# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=520 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 521 --- ## [High CPU utilization on two nodes due to DSL Queries and slower query response](https://discuss.elastic.co/t/high-cpu-utilization-on-two-nodes-due-to-dsl-queries-and-slower-query-response/292535)
**Author:** [@Divyank\_Mahalle](https://discuss.elastic.co/u/Divyank_Mahalle)\ **Replies:** 5\ **Last updated:** [December 23, 2021, 3:45pm UTC](https://discuss.elastic.co/t/high-cpu-utilization-on-two-nodes-due-to-dsl-queries-and-slower-query-response/292535 "2021-12-23T15:45:41Z")
Hi, I am using elastic version 7.11.2. I am observing that two nodes that contain an index of 102Gb (51+51), multiple DSL queries are running in the background resulting in high CPU utilization. Enabled autoscaling on … --- ## [Disable specific deprecation warnings](https://discuss.elastic.co/t/disable-specific-deprecation-warnings/292678)
**Author:** [@joschi](https://discuss.elastic.co/u/joschi)\ **Replies:** 8\ **Last updated:** [December 23, 2021, 3:16pm UTC](https://discuss.elastic.co/t/disable-specific-deprecation-warnings/292678 "2021-12-23T15:16:24Z")
Hey folks, after upgrading to Elasticsearch 7.16.2, we receive the following deprecation warning in our clients (Java High-Level REST client): org.elasticsearch.client.RestClient - request \[POST http://example.com:9200… --- ## [How can I delete and insert parent document?](https://discuss.elastic.co/t/how-can-i-delete-and-insert-parent-document/292803)
**Author:** [@Ulan\_Zhenisserov](https://discuss.elastic.co/u/Ulan_Zhenisserov)\ **Replies:** 0\ **Last updated:** [December 23, 2021, 12:50pm UTC](https://discuss.elastic.co/t/how-can-i-delete-and-insert-parent-document/292803 "2021-12-23T12:50:33Z")
Hi. Can someone help me with this as i want to delete my parent docs in my parent child relationship and insert it again to the index. How will it work? This again inserted parent document will be in the same shard as it… --- ## [Azure Billing in Fleet integration](https://discuss.elastic.co/t/azure-billing-in-fleet-integration/292797)
**Author:** [@dabo](https://discuss.elastic.co/u/dabo)\ **Replies:** 0\ **Last updated:** [December 23, 2021, 11:09am UTC](https://discuss.elastic.co/t/azure-billing-in-fleet-integration/292797 "2021-12-23T11:09:50Z")
Hi, Any idea when will Azure Billing be added to Azure integration in Fleet (elastic agent). I can see this PR is open: Create Azure billing package by narph · Pull Request #1052 · elastic/integrations · GitHub Kind r… --- ## [How to whitelist again a email which is unsubscribed by the end user in Elastic Cloud?](https://discuss.elastic.co/t/how-to-whitelist-again-a-email-which-is-unsubscribed-by-the-end-user-in-elastic-cloud/292784)
**Author:** [@Gaurav2](https://discuss.elastic.co/u/Gaurav2)\ **Replies:** 0\ **Last updated:** [December 23, 2021, 9:03am UTC](https://discuss.elastic.co/t/how-to-whitelist-again-a-email-which-is-unsubscribed-by-the-end-user-in-elastic-cloud/292784 "2021-12-23T09:03:41Z")
Hello, we are using Elastic Cloud. we have configured alerts with the Elastic SMTP (preconfigure one which comes with Elastic Cloud default). It works fine. but one of our users has clicked on un-subscribe to the email … --- ## [How to send watcher alert email via gmail SMTP in Elastic Cloud?](https://discuss.elastic.co/t/how-to-send-watcher-alert-email-via-gmail-smtp-in-elastic-cloud/292783)
**Author:** [@Gaurav2](https://discuss.elastic.co/u/Gaurav2)\ **Replies:** 0\ **Last updated:** [December 23, 2021, 9:00am UTC](https://discuss.elastic.co/t/how-to-send-watcher-alert-email-via-gmail-smtp-in-elastic-cloud/292783 "2021-12-23T09:00:03Z")
Hello, we are trying to set watcher alerts via Gmail SMTP. we found some references in the official documentation and that seems to be of on-prem ELK Step. it is possible to do in Elastic Cloud? --- ## [Autoscaling on hosted elastic](https://discuss.elastic.co/t/autoscaling-on-hosted-elastic/292764)
**Author:** [@Divyank\_Mahalle](https://discuss.elastic.co/u/Divyank_Mahalle)\ **Replies:** 2\ **Last updated:** [December 23, 2021, 8:58am UTC](https://discuss.elastic.co/t/autoscaling-on-hosted-elastic/292764 "2021-12-23T08:58:53Z")
Hi, I am using hosted es with v 11.1.2. I am having two nodes with 1 primary shard and 1 replica shard in each node. (for 1 index- 1 primary and 1 replica shard) Autoscaling is enabled for clusters. During autoscaling… --- ## [EQL scenario doesn't match](https://discuss.elastic.co/t/eql-scenario-doesnt-match/292765)
**Author:** [@ateethrigvedi](https://discuss.elastic.co/u/ateethrigvedi)\ **Replies:** 0\ **Last updated:** [December 23, 2021, 6:20am UTC](https://discuss.elastic.co/t/eql-scenario-doesnt-match/292765 "2021-12-23T06:20:53Z")
I was trying to match some lines using EQL, but no match was found in-spite of having lines which matches the criteria in Elasticsearch. Kindly provide some leads about the same. Thanks in advance EQL QUERY: GET /inde… --- ## [Is it possible to use secrets from Elasticsearch keystore in ES Watcher actions?](https://discuss.elastic.co/t/is-it-possible-to-use-secrets-from-elasticsearch-keystore-in-es-watcher-actions/292755)
**Author:** [@andrewthetack](https://discuss.elastic.co/u/andrewthetack)\ **Replies:** 1\ **Last updated:** [December 23, 2021, 4:08am UTC](https://discuss.elastic.co/t/is-it-possible-to-use-secrets-from-elasticsearch-keystore-in-es-watcher-actions/292755 "2021-12-23T04:08:02Z")
I use watchers that call custom webhooks in their actions sections. Can I refer keystore values in the Authorization headers similar to variables? I need something similar to: "actions": { "my-api-notification": { … --- ## [Elastic Stack upgradation from 7.13.4 to 7.16.2](https://discuss.elastic.co/t/elastic-stack-upgradation-from-7-13-4-to-7-16-2/292703)
**Author:** [@chandra\_mohan1](https://discuss.elastic.co/u/chandra_mohan1)\ **Replies:** 2\ **Last updated:** [December 23, 2021, 4:14am UTC](https://discuss.elastic.co/t/elastic-stack-upgradation-from-7-13-4-to-7-16-2/292703 "2021-12-23T04:14:58Z")
We are planning to update elastic stack which contains, Elasticsearch cluster, Logstash, Kibana & Elasticsearch Monitoring cluster. We are not using any beats to ship data to logstash. Data to monitoring cluster is ship… --- ## [How to install Elasticsearch & Logstash using RPM for version 7.13.4](https://discuss.elastic.co/t/how-to-install-elasticsearch-logstash-using-rpm-for-version-7-13-4/292715)
**Author:** [@chandra\_mohan1](https://discuss.elastic.co/u/chandra_mohan1)\ **Replies:** 2\ **Last updated:** [December 23, 2021, 4:13am UTC](https://discuss.elastic.co/t/how-to-install-elasticsearch-logstash-using-rpm-for-version-7-13-4/292715 "2021-12-23T04:13:46Z")
I want install Elasticsearch & Logstash of version 7.13.4 using RPM to perform some testing. I am trying to install using using RPM package mentioned here: \[Installing Logstash | Logstash Reference \[7.16\] | Elastic\](htt… --- ## [How to join two index](https://discuss.elastic.co/t/how-to-join-two-index/292629)
**Author:** [@arisxf](https://discuss.elastic.co/u/arisxf)\ **Replies:** 5\ **Last updated:** [December 23, 2021, 2:11am UTC](https://discuss.elastic.co/t/how-to-join-two-index/292629 "2021-12-23T02:11:36Z")
I've tried using aliases (aliases a and b) the results alert The data you are seeing might be incomplete or wrong. in the field at index b. Please help me POST /\_aliases { "actions" : \[ { "add" : { "index" :… --- ## [Some vulnerabilities in repository S3 plugin for Elasticsearch](https://discuss.elastic.co/t/some-vulnerabilities-in-repository-s3-plugin-for-elasticsearch/292748)
**Author:** [@Sagarika\_Mahalik](https://discuss.elastic.co/u/Sagarika_Mahalik)\ **Replies:** 1\ **Last updated:** [December 23, 2021, 1:17am UTC](https://discuss.elastic.co/t/some-vulnerabilities-in-repository-s3-plugin-for-elasticsearch/292748 "2021-12-23T01:17:52Z")
Hi There are some Vulnerabilities which are coming from repository S3 plugin in these two jar jackson-databind-2.10.4.jar log4j-1.2-api-2.11.1.jar Please have a look into these. --- ## [Zero-day-exploit in log4j2 which is part of elasticsearch](https://discuss.elastic.co/t/zero-day-exploit-in-log4j2-which-is-part-of-elasticsearch/291439)
**Author:** [@spotlight2001](https://discuss.elastic.co/u/spotlight2001)\ **Replies:** 93\ **Last updated:** [December 23, 2021, 12:44am UTC](https://discuss.elastic.co/t/zero-day-exploit-in-log4j2-which-is-part-of-elasticsearch/291439 "2021-12-23T00:44:47Z")
Elasticsearch 7.1.1 seems to contain log4j 2.11.1 So is Elasticsearch affected? Will there be a new 7.1.x? --- ## [Transform not synching](https://discuss.elastic.co/t/transform-not-synching/292699)
**Author:** [@iamtheschmitzer](https://discuss.elastic.co/u/iamtheschmitzer)\ **Replies:** 8\ **Last updated:** [December 22, 2021, 10:20pm UTC](https://discuss.elastic.co/t/transform-not-synching/292699 "2021-12-22T22:20:50Z")
Hi trying to build my first transform - a latest transform. Maybe I misunderstand, but I expect to create and start the transform and it runs continuously - so new documents in the source index are processed and reflec… --- ## [ES transforms behaviour change after upgrading from 7.10.0 to 7.16.1](https://discuss.elastic.co/t/es-transforms-behaviour-change-after-upgrading-from-7-10-0-to-7-16-1/292700)
**Author:** [@brna](https://discuss.elastic.co/u/brna)\ **Replies:** 3\ **Last updated:** [December 22, 2021, 10:05pm UTC](https://discuss.elastic.co/t/es-transforms-behaviour-change-after-upgrading-from-7-10-0-to-7-16-1/292700 "2021-12-22T22:05:38Z")
I am observing a change in the way es transforms work after the cluster upgrade from 7.10.0 to 7.16.1 It is a continuous transform with filter on source index that would get all of the documents from the source index wi… --- ## [Apache Log4j2 vulnerability](https://discuss.elastic.co/t/apache-log4j2-vulnerability/292690)
**Author:** [@Amina\_LAARIM-SC](https://discuss.elastic.co/u/Amina_LAARIM-SC)\ **Replies:** 3\ **Last updated:** [December 22, 2021, 9:25pm UTC](https://discuss.elastic.co/t/apache-log4j2-vulnerability/292690 "2021-12-22T21:25:23Z")
Hello community, I am using Elasticsearch 6.2.1 and I can't find any information if this version is impacted with the Apache Log4j2 vulnerability discovered at the begining of this month. Do you have any information pl… --- ## [Question regarding the IDF value for the optional fields in a document](https://discuss.elastic.co/t/question-regarding-the-idf-value-for-the-optional-fields-in-a-document/290598)
**Author:** [@kaykanloo](https://discuss.elastic.co/u/kaykanloo)\ **Replies:** 3\ **Last updated:** [December 22, 2021, 8:18pm UTC](https://discuss.elastic.co/t/question-regarding-the-idf-value-for-the-optional-fields-in-a-document/290598 "2021-12-22T20:18:46Z")
Hi, I'm relatively new to Elasticsearch, so I'm probably missing something trivial here, but I'm having issues with the relevancy score of the search results when it comes to optional fields in documents. Consider the f… --- ## [Why is /\_search with scroll different?](https://discuss.elastic.co/t/why-is-search-with-scroll-different/292720)
**Author:** [@PeterMmm](https://discuss.elastic.co/u/PeterMmm)\ **Replies:** 1\ **Last updated:** [December 22, 2021, 7:56pm UTC](https://discuss.elastic.co/t/why-is-search-with-scroll-different/292720 "2021-12-22T19:56:27Z")
I have this api search (ES 7.10.2) https://host:19102/myindex/cat/\_search?filter\_path=hits.total that returns { "hits": { "total": { "value": 10000, "relation": "gte" } … --- ## [Cluster re-balancing issue](https://discuss.elastic.co/t/cluster-re-balancing-issue/292685)
**Author:** [@arunpmohan](https://discuss.elastic.co/u/arunpmohan)\ **Replies:** 3\ **Last updated:** [December 22, 2021, 5:34pm UTC](https://discuss.elastic.co/t/cluster-re-balancing-issue/292685 "2021-12-22T17:34:31Z")
We have a cluster with zoning enabled. Zone-A has 15 hot nodes+10 warm nodes and Zone-B has 14 hot nodes + 10 warm nodes (one node was taken out due to repeated issues). The cluster was doing well until the last we… --- ## [Elasticsearch 7.16.2 fails to start as service under windows server 2019](https://discuss.elastic.co/t/elasticsearch-7-16-2-fails-to-start-as-service-under-windows-server-2019/292708)
**Author:** [@yankun0567](https://discuss.elastic.co/u/yankun0567)\ **Replies:** 6\ **Last updated:** [December 22, 2021, 4:40pm UTC](https://discuss.elastic.co/t/elasticsearch-7-16-2-fails-to-start-as-service-under-windows-server-2019/292708 "2021-12-22T16:40:59Z")
Hi, I've just downloaded Elasticsearch 7.16.2 and installed it as a service under Windows Server 2019. Previously I had 7.10.2. running without any issues. If I'm trying to start the service, it fails with following er… --- ## [Problem importing saved\_objects using api](https://discuss.elastic.co/t/problem-importing-saved-objects-using-api/292304)
**Author:** [@fkoene](https://discuss.elastic.co/u/fkoene)\ **Replies:** 1\ **Last updated:** [December 22, 2021, 4:18pm UTC](https://discuss.elastic.co/t/problem-importing-saved-objects-using-api/292304 "2021-12-22T16:18:53Z")
I want to export saved\_objects and use the output file to import the objects in another space. The export goes well, the file can be imported by hand in the ELK GUI, but when I try importing it using the just exported f… --- ## [How to find the step names for each ILM action in each phases](https://discuss.elastic.co/t/how-to-find-the-step-names-for-each-ilm-action-in-each-phases/292662)
**Author:** [@Kannappan\_Somu](https://discuss.elastic.co/u/Kannappan_Somu)\ **Replies:** 1\ **Last updated:** [December 22, 2021, 3:53pm UTC](https://discuss.elastic.co/t/how-to-find-the-step-names-for-each-ilm-action-in-each-phases/292662 "2021-12-22T15:53:05Z")
How to find the step names for each ILM action in each phases ? For example , how to find the sequence of step names for searchable snapshot action in cold phase ? I know that we can use ilm explain api, but that will… --- ## [Index routing allocation does appear to move shards over to specified node](https://discuss.elastic.co/t/index-routing-allocation-does-appear-to-move-shards-over-to-specified-node/292682)
**Author:** [@Kay\_Khan](https://discuss.elastic.co/u/Kay_Khan)\ **Replies:** 6\ **Last updated:** [December 22, 2021, 3:34pm UTC](https://discuss.elastic.co/t/index-routing-allocation-does-appear-to-move-shards-over-to-specified-node/292682 "2021-12-22T15:34:33Z")
I am trying to separate indexes so that they are assigned to specific nodes. I have been following this documentation in order to achieve that. I have an Elasticsearch cluster with 3 nodes. Each node has been given a … --- ## [Patch log4j vulnerability on Windows](https://discuss.elastic.co/t/patch-log4j-vulnerability-on-windows/292679)
**Author:** [@Erni](https://discuss.elastic.co/u/Erni)\ **Replies:** 1\ **Last updated:** [December 22, 2021, 2:15pm UTC](https://discuss.elastic.co/t/patch-log4j-vulnerability-on-windows/292679 "2021-12-22T14:15:09Z")
Hi, I was following instructions from: Elasticsearch 5.0.0-5.6.10 and 6.0.0-6.3.2: Log4j CVE-2021-44228, CVE-2021-45046 remediation But changed it to powershell commands as I am runnng elasticsearch on Windows: Copy-I… --- ## [Search.max\_buckets limit error on 7.6.0 even after setting to 10000](https://discuss.elastic.co/t/search-max-buckets-limit-error-on-7-6-0-even-after-setting-to-10000/292688)
**Author:** [@Nipun\_Tulsyan](https://discuss.elastic.co/u/Nipun_Tulsyan)\ **Replies:** 0\ **Last updated:** [December 22, 2021, 1:36pm UTC](https://discuss.elastic.co/t/search-max-buckets-limit-error-on-7-6-0-even-after-setting-to-10000/292688 "2021-12-22T13:36:19Z")
I am using a simple query with aggregation. GET testIndex/\_search { "size": 0, "aggs": { "Name1": { "terms": { "field": "field1.keyword", "size": 10000 } }, "Name2":{ "… --- ## [Waiting for elected master node in Rolling upgrade](https://discuss.elastic.co/t/waiting-for-elected-master-node-in-rolling-upgrade/292576)
**Author:** [@maadhav](https://discuss.elastic.co/u/maadhav)\ **Replies:** 4\ **Last updated:** [December 22, 2021, 10:45am UTC](https://discuss.elastic.co/t/waiting-for-elected-master-node-in-rolling-upgrade/292576 "2021-12-22T10:45:38Z")
Hi Team We upgraded Elasticsearch cluster from version 7.13.3 to version 7.16.1 using Rolling upgrade. We upgraded each node one by one, considering non-master nodes first and master nodes in last. The cluster got upgr… --- ## [Log4j Vulnerability: JVM Options not picked from location mentioned in %ES\_PATH\_CONF%](https://discuss.elastic.co/t/log4j-vulnerability-jvm-options-not-picked-from-location-mentioned-in-es-path-conf/292516)
**Author:** [@nikhilagrawaldotnet](https://discuss.elastic.co/u/nikhilagrawaldotnet)\ **Replies:** 3\ **Last updated:** [December 22, 2021, 9:52am UTC](https://discuss.elastic.co/t/log4j-vulnerability-jvm-options-not-picked-from-location-mentioned-in-es-path-conf/292516 "2021-12-22T09:52:47Z")
Does anyone know why setting option -Dlog4j2.formatMsgNoLookups=true in jvm.options file does not work? Elasticsearch version (bin/elasticsearch --version): 7.5.1 Plugins installed: None JVM version (java -version): … --- ## [No shard is getting assigned on one of the data node](https://discuss.elastic.co/t/no-shard-is-getting-assigned-on-one-of-the-data-node/292575)
**Author:** [@pratiksha](https://discuss.elastic.co/u/pratiksha)\ **Replies:** 7\ **Last updated:** [December 22, 2021, 8:24am UTC](https://discuss.elastic.co/t/no-shard-is-getting-assigned-on-one-of-the-data-node/292575 "2021-12-22T08:24:17Z")
I have a cluster running with 10 data, 3 master and 3 client nodes. I am facing issue on one of data node where no shard is able to get assign on it. \_cluster/allocation/explain is giving below message: { "node\_i… --- ## [Elasticsearch clusterstate data](https://discuss.elastic.co/t/elasticsearch-clusterstate-data/292392)
**Author:** [@qixian](https://discuss.elastic.co/u/qixian)\ **Replies:** 11\ **Last updated:** [December 22, 2021, 8:22am UTC](https://discuss.elastic.co/t/elasticsearch-clusterstate-data/292392 "2021-12-22T08:22:03Z")
hello,I have a question need to have a answer，which is if my master es nodes have multi datapaths,the clusterstate data will be saved Multiple and which is Exactly the same [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=519) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=521)