# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=516 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 517 --- ## [Calculated the sum of blank per doc](https://discuss.elastic.co/t/calculated-the-sum-of-blank-per-doc/293516)
**Author:** [@Sugand](https://discuss.elastic.co/u/Sugand)\ **Replies:** 0\ **Last updated:** [January 5, 2022, 10:07am UTC](https://discuss.elastic.co/t/calculated-the-sum-of-blank-per-doc/293516 "2022-01-05T10:07:31Z")
Hi, Have a data structure doc like attached, I want to create a field which is the calculation of sum of blanks per doc or per ID So a field "total blank" with above example should be like "total blank" 3 2 1 … --- ## [Migrating Java Rest Client to Java Api Client](https://discuss.elastic.co/t/migrating-java-rest-client-to-java-api-client/293337)
**Author:** [@Swati\_Jain1](https://discuss.elastic.co/u/Swati_Jain1)\ **Replies:** 1\ **Last updated:** [January 5, 2022, 9:56am UTC](https://discuss.elastic.co/t/migrating-java-rest-client-to-java-api-client/293337 "2022-01-05T09:56:51Z")
After upgrading Elasticsearch to 7.16.2, Elasticsearch Java Rest Client seems to be deprecated. We are migrating to Java API client which lacks proper documentation. Please help. --- ## [Cloudwatch Metric stream to Elastic search](https://discuss.elastic.co/t/cloudwatch-metric-stream-to-elastic-search/293506)
**Author:** [@akb\_2021](https://discuss.elastic.co/u/akb_2021)\ **Replies:** 1\ **Last updated:** [January 5, 2022, 8:53am UTC](https://discuss.elastic.co/t/cloudwatch-metric-stream-to-elastic-search/293506 "2022-01-05T08:53:00Z")
My Objective is to build a monitoring system for RDS databases. So I am trying to create Cloudwatch metric stream to Elasticsearch(open search AWS) using kinesis firehose & lambda. The RDS metrics are appearing but Datab… --- ## [System load too high](https://discuss.elastic.co/t/system-load-too-high/293436)
**Author:** [@Davide89](https://discuss.elastic.co/u/Davide89)\ **Replies:** 5\ **Last updated:** [January 5, 2022, 8:41am UTC](https://discuss.elastic.co/t/system-load-too-high/293436 "2022-01-05T08:41:19Z")
I'm working on a VM with a single-node instance of Elasticsearch and I registered a lot of alerts about system load for many days. Indeed the overall system load is always higher then 1. Below a Grafana chart that shows… --- ## [Failed to open TCP connection to ES while trying to connect from fluentd](https://discuss.elastic.co/t/failed-to-open-tcp-connection-to-es-while-trying-to-connect-from-fluentd/293502)
**Author:** [@subha1](https://discuss.elastic.co/u/subha1)\ **Replies:** 0\ **Last updated:** [January 5, 2022, 6:53am UTC](https://discuss.elastic.co/t/failed-to-open-tcp-connection-to-es-while-trying-to-connect-from-fluentd/293502 "2022-01-05T06:53:35Z")
Failed to open TCP connection to ES while trying to connect from fluentd. In the cluster, there are 5 clients , 5 masters & 5 data pods are running with 155 fluentd daemonsets. some of the fluentd pods are getting res… --- ## [Can we use elasticsearch analyzer for kibana](https://discuss.elastic.co/t/can-we-use-elasticsearch-analyzer-for-kibana/293310)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 2\ **Last updated:** [January 5, 2022, 5:27am UTC](https://discuss.elastic.co/t/can-we-use-elasticsearch-analyzer-for-kibana/293310 "2022-01-05T05:27:00Z")
Hi team, I am learning Elasticsearch analyzer and now i have to test this analyzer for my new index. There is a question strucking in my mind that if made analyzer and we are searching our text in kibana discover. Beca… --- ## [\[ES v6.7.2\] Speed up snapshot restore from GCS Snapshot Repository](https://discuss.elastic.co/t/es-v6-7-2-speed-up-snapshot-restore-from-gcs-snapshot-repository/293343)
**Author:** [@Akshay\_KN](https://discuss.elastic.co/u/Akshay_KN)\ **Replies:** 2\ **Last updated:** [January 5, 2022, 5:19am UTC](https://discuss.elastic.co/t/es-v6-7-2-speed-up-snapshot-restore-from-gcs-snapshot-repository/293343 "2022-01-05T05:19:58Z")
Hello Team, We are trying to speed up our snapshot restoration speed in our ES cluster hosted on GCP Compute instances. TL;DR : Current Performance: 50 MBps per data node Infra Capable of 500 MBps We want to improve … --- ## [Lost data:The successfully written data is missing](https://discuss.elastic.co/t/lost-data-the-successfully-written-data-is-missing/293486)
**Author:** [@51pwn](https://discuss.elastic.co/u/51pwn)\ **Replies:** 3\ **Last updated:** [January 5, 2022, 1:34am UTC](https://discuss.elastic.co/t/lost-data-the-successfully-written-data-is-missing/293486 "2022-01-05T01:34:34Z")
Docker 7.16.2 official image I successfully wrote 177393 pieces of data, each of which returned: {"total": 1, "successful": 1, "failed": 0}, but passed http://127.0.0.1:9200/\_cat/indices?v See docs The count is 147840… --- ## [Elastic Query for alerts Windows](https://discuss.elastic.co/t/elastic-query-for-alerts-windows/293481)
**Author:** [@PublicName](https://discuss.elastic.co/u/PublicName)\ **Replies:** 0\ **Last updated:** [January 4, 2022, 10:42pm UTC](https://discuss.elastic.co/t/elastic-query-for-alerts-windows/293481 "2022-01-04T22:42:14Z")
I know this is going to be simple but it's just not coming to me at all today. GET /logs-\*/\_eql/search { "query": """ winlog where winlog.event\_id == "4625" and stringContains(message, "The specified account's pas… --- ## [Trying to divide the cardinality of a string/hash field by the numeric value of another field](https://discuss.elastic.co/t/trying-to-divide-the-cardinality-of-a-string-hash-field-by-the-numeric-value-of-another-field/293374)
**Author:** [@jjammin92](https://discuss.elastic.co/u/jjammin92)\ **Replies:** 1\ **Last updated:** [January 4, 2022, 9:10pm UTC](https://discuss.elastic.co/t/trying-to-divide-the-cardinality-of-a-string-hash-field-by-the-numeric-value-of-another-field/293374 "2022-01-04T21:10:07Z")
I'm trying to create a runtime field within an index template. I can easily divide the values of two integers like this: emit(doc\['bounce\_time'\].value / doc\['session'\].value) EG bounce\_time: 100 / session: 25 = 4 Ho… --- ## [Host availability](https://discuss.elastic.co/t/host-availability/293479)
**Author:** [@Kirill\_Gofman](https://discuss.elastic.co/u/Kirill_Gofman)\ **Replies:** 0\ **Last updated:** [January 4, 2022, 8:41pm UTC](https://discuss.elastic.co/t/host-availability/293479 "2022-01-04T20:41:56Z")
Hey, we are trying to configure SAML auth with adfs. How can we verify that security rules are configured correctly on AWS/host and that it's available from elastic ? Any option to ping/trace destination host from the el… --- ## [Merge different index in function two fields and paste eleement of fields](https://discuss.elastic.co/t/merge-different-index-in-function-two-fields-and-paste-eleement-of-fields/293363)
**Author:** [@Vivian](https://discuss.elastic.co/u/Vivian)\ **Replies:** 8\ **Last updated:** [January 4, 2022, 7:06pm UTC](https://discuss.elastic.co/t/merge-different-index-in-function-two-fields-and-paste-eleement-of-fields/293363 "2022-01-04T19:06:46Z")
Hello, I have an index of this shape : { "\_index": "df\_extrait", "\_type": "\_doc", "\_id": "27685", "\_version": 1, "\_seq\_no": 0, "\_primary\_term": 1, "\_score": 1, "\_source": { "source": "avatar", "… --- ## [ElasticSearch Upgrade to 5.6](https://discuss.elastic.co/t/elasticsearch-upgrade-to-5-6/293469)
**Author:** [@mario12](https://discuss.elastic.co/u/mario12)\ **Replies:** 3\ **Last updated:** [January 4, 2022, 6:20pm UTC](https://discuss.elastic.co/t/elasticsearch-upgrade-to-5-6/293469 "2022-01-04T18:20:51Z")
We are currently running Elasticsearch version 2.4. We are planning to upgrade to ES 5.6. We ran the upgrade advisor and we took care of the issues. We are planning to upgrade by setting up a new cluster and restoring th… --- ## [Disable java security policies in elasticsearch:5.6.9 docker image](https://discuss.elastic.co/t/disable-java-security-policies-in-elasticsearch-5-6-9-docker-image/293460)
**Author:** [@curioususer](https://discuss.elastic.co/u/curioususer)\ **Replies:** 0\ **Last updated:** [January 4, 2022, 3:25pm UTC](https://discuss.elastic.co/t/disable-java-security-policies-in-elasticsearch-5-6-9-docker-image/293460 "2022-01-04T15:25:53Z")
Hi, I'm trying to exploit the log4j vulnerability in Elasticsearch 5.6.9 for an academic project. I was able to get a RCE (a simple print), but when it comes to executing a shell, I get this error: java.security.Access… --- ## [How to whitelist NULL values?](https://discuss.elastic.co/t/how-to-whitelist-null-values/293449)
**Author:** [@Wooden\_tree](https://discuss.elastic.co/u/Wooden_tree)\ **Replies:** 0\ **Last updated:** [January 4, 2022, 1:55pm UTC](https://discuss.elastic.co/t/how-to-whitelist-null-values/293449 "2022-01-04T13:55:57Z")
Hello, I’m a quite new in Elastic world and I’d like to know if it’s possible to whitelist a NULL value. We have a rule that detects the authentications of our privileges accounts on unauthorized assets which is based … --- ## [I'm trying to move my elastic stack to 7.16.2 (from 6.8.22) in docker-compose - but fails to get certificates generated](https://discuss.elastic.co/t/im-trying-to-move-my-elastic-stack-to-7-16-2-from-6-8-22-in-docker-compose-but-fails-to-get-certificates-generated/292675)
**Author:** [@fribse](https://discuss.elastic.co/u/fribse)\ **Replies:** 5\ **Last updated:** [January 4, 2022, 1:06pm UTC](https://discuss.elastic.co/t/im-trying-to-move-my-elastic-stack-to-7-16-2-from-6-8-22-in-docker-compose-but-fails-to-get-certificates-generated/292675 "2022-01-04T13:06:49Z")
With the Log4J vulnerability I've been tasked to update our quite dated Elasticsearch stack. We were on 6.5.1, which I moved to 6.8.22 without issues. Now I want to move it to 7.16.2. There isn't that much with rollin… --- ## [Elastic life cycle management](https://discuss.elastic.co/t/elastic-life-cycle-management/293392)
**Author:** [@bargb](https://discuss.elastic.co/u/bargb)\ **Replies:** 3\ **Last updated:** [January 4, 2022, 12:49pm UTC](https://discuss.elastic.co/t/elastic-life-cycle-management/293392 "2022-01-04T12:49:33Z")
Hello All. I am relatively new to elastic and trying to configure elastic policy for life cycle management on a Kubernetes env. I see that we can configure using curl request. Is there are corresponding CLI? I want… --- ## [Eland: How to access and filter nested fields in a DataFrame?](https://discuss.elastic.co/t/eland-how-to-access-and-filter-nested-fields-in-a-dataframe/292672)
**Author:** [@Paddyns](https://discuss.elastic.co/u/Paddyns)\ **Replies:** 2\ **Last updated:** [January 4, 2022, 12:10pm UTC](https://discuss.elastic.co/t/eland-how-to-access-and-filter-nested-fields-in-a-dataframe/292672 "2022-01-04T12:10:20Z")
Hi, I'm trying to use the examples from the ELAND docs e.g. this filtering example from github df\[(df.Carrier=="Kibana Airlines") & (df.AvgTicketPrice \> 900.0) & (df.Cancelled == True)\].head() But the fields I have al… --- ## [After Elasticsearch 7.10-\>7.16 Upgrade Geo Shape Queries Cause Heap Problem ( G1 Humongous Allocation )](https://discuss.elastic.co/t/after-elasticsearch-7-10-7-16-upgrade-geo-shape-queries-cause-heap-problem-g1-humongous-allocation/292912)
**Author:** [@bulent](https://discuss.elastic.co/u/bulent)\ **Replies:** 6\ **Last updated:** [January 4, 2022, 10:03am UTC](https://discuss.elastic.co/t/after-elasticsearch-7-10-7-16-upgrade-geo-shape-queries-cause-heap-problem-g1-humongous-allocation/292912 "2022-01-04T10:03:59Z")
Hi; We have upgraded our ES Cluster from 7.10.0 to 7.16.2 . After upgrade , we have noticed heap usage increased a lot because of G1 Humongous Allocations. ES heap has a lot of Humongous regions. When Heap usage reac… --- ## [Running an \_update\_by\_query statement dropped the field in unmatched elements?](https://discuss.elastic.co/t/running-an-update-by-query-statement-dropped-the-field-in-unmatched-elements/293333)
**Author:** [@cdav](https://discuss.elastic.co/u/cdav)\ **Replies:** 3\ **Last updated:** [January 4, 2022, 9:20am UTC](https://discuss.elastic.co/t/running-an-update-by-query-statement-dropped-the-field-in-unmatched-elements/293333 "2022-01-04T09:20:50Z")
I've run the following query: POST hits-\*/\_update\_by\_query { "script": { "source": "ctx.\_source.type = 'se';", "lang": "painless" }, "query": { "match": { "type": "qa" } } } Everything see… --- ## [Data not visibile in Kibana](https://discuss.elastic.co/t/data-not-visibile-in-kibana/293122)
**Author:** [@d6036de2b54af16665f4](https://discuss.elastic.co/u/d6036de2b54af16665f4)\ **Replies:** 9\ **Last updated:** [January 4, 2022, 9:20am UTC](https://discuss.elastic.co/t/data-not-visibile-in-kibana/293122 "2022-01-04T09:20:20Z")
Hello, I ingested data from s3 bucket into Elasticsearch through Logstash pipelines. BUT I AM NOT ABLE TO visualize DATA IN KIBANA . I am only able to see data till october monthsm and after that no data is visible th… --- ## [Unable to start Elasticsearch on my local Windows system](https://discuss.elastic.co/t/unable-to-start-elasticsearch-on-my-local-windows-system/293202)
**Author:** [@gauravraje](https://discuss.elastic.co/u/gauravraje)\ **Replies:** 2\ **Last updated:** [January 4, 2022, 8:54am UTC](https://discuss.elastic.co/t/unable-to-start-elasticsearch-on-my-local-windows-system/293202 "2022-01-04T08:54:43Z")
Team, I have downloaded Elasticsearch on my local system but when i am trying to open/start elastic server from bin/Elasticsearch.bat, we are facing below issue plz share possible steps to launch Elasticsearch succes… --- ## [Should I close the older PIT id once it has been replaced by a new PIT id?](https://discuss.elastic.co/t/should-i-close-the-older-pit-id-once-it-has-been-replaced-by-a-new-pit-id/293420)
**Author:** [@pranay\_jain](https://discuss.elastic.co/u/pranay_jain)\ **Replies:** 0\ **Last updated:** [January 4, 2022, 8:51am UTC](https://discuss.elastic.co/t/should-i-close-the-older-pit-id-once-it-has-been-replaced-by-a-new-pit-id/293420 "2022-01-04T08:51:24Z")
I am working on a task in which I have to search a large number of documents in Elasticsearch. I use SearchAPI with SearchAfter and PointInTime as recommended. While fetching the results, I am using the PIT ID returned b… --- ## [How to show "N/A" in a field has null value](https://discuss.elastic.co/t/how-to-show-n-a-in-a-field-has-null-value/293416)
**Author:** [@v.le](https://discuss.elastic.co/u/v.le)\ **Replies:** 1\ **Last updated:** [January 4, 2022, 8:22am UTC](https://discuss.elastic.co/t/how-to-show-n-a-in-a-field-has-null-value/293416 "2022-01-04T08:22:34Z")
Hi, I am new for Elasticsearch! I had imported my data content to Elasticsearch but I cant work out how to show the N/A value of the sales field. Here's the data : country group brand PT date sales Japan… --- ## [How to run multiple views of the same log set on same VM](https://discuss.elastic.co/t/how-to-run-multiple-views-of-the-same-log-set-on-same-vm/293417)
**Author:** [@smarajit\_mishra](https://discuss.elastic.co/u/smarajit_mishra)\ **Replies:** 0\ **Last updated:** [January 4, 2022, 8:16am UTC](https://discuss.elastic.co/t/how-to-run-multiple-views-of-the-same-log-set-on-same-vm/293417 "2022-01-04T08:16:41Z")
The requirement here is to create 2 views. 1 with the comprehensive view of all debug logs in like one week or so. And second view to have a job wise view. Where you can filter out logs and errors. The logs in themselv… --- ## [Swagger-4-es (Swagger UI for Key Elasticsearch Endpoints)](https://discuss.elastic.co/t/swagger-4-es-swagger-ui-for-key-elasticsearch-endpoints/293012)
**Author:** [@Johnnycc1](https://discuss.elastic.co/u/Johnnycc1)\ **Replies:** 1\ **Last updated:** [January 4, 2022, 7:42am UTC](https://discuss.elastic.co/t/swagger-4-es-swagger-ui-for-key-elasticsearch-endpoints/293012 "2022-01-04T07:42:45Z")
Hey Elasticsearch community, I have created an openapi schema for the key Elasticsearch endpoints (or at least the ones I think are key). If you don't know what that is, basically when paired with the swagger-ui library… --- ## [Composite aggregation behavior when missing a key, not value](https://discuss.elastic.co/t/composite-aggregation-behavior-when-missing-a-key-not-value/293407)
**Author:** [@lstoneir](https://discuss.elastic.co/u/lstoneir)\ **Replies:** 0\ **Last updated:** [January 4, 2022, 6:17am UTC](https://discuss.elastic.co/t/composite-aggregation-behavior-when-missing-a-key-not-value/293407 "2022-01-04T06:17:01Z")
Hi every body! I'm using composite aggregation to multi terms on my data. some where in docs elastic says: By default documents without a value for a given source are ignored. It is possible to include them in the res… --- ## [How to stop auto index creation](https://discuss.elastic.co/t/how-to-stop-auto-index-creation/293275)
**Author:** [@ken\_kentan](https://discuss.elastic.co/u/ken_kentan)\ **Replies:** 1\ **Last updated:** [January 4, 2022, 5:55am UTC](https://discuss.elastic.co/t/how-to-stop-auto-index-creation/293275 "2022-01-04T05:55:47Z")
I'm using Elasticsearch(7.16.0) with Metricbeat and Filebeat. It will create unused indexes automtically. e.g. dekitateserver-filebeat-7.11.1-\*. Curentlly, Filebeat is using only dekitateserver-filebeat-2021-\*. How to… --- ## [Query about the Logstash compatibility with ELK 6.7.2](https://discuss.elastic.co/t/query-about-the-logstash-compatibility-with-elk-6-7-2/293301)
**Author:** [@Sunil\_Kumar1](https://discuss.elastic.co/u/Sunil_Kumar1)\ **Replies:** 1\ **Last updated:** [January 4, 2022, 5:54am UTC](https://discuss.elastic.co/t/query-about-the-logstash-compatibility-with-elk-6-7-2/293301 "2022-01-04T05:54:32Z")
Hello Team, We are running the Elastic cluster with 6.7.2 version and we are also using logstash 6.7.2 to ship the application logs from our kubernetes containers to Elasticsearch. Our query is, is logstash 6.8.22 is co… --- ## [Correct way to map HTTP Server logs](https://discuss.elastic.co/t/correct-way-to-map-http-server-logs/293357)
**Author:** [@Jonathan\_Rosenboim](https://discuss.elastic.co/u/Jonathan_Rosenboim)\ **Replies:** 1\ **Last updated:** [January 4, 2022, 5:52am UTC](https://discuss.elastic.co/t/correct-way-to-map-http-server-logs/293357 "2022-01-04T05:52:50Z")
Hi all! I am relatively new with Elasticsearch, and I want to store logs of all HTTP requests made to multiple services, including info like headers, body and params to Elasticsearch, and wish for all this info to be ac… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=515) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=517)