# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=514 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 515 --- ## [Upgrading elasticsearch 6.3.2 to 6.8.22](https://discuss.elastic.co/t/upgrading-elasticsearch-6-3-2-to-6-8-22/293849)
**Author:** [@Vishnu\_Vijay](https://discuss.elastic.co/u/Vishnu_Vijay)\ **Replies:** 1\ **Last updated:** [January 10, 2022, 6:23am UTC](https://discuss.elastic.co/t/upgrading-elasticsearch-6-3-2-to-6-8-22/293849 "2022-01-10T06:23:34Z")
Hello Team, We are planning to upgrade Elasticsearch from 6.3.2 to 6.8.22. We noticed that there are no breaking changes as per the documentation. Kindly suggest whether there are any areas to be focused about. Also ple… --- ## [Merging the index with lower max\_number\_segement causing increasing index size](https://discuss.elastic.co/t/merging-the-index-with-lower-max-number-segement-causing-increasing-index-size/293844)
**Author:** [@arvin495](https://discuss.elastic.co/u/arvin495)\ **Replies:** 8\ **Last updated:** [January 10, 2022, 6:01am UTC](https://discuss.elastic.co/t/merging-the-index-with-lower-max-number-segement-causing-increasing-index-size/293844 "2022-01-10T06:01:04Z")
Hello Team, We have performed force merging on one index size of 74GB with 2 shards (primary + replica) and 36 segments (primary + replica) to remove deleted docs. curl -s -X POST "https://elasticsearch.com/index/\_forc… --- ## [Search multiple data streams and indices - Permissions](https://discuss.elastic.co/t/search-multiple-data-streams-and-indices-permissions/293678)
**Author:** [@carlos.cilleruelo](https://discuss.elastic.co/u/carlos.cilleruelo)\ **Replies:** 1\ **Last updated:** [January 9, 2022, 11:11pm UTC](https://discuss.elastic.co/t/search-multiple-data-streams-and-indices-permissions/293678 "2022-01-09T23:11:43Z")
Hello, I am trying to perform some searches over multiple data streams and indices using a -\* pattern. Everything seems to be working when I search over a specific index, but if a tried the wildcard my client prompts an… --- ## [What is a classic and recommanded ElasticSearch architecture?](https://discuss.elastic.co/t/what-is-a-classic-and-recommanded-elasticsearch-architecture/293727)
**Author:** [@sebastienf](https://discuss.elastic.co/u/sebastienf)\ **Replies:** 1\ **Last updated:** [January 9, 2022, 9:57pm UTC](https://discuss.elastic.co/t/what-is-a-classic-and-recommanded-elasticsearch-architecture/293727 "2022-01-09T21:57:25Z")
Our former cluster ES was made of 40 data nodes. 4 of them were coordinators as well 3 of them were electable as a master (for one node, it gathers data, coordinator and master-electable role) We aim to create a new c… --- ## [Elastic Diagnostics and Log4j2 vulnerability](https://discuss.elastic.co/t/elastic-diagnostics-and-log4j2-vulnerability/293808)
**Author:** [@newschapmj1](https://discuss.elastic.co/u/newschapmj1)\ **Replies:** 1\ **Last updated:** [January 9, 2022, 9:31pm UTC](https://discuss.elastic.co/t/elastic-diagnostics-and-log4j2-vulnerability/293808 "2022-01-09T21:31:33Z")
Does upgrading to 8.2.6 fix all known Log4j2 issues with Elastic Diagnostics? Should it be on the Elastic list of software affected by Log4j2 to remind users to upgrade? --- ## [Aggregation numbers do not add up](https://discuss.elastic.co/t/aggregation-numbers-do-not-add-up/293825)
**Author:** [@Lark](https://discuss.elastic.co/u/Lark)\ **Replies:** 0\ **Last updated:** [January 9, 2022, 12:42pm UTC](https://discuss.elastic.co/t/aggregation-numbers-do-not-add-up/293825 "2022-01-09T12:42:01Z")
Hello friends! I'm trying to learn aggregations on Elastic for my company's backend. Our documents include a label field (which could be many different keywords), and I would like to aggregate and calculate certain thi… --- ## [Search template condition on paramters](https://discuss.elastic.co/t/search-template-condition-on-paramters/293809)
**Author:** [@ylasri](https://discuss.elastic.co/u/ylasri)\ **Replies:** 0\ **Last updated:** [January 8, 2022, 7:25pm UTC](https://discuss.elastic.co/t/search-template-condition-on-paramters/293809 "2022-01-08T19:25:37Z")
Hello Everybody, Happy new year 2022. I have a small use case that i want to implement using Elasticsearch search template The idea is to limit the parameter from so that it can't go more that a limit value. Do you ha… --- ## [Elasticsearch-keystore: not found during attempt to configure elasticsearch 7.16.2](https://discuss.elastic.co/t/elasticsearch-keystore-not-found-during-attempt-to-configure-elasticsearch-7-16-2/293805)
**Author:** [@Nicole\_Hirshler](https://discuss.elastic.co/u/Nicole_Hirshler)\ **Replies:** 1\ **Last updated:** [January 8, 2022, 6:04pm UTC](https://discuss.elastic.co/t/elasticsearch-keystore-not-found-during-attempt-to-configure-elasticsearch-7-16-2/293805 "2022-01-08T18:04:14Z")
I'm trying to upgrade to the latest version of elasticsearch 7.16.2 inside docker. During the setup I see the following error: docker logs -f emr\_cloud\_elasticsearch /usr/local/bin/docker-entrypoint.sh: line 14: exec… --- ## [In memory Indices on ES 7.x](https://discuss.elastic.co/t/in-memory-indices-on-es-7-x/293778)
**Author:** [@mario12](https://discuss.elastic.co/u/mario12)\ **Replies:** 2\ **Last updated:** [January 8, 2022, 12:06am UTC](https://discuss.elastic.co/t/in-memory-indices-on-es-7-x/293778 "2022-01-08T00:06:22Z")
We are planning to implement an indices on ES 7.x. Is there a way we can keep the indices on memory instead of disk? The total size of the indices will be 150 GB and shared across multiple data nodes. --- ## [Elasticsearh Error : Pods not coming back up](https://discuss.elastic.co/t/elasticsearh-error-pods-not-coming-back-up/293380)
**Author:** [@tropically](https://discuss.elastic.co/u/tropically)\ **Replies:** 8\ **Last updated:** [January 7, 2022, 8:51pm UTC](https://discuss.elastic.co/t/elasticsearh-error-pods-not-coming-back-up/293380 "2022-01-07T20:51:24Z")
Hi We have Elasticsearch running on openshift. Image: docker.elastic.co/elasticsearch/elasticsearch:6.8.15 All of a sudden on the the pods went down and are not restarting. Trying to figure out what the cause is. Log… --- ## [Exact match](https://discuss.elastic.co/t/exact-match/293761)
**Author:** [@shafouz](https://discuss.elastic.co/u/shafouz)\ **Replies:** 3\ **Last updated:** [January 7, 2022, 7:19pm UTC](https://discuss.elastic.co/t/exact-match/293761 "2022-01-07T19:19:19Z")
Hi, I need to search in a big text field for a exact match. I tried with different analyzers but in a lot of them i run on the lucerne size limit and i haven't found any that exact matches. Are there any way to do that… --- ## [Request body is required when updating an index template using the Dev console](https://discuss.elastic.co/t/request-body-is-required-when-updating-an-index-template-using-the-dev-console/293775)
**Author:** [@dev9](https://discuss.elastic.co/u/dev9)\ **Replies:** 5\ **Last updated:** [January 7, 2022, 6:49pm UTC](https://discuss.elastic.co/t/request-body-is-required-when-updating-an-index-template-using-the-dev-console/293775 "2022-01-07T18:49:41Z")
Hi, How do I update an index template using the Dev Console? when I tried the below, I got a parse exception request body is required. I am using the latest version of elastic PUT \_index\_template/test/ { "… --- ## [Hardware server requirements for a fast ElasticSearch experience on one website with 900k entries](https://discuss.elastic.co/t/hardware-server-requirements-for-a-fast-elasticsearch-experience-on-one-website-with-900k-entries/293768)
**Author:** [@nbadmin](https://discuss.elastic.co/u/nbadmin)\ **Replies:** 1\ **Last updated:** [January 7, 2022, 5:12pm UTC](https://discuss.elastic.co/t/hardware-server-requirements-for-a-fast-elasticsearch-experience-on-one-website-with-900k-entries/293768 "2022-01-07T17:12:00Z")
Hello guys, I want to set up a dedicated vServer on which I want to run a single website. My question is what hardware server requirements do I need to implement a really fast Elasticsearch search and manage it with K… --- ## [Elasticsearch issue: nested: NumberFormatException\[For input string:](https://discuss.elastic.co/t/elasticsearch-issue-nested-numberformatexception-for-input-string/293730)
**Author:** [@Kiran\_Chauhan](https://discuss.elastic.co/u/Kiran_Chauhan)\ **Replies:** 1\ **Last updated:** [January 7, 2022, 4:53pm UTC](https://discuss.elastic.co/t/elasticsearch-issue-nested-numberformatexception-for-input-string/293730 "2022-01-07T16:53:48Z")
Hello @all, I am new here and hope this is the right place to discuss the issue. Sorry if I am violating any community rule. I have Elasticsearch with open-edx. Currently, I am facing an issue with Elasticsearch. wh… --- ## [How to ingest access\_log with x-forwarded-for from oracle http server in elasticsearch](https://discuss.elastic.co/t/how-to-ingest-access-log-with-x-forwarded-for-from-oracle-http-server-in-elasticsearch/293770)
**Author:** [@Agarwal](https://discuss.elastic.co/u/Agarwal)\ **Replies:** 0\ **Last updated:** [January 7, 2022, 4:51pm UTC](https://discuss.elastic.co/t/how-to-ingest-access-log-with-x-forwarded-for-from-oracle-http-server-in-elasticsearch/293770 "2022-01-07T16:51:31Z")
I am new to Elastic and wanting to ingest Oracle http server access\_log in elastic. i used apache ingestion, it considers entry as error.message. i used filebeat it does the same. i dont understand how to format it for i… --- ## [How to combine results from 2 elasticsearch indexes with different layouts](https://discuss.elastic.co/t/how-to-combine-results-from-2-elasticsearch-indexes-with-different-layouts/293659)
**Author:** [@jan499](https://discuss.elastic.co/u/jan499)\ **Replies:** 2\ **Last updated:** [January 7, 2022, 3:22pm UTC](https://discuss.elastic.co/t/how-to-combine-results-from-2-elasticsearch-indexes-with-different-layouts/293659 "2022-01-07T15:22:29Z")
We have an Elasticsearch with 2 different indexes. In one index there is a field called physical\_location which contains a lat en lon subfield. in the other index there is a field called program\_run.geolocation with the … --- ## [Unable to Start Elastic Search from Windows Service : Using MSI](https://discuss.elastic.co/t/unable-to-start-elastic-search-from-windows-service-using-msi/293752)
**Author:** [@dkris1](https://discuss.elastic.co/u/dkris1)\ **Replies:** 0\ **Last updated:** [January 7, 2022, 2:37pm UTC](https://discuss.elastic.co/t/unable-to-start-elastic-search-from-windows-service-using-msi/293752 "2022-01-07T14:37:57Z")
Hi All, Unable to start windows Elasticsearch service. Event viewer shows below. Using Version 7.16.1 Service cannot be started. Elastic.ProcessHosts.Process.StartupException: Could not evaluate jvm.options file. result… --- ## [Watcher which tries 2 times before alerting](https://discuss.elastic.co/t/watcher-which-tries-2-times-before-alerting/293128)
**Author:** [@Dimitri2](https://discuss.elastic.co/u/Dimitri2)\ **Replies:** 4\ **Last updated:** [January 7, 2022, 1:08pm UTC](https://discuss.elastic.co/t/watcher-which-tries-2-times-before-alerting/293128 "2022-01-07T13:08:45Z")
Hello everyone, I'm new to Elastic and I'm having trouble. I'm trying to get my Watcher to not return an alert right away but wait a moment to confirm or deny the problem. So instead of sending an alert directly, I wa… --- ## [Is there a way to show nested fields when showing highlight results?](https://discuss.elastic.co/t/is-there-a-way-to-show-nested-fields-when-showing-highlight-results/293740)
**Author:** [@munkyu](https://discuss.elastic.co/u/munkyu)\ **Replies:** 0\ **Last updated:** [January 7, 2022, 12:51pm UTC](https://discuss.elastic.co/t/is-there-a-way-to-show-nested-fields-when-showing-highlight-results/293740 "2022-01-07T12:51:46Z")
nested fields like below. "comments" : \[ { "content" : "apple computer", "votes\_count" : 1 }, { "content" : "apple computer is good", … --- ## [7.16.2 API problem](https://discuss.elastic.co/t/7-16-2-api-problem/293722)
**Author:** [@mengben](https://discuss.elastic.co/u/mengben)\ **Replies:** 1\ **Last updated:** [January 7, 2022, 11:12am UTC](https://discuss.elastic.co/t/7-16-2-api-problem/293722 "2022-01-07T11:12:10Z")
first：how to use SQL query second:How does the new API return some fields --- ## [ILM failing for rollover for Wazuh module / data](https://discuss.elastic.co/t/ilm-failing-for-rollover-for-wazuh-module-data/291781)
**Author:** [@Atul\_Chadha](https://discuss.elastic.co/u/Atul_Chadha)\ **Replies:** 38\ **Last updated:** [January 7, 2022, 9:34am UTC](https://discuss.elastic.co/t/ilm-failing-for-rollover-for-wazuh-module-data/291781 "2022-01-07T09:34:34Z")
I have setup a rollover policy for wazuh index with the below policy defination { "policy": "Wazuh", "phase\_definition": { "min\_age": "0ms", "actions": { "rollover": { "max\_size": "20gb", … --- ## [Elasticsearch Script Query - Returning multiple values on aggregation](https://discuss.elastic.co/t/elasticsearch-script-query-returning-multiple-values-on-aggregation/293716)
**Author:** [@hyun](https://discuss.elastic.co/u/hyun)\ **Replies:** 0\ **Last updated:** [January 7, 2022, 8:26am UTC](https://discuss.elastic.co/t/elasticsearch-script-query-returning-multiple-values-on-aggregation/293716 "2022-01-07T08:26:07Z")
Aggregation Result "aggregations": { "649": { "doc\_count\_error\_upper\_bound": 0, "sum\_other\_doc\_count": 0, "buckets": \[ { "key": "ALLOGENE THERAPEUTICS", … --- ## [ML datafeed altering - convert text field to integer](https://discuss.elastic.co/t/ml-datafeed-altering-convert-text-field-to-integer/293713)
**Author:** [@zerojin63](https://discuss.elastic.co/u/zerojin63)\ **Replies:** 0\ **Last updated:** [January 7, 2022, 8:03am UTC](https://discuss.elastic.co/t/ml-datafeed-altering-convert-text-field-to-integer/293713 "2022-01-07T08:03:56Z")
Hi, I want to convert keyword format field to integer in runtime mapping. I've tried these code but none of them worked. "runtime\_mappings": { "my\_field.keyword": { "type": "keyword", "script": { … --- ## [Failed to create elasticsearch client, connection refused while running fscrawler pod](https://discuss.elastic.co/t/failed-to-create-elasticsearch-client-connection-refused-while-running-fscrawler-pod/293663)
**Author:** [@Adityadgr8](https://discuss.elastic.co/u/Adityadgr8)\ **Replies:** 0\ **Last updated:** [January 6, 2022, 3:14pm UTC](https://discuss.elastic.co/t/failed-to-create-elasticsearch-client-connection-refused-while-running-fscrawler-pod/293663 "2022-01-06T15:14:08Z")
Hello, our fscrawler is unable to make a connection with Elasticsearch in the linux server. Previously with the same configuration, it was working fine but don't know why suddenly we starts to face this issue -- we ar… --- ## [Calculating percent](https://discuss.elastic.co/t/calculating-percent/293688)
**Author:** [@nabil86](https://discuss.elastic.co/u/nabil86)\ **Replies:** 1\ **Last updated:** [January 7, 2022, 2:20am UTC](https://discuss.elastic.co/t/calculating-percent/293688 "2022-01-07T02:20:57Z")
Hello, I want to calculte the percent of a given type on my index: Ok\_Count/total , I wrote this query But it doesn't work as i excepted , could you help me to correct it { "aggs": { "total":{ "filter":… --- ## [Choosing hot/warm or keep only hot nodes](https://discuss.elastic.co/t/choosing-hot-warm-or-keep-only-hot-nodes/293689)
**Author:** [@nabil86](https://discuss.elastic.co/u/nabil86)\ **Replies:** 0\ **Last updated:** [January 6, 2022, 8:13pm UTC](https://discuss.elastic.co/t/choosing-hot-warm-or-keep-only-hot-nodes/293689 "2022-01-06T20:13:51Z")
Hello, Currently, i want to implement a cluster which can index 650GB of application logs /day with 2 weeks of retention data. I want to decide about cluster typology: Is Hot/wam architecture ⇒ Hot keep data for 2 da… --- ## [Painless Script in Ingest - Rename Field](https://discuss.elastic.co/t/painless-script-in-ingest-rename-field/292587)
**Author:** [@DefensiveDepth](https://discuss.elastic.co/u/DefensiveDepth)\ **Replies:** 3\ **Last updated:** [January 6, 2022, 7:55pm UTC](https://discuss.elastic.co/t/painless-script-in-ingest-rename-field/292587 "2022-01-06T19:55:11Z")
Hello there, Using an ingest pipeline, I am trying to uppercase the first char in a fieldname, for all fields under winlog.event\_data: { "script": { "lang": "painless", "source": "ctx.\_source.winlog.e… --- ## [ECS fields for E-Commerce](https://discuss.elastic.co/t/ecs-fields-for-e-commerce/292987)
**Author:** [@Jannik\_Z](https://discuss.elastic.co/u/Jannik_Z)\ **Replies:** 1\ **Last updated:** [January 6, 2022, 4:23pm UTC](https://discuss.elastic.co/t/ecs-fields-for-e-commerce/292987 "2022-01-06T16:23:23Z")
Hi there, I would like to bring new "non-log" ECS fields to the table and would love to get some feedback from the community. We want to sponsor fields for e-commerce: orders payments products ... I think, the e-comm… --- ## [Making elastic persistence on Kubernetes env](https://discuss.elastic.co/t/making-elastic-persistence-on-kubernetes-env/293666)
**Author:** [@bargb](https://discuss.elastic.co/u/bargb)\ **Replies:** 0\ **Last updated:** [January 6, 2022, 3:27pm UTC](https://discuss.elastic.co/t/making-elastic-persistence-on-kubernetes-env/293666 "2022-01-06T15:27:16Z")
Hi.. I am running elastic on kubernetes cluster. My Yaml is as below but this is not persisting the data after elastic restarts. What should i do to persist it kind: PersistentVolumeClaim apiVersion: v1 metadata: nam… --- ## [Curl query from json](https://discuss.elastic.co/t/curl-query-from-json/293650)
**Author:** [@rusty\_cole](https://discuss.elastic.co/u/rusty_cole)\ **Replies:** 4\ **Last updated:** [January 6, 2022, 2:48pm UTC](https://discuss.elastic.co/t/curl-query-from-json/293650 "2022-01-06T14:48:57Z")
Hi guys, I have some query(witch works fine in kibana debugger), my goal is to make this query work from curl command line(windows). i have other queries with no issues. I think the problem is with the """ in the "r… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=513) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=515)