch:7.16.2 container\_name: el… --- ## [Exclude master node from query user operations - how?](https://discuss.elastic.co/t/exclude-master-node-from-query-user-operations-how/294636)
**Author:** [@sale](https://discuss.elastic.co/u/sale)\ **Replies:** 6\ **Last updated:** [January 18, 2022, 6:25pm UTC](https://discuss.elastic.co/t/exclude-master-node-from-query-user-operations-how/294636 "2022-01-18T18:25:25Z")
We have a 11 node Elasticsearch cluster (3 master-eligible node + 8 data nodes). We perform all operations (ingesting, search etc) using REST calls. The master nodes are lightweight as compared to data nodes. For the sa… --- ## ["operation primary term \[1\] is too old (current \[2\])"](https://discuss.elastic.co/t/operation-primary-term-1-is-too-old-current-2/294459)
**Author:** [@noactivation](https://discuss.elastic.co/u/noactivation)\ **Replies:** 2\ **Last updated:** [January 18, 2022, 6:14pm UTC](https://discuss.elastic.co/t/operation-primary-term-1-is-too-old-current-2/294459 "2022-01-18T18:14:27Z")
I'm novice with Elasticsearch, looking at some issues today. The company subject matter expert is in a different timezone where it is well-past business hours on a Friday night. This doesn't seem critical, so I'm not goi… --- ## [Can't delete/change data in @timestamp field yielded by ingest processor](https://discuss.elastic.co/t/cant-delete-change-data-in-timestamp-field-yielded-by-ingest-processor/294497)
**Author:** [@SomeAkk](https://discuss.elastic.co/u/SomeAkk)\ **Replies:** 5\ **Last updated:** [January 18, 2022, 5:29pm UTC](https://discuss.elastic.co/t/cant-delete-change-data-in-timestamp-field-yielded-by-ingest-processor/294497 "2022-01-18T17:29:35Z")
Hi! Today i add to my document @timestamp field (before this value was not in the document, and document no any date data.) with date data using ingest set processor: { "processors": \[ { "set": { "de… --- ## [Roll Up Index does not get populated with documents](https://discuss.elastic.co/t/roll-up-index-does-not-get-populated-with-documents/294707)
**Author:** [@Kosodrom](https://discuss.elastic.co/u/Kosodrom)\ **Replies:** 1\ **Last updated:** [January 18, 2022, 5:04pm UTC](https://discuss.elastic.co/t/roll-up-index-does-not-get-populated-with-documents/294707 "2022-01-18T17:04:37Z")
Hi folks, my goal is to archive the document \_size of incoming logs in specific archive index, because the original document gets deleted using ILM. Example Document: { "\_index":"filebeat-live-index-01", "\_type"… --- ## [Upsert data using painless script if updated\_at is higher than previous document](https://discuss.elastic.co/t/upsert-data-using-painless-script-if-updated-at-is-higher-than-previous-document/294632)
**Author:** [@garotad508](https://discuss.elastic.co/u/garotad508)\ **Replies:** 1\ **Last updated:** [January 18, 2022, 4:35pm UTC](https://discuss.elastic.co/t/upsert-data-using-painless-script-if-updated-at-is-higher-than-previous-document/294632 "2022-01-18T16:35:28Z")
I have a collection which gets updated frequently. We need to perform upsert operation, i.e., if document doesn't exist then create else update. Another constraint we require is timestamp of updated\_at should be higher… --- ## [Select documents with nested collection without something](https://discuss.elastic.co/t/select-documents-with-nested-collection-without-something/294714)
**Author:** [@Ivan\_Popov](https://discuss.elastic.co/u/Ivan_Popov)\ **Replies:** 0\ **Last updated:** [January 18, 2022, 4:22pm UTC](https://discuss.elastic.co/t/select-documents-with-nested-collection-without-something/294714 "2022-01-18T16:22:38Z")
Here is my test data \[ { "id": 1, "last\_email\_sent": \[ { "letterId": 1, "timestamp": 555 }, { "letterId": 2, "timestamp": 666 } \] }, { "id": … --- ## [Elasticsearch docker environment variables prefix](https://discuss.elastic.co/t/elasticsearch-docker-environment-variables-prefix/294711)
**Author:** [@rschirin](https://discuss.elastic.co/u/rschirin)\ **Replies:** 0\ **Last updated:** [January 18, 2022, 4:08pm UTC](https://discuss.elastic.co/t/elasticsearch-docker-environment-variables-prefix/294711 "2022-01-18T16:08:58Z")
I'm trying to run ES in docker with specific env variables such as discovery.type=single-node, but my hosting provider prohibits . characters in env variable names. This is discussed here: Install Elasticsearch with Doc… --- ## [How to restart collection after high disk watermark](https://discuss.elastic.co/t/how-to-restart-collection-after-high-disk-watermark/294605)
**Author:** [@linuxlion](https://discuss.elastic.co/u/linuxlion)\ **Replies:** 2\ **Last updated:** [January 17, 2022, 4:36pm UTC](https://discuss.elastic.co/t/how-to-restart-collection-after-high-disk-watermark/294605 "2022-01-17T16:36:50Z")
Elasticsearch stop collection after high disk watermark. After cleanup the disk, I want to restart collection. Some years ago on version 6.8.23-1 I use: curl -X PUT "http://127.0.0.1:9200/settings?pretty" -H 'Content-… --- ## [Not able to start Elasticsearch cluster after disabling security](https://discuss.elastic.co/t/not-able-to-start-elasticsearch-cluster-after-disabling-security/294673)
**Author:** [@hallaoui](https://discuss.elastic.co/u/hallaoui)\ **Replies:** 3\ **Last updated:** [January 18, 2022, 2:17pm UTC](https://discuss.elastic.co/t/not-able-to-start-elasticsearch-cluster-after-disabling-security/294673 "2022-01-18T14:17:13Z")
Hi All, I disabled the security due to expiration of platinum subscription but when trying to start the cluster it is not starting. Any help will be high appreciated. Thanks --- ## [Update mapping to support an additional date format (without reindexing)](https://discuss.elastic.co/t/update-mapping-to-support-an-additional-date-format-without-reindexing/294704)
**Author:** [@Lee\_Tonks](https://discuss.elastic.co/u/Lee_Tonks)\ **Replies:** 0\ **Last updated:** [January 18, 2022, 2:13pm UTC](https://discuss.elastic.co/t/update-mapping-to-support-an-additional-date-format-without-reindexing/294704 "2022-01-18T14:13:59Z")
Is it possible to update my document mapping to support an additional date/time format without having to reindex? ie my current format is: {"type": "date", "format": "yyyy-MM-dd HH:mm:ss"} and the format I want to set… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=507) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=509)