# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=521 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 522 --- ## [Elasticsearch log4j 2.17.0 replace](https://discuss.elastic.co/t/elasticsearch-log4j-2-17-0-replace/292644)
**Author:** [@qixian](https://discuss.elastic.co/u/qixian)\ **Replies:** 2\ **Last updated:** [December 22, 2021, 7:00am UTC](https://discuss.elastic.co/t/elasticsearch-log4j-2-17-0-replace/292644 "2021-12-22T07:00:07Z")
hello，I want to know whether all the Elasticsearch release version has been installed could replace the log4j 2.17.0 then rolling restart --- ## [How to process csv data from multiple folders using file beat and create separate index and move it to elastic search](https://discuss.elastic.co/t/how-to-process-csv-data-from-multiple-folders-using-file-beat-and-create-separate-index-and-move-it-to-elastic-search/292641)
**Author:** [@data123](https://discuss.elastic.co/u/data123)\ **Replies:** 1\ **Last updated:** [December 22, 2021, 6:52am UTC](https://discuss.elastic.co/t/how-to-process-csv-data-from-multiple-folders-using-file-beat-and-create-separate-index-and-move-it-to-elastic-search/292641 "2021-12-22T06:52:49Z")
Hi Team, Our requirement is like this... we have log files stored in different folders under master folder as csv format. we want to send this to Elasticsearch using file beats as a part of automation. we cant find s… --- ## [How to make a plugin for elasticsearch 5.6.16?](https://discuss.elastic.co/t/how-to-make-a-plugin-for-elasticsearch-5-6-16/292561)
**Author:** [@dishant](https://discuss.elastic.co/u/dishant)\ **Replies:** 2\ **Last updated:** [December 22, 2021, 4:44am UTC](https://discuss.elastic.co/t/how-to-make-a-plugin-for-elasticsearch-5-6-16/292561 "2021-12-22T04:44:15Z")
I tried a lot finding about it on the internet but not getting anything that works. I have been able to build a plugin for Elasticsearch 7.11.1 and used gradle 6.8.2 for that. But not able to make the same for Elasticsea… --- ## [Displaying the application log data in Kibana - Log file content field is missing in Elasticsearch](https://discuss.elastic.co/t/displaying-the-application-log-data-in-kibana-log-file-content-field-is-missing-in-elasticsearch/292448)
**Author:** [@online](https://discuss.elastic.co/u/online)\ **Replies:** 1\ **Last updated:** [December 22, 2021, 2:58am UTC](https://discuss.elastic.co/t/displaying-the-application-log-data-in-kibana-log-file-content-field-is-missing-in-elasticsearch/292448 "2021-12-22T02:58:50Z")
Hello Friends, I am trying to setup an Elasticsearch index to display log contents from an application using Kibana. I setup the Filebeat on my application server and it created an index with 25 fields in Elasticsearch.… --- ## [Filter a field](https://discuss.elastic.co/t/filter-a-field/292549)
**Author:** [@scar](https://discuss.elastic.co/u/scar)\ **Replies:** 1\ **Last updated:** [December 21, 2021, 11:59pm UTC](https://discuss.elastic.co/t/filter-a-field/292549 "2021-12-21T23:59:17Z")
I want to filter a field, for example filter an array field by only returning the values I want. i try it using the source filter but don't do what i expected --- ## [ElasticSearch: search\_after with refresh](https://discuss.elastic.co/t/elasticsearch-search-after-with-refresh/292608)
**Author:** [@sag-tobias-frey](https://discuss.elastic.co/u/sag-tobias-frey)\ **Replies:** 1\ **Last updated:** [December 21, 2021, 9:18pm UTC](https://discuss.elastic.co/t/elasticsearch-search-after-with-refresh/292608 "2021-12-21T21:18:17Z")
Hello, I have searched for quite some time but did not find an answer yet. I'm currently looking into doing some pagination over my data. I have stumbled across the search\_after functionality. The queries work quite nic… --- ## [Elasticsearch get all unique Ids](https://discuss.elastic.co/t/elasticsearch-get-all-unique-ids/292589)
**Author:** [@iamtheschmitzer](https://discuss.elastic.co/u/iamtheschmitzer)\ **Replies:** 5\ **Last updated:** [December 21, 2021, 9:08pm UTC](https://discuss.elastic.co/t/elasticsearch-get-all-unique-ids/292589 "2021-12-21T21:08:12Z")
Thanks to all who read this for your help. Background: I have a job that when executing inserts a document. The job can fail and run again, inserting a second document. Both have the same linkId- so I know there is o… --- ## [Wildcard query returns 0 result](https://discuss.elastic.co/t/wildcard-query-returns-0-result/290549)
**Author:** [@Wonder\_Garance](https://discuss.elastic.co/u/Wonder_Garance)\ **Replies:** 4\ **Last updated:** [December 21, 2021, 8:07pm UTC](https://discuss.elastic.co/t/wildcard-query-returns-0-result/290549 "2021-12-21T20:07:55Z")
I have a problem with the char '?' in the wildcard query, the query below returns 0 result { "query": { "span\_near": { "clauses": \[ { "span\_multi": { "match": { "w… --- ## [Reindex: how Elastic handle index names](https://discuss.elastic.co/t/reindex-how-elastic-handle-index-names/291336)
**Author:** [@mauog](https://discuss.elastic.co/u/mauog)\ **Replies:** 1\ **Last updated:** [December 21, 2021, 6:59pm UTC](https://discuss.elastic.co/t/reindex-how-elastic-handle-index-names/291336 "2021-12-21T18:59:15Z")
Hello, I read sometime that some operation are impossible on current index and so the strategy is to create a new one an the reindex there all the data stored. I'm a newbie here and this could be a stupid question but … --- ## [Certificate problems adding node to cluster](https://discuss.elastic.co/t/certificate-problems-adding-node-to-cluster/292511)
**Author:** [@Russell\_Fulton](https://discuss.elastic.co/u/Russell_Fulton)\ **Replies:** 2\ **Last updated:** [December 21, 2021, 6:38pm UTC](https://discuss.elastic.co/t/certificate-problems-adding-node-to-cluster/292511 "2021-12-21T18:38:57Z")
I am preparing to turn on "security" on my production cluster by setting up a test cluster first. I have a single node running fine with security enabled but when I try and bring up a second node with the same configura… --- ## [Does cluster.routing.allocation.cluster\_concurrent\_rebalance limit the number of reallocation due to a high watermark?](https://discuss.elastic.co/t/does-cluster-routing-allocation-cluster-concurrent-rebalance-limit-the-number-of-reallocation-due-to-a-high-watermark/292555)
**Author:** [@alsyia](https://discuss.elastic.co/u/alsyia)\ **Replies:** 1\ **Last updated:** [December 21, 2021, 5:15pm UTC](https://discuss.elastic.co/t/does-cluster-routing-allocation-cluster-concurrent-rebalance-limit-the-number-of-reallocation-due-to-a-high-watermark/292555 "2021-12-21T17:15:22Z")
Hello, We had an event this morning were a node reached its high watermark. Elasticsearch decided to move 21 of its shards. We didn't modify cluster.routing.allocation.cluster\_concurrent\_rebalance, so it should limit t… --- ## [Significant text aggregation on multiple fields](https://discuss.elastic.co/t/significant-text-aggregation-on-multiple-fields/292585)
**Author:** [@Manisekhar\_techo](https://discuss.elastic.co/u/Manisekhar_techo)\ **Replies:** 0\ **Last updated:** [December 21, 2021, 5:02pm UTC](https://discuss.elastic.co/t/significant-text-aggregation-on-multiple-fields/292585 "2021-12-21T17:02:19Z")
Hi I'm using the multi\_match query for search with phrase keyword, in the aggregations, I'm using significant\_text aggregation, But I can only specify one field is there any way to perform that aggregation on multiple… --- ## [Elastic Stack Cloud Subscription](https://discuss.elastic.co/t/elastic-stack-cloud-subscription/292449)
**Author:** [@Thamini\_NellaiKumar](https://discuss.elastic.co/u/Thamini_NellaiKumar)\ **Replies:** 3\ **Last updated:** [December 21, 2021, 4:38pm UTC](https://discuss.elastic.co/t/elastic-stack-cloud-subscription/292449 "2021-12-21T16:38:24Z")
Hi, I would like to know the difference between getting elastic cloud subscription separately and hosting elastic from the existing Azure subscription --- ## [ILM shrink and warm node](https://discuss.elastic.co/t/ilm-shrink-and-warm-node/292357)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 8\ **Last updated:** [December 21, 2021, 2:42pm UTC](https://discuss.elastic.co/t/ilm-shrink-and-warm-node/292357 "2021-12-21T14:42:16Z")
I have setup ILM policy with shrink but not working. what am I missing PUT \_ilm/policy/metricbeat { "policy": { "phases": { "hot": { "min\_age": "0ms", "actions": { "rollover": { … --- ## [Field exist query to check nested type field exists for a doc](https://discuss.elastic.co/t/field-exist-query-to-check-nested-type-field-exists-for-a-doc/292152)
**Author:** [@sudheesh](https://discuss.elastic.co/u/sudheesh)\ **Replies:** 0\ **Last updated:** [December 16, 2021, 12:40pm UTC](https://discuss.elastic.co/t/field-exist-query-to-check-nested-type-field-exists-for-a-doc/292152 "2021-12-16T12:40:23Z")
This is the template for my index PUT employee\_index { "mappings":{ "properties": { "role": { "type": "text" }, "Employee": { "type": "nested", "properties": { … --- ## [How to resolve "Failed to poll for work. Work has timed out" error](https://discuss.elastic.co/t/how-to-resolve-failed-to-poll-for-work-work-has-timed-out-error/291538)
**Author:** [@mertkaant](https://discuss.elastic.co/u/mertkaant)\ **Replies:** 3\ **Last updated:** [December 21, 2021, 12:02pm UTC](https://discuss.elastic.co/t/how-to-resolve-failed-to-poll-for-work-work-has-timed-out-error/291538 "2021-12-21T12:02:27Z")
Hello, dear elastic community, We recently upgraded our ELK stack to 7.15.2 from 7.7.0. All my nodes are on the same version (7.15.2) After the upgrade, our Kibana's status goes yellow repeatedly. When it goes yellow … --- ## [No signature of method: java.util.ArrayList.get() is applicable for argument types: (org.codehaus.groovy.runtime.GStringImpl)](https://discuss.elastic.co/t/no-signature-of-method-java-util-arraylist-get-is-applicable-for-argument-types-org-codehaus-groovy-runtime-gstringimpl/292554)
**Author:** [@dishant](https://discuss.elastic.co/u/dishant)\ **Replies:** 0\ **Last updated:** [December 21, 2021, 11:51am UTC](https://discuss.elastic.co/t/no-signature-of-method-java-util-arraylist-get-is-applicable-for-argument-types-org-codehaus-groovy-runtime-gstringimpl/292554 "2021-12-21T11:51:53Z")
I am trying to make an Elasticsearch plugin for Elasticsearch version 5.6.16 and using the gradle version 4.7. I am using oracle jdk9. Whenever, I'm trying to create the project build, it is giving me an error. I have su… --- ## [Esrally warmup explaination](https://discuss.elastic.co/t/esrally-warmup-explaination/291307)
**Author:** [@fentom](https://discuss.elastic.co/u/fentom)\ **Replies:** 2\ **Last updated:** [December 21, 2021, 11:13am UTC](https://discuss.elastic.co/t/esrally-warmup-explaination/291307 "2021-12-21T11:13:54Z")
Hi, I'm new to Elasticsearch and ESRally. I want to run some benchmarks but I don't understand how the warmup-iterations parameter for tracks works. Documentation says "Number of iterations that each client should execu… --- ## [Manage Thread Pool in Elasticsearch](https://discuss.elastic.co/t/manage-thread-pool-in-elasticsearch/292493)
**Author:** [@yash\_196](https://discuss.elastic.co/u/yash_196)\ **Replies:** 6\ **Last updated:** [December 21, 2021, 10:22am UTC](https://discuss.elastic.co/t/manage-thread-pool-in-elasticsearch/292493 "2021-12-21T10:22:48Z")
Hi Team, Is there any way to increase the queue size for write and search using JAVA API's / High Level Rest Client? --- ## [Save a field into another index](https://discuss.elastic.co/t/save-a-field-into-another-index/292455)
**Author:** [@Kosodrom](https://discuss.elastic.co/u/Kosodrom)\ **Replies:** 2\ **Last updated:** [December 21, 2021, 10:18am UTC](https://discuss.elastic.co/t/save-a-field-into-another-index/292455 "2021-12-21T10:18:55Z")
Hi folks, I am using the mapper size plugin to save the size of the document to be able to create dashboards, so a developer can see how much log data he produces within his containers in kubernetes/openshift. I am usin… --- ## [Elasticsearch 7.3.2 log4j2 properties changes](https://discuss.elastic.co/t/elasticsearch-7-3-2-log4j2-properties-changes/292242)
**Author:** [@Siva\_Karan](https://discuss.elastic.co/u/Siva_Karan)\ **Replies:** 2\ **Last updated:** [December 21, 2021, 10:18am UTC](https://discuss.elastic.co/t/elasticsearch-7-3-2-log4j2-properties-changes/292242 "2021-12-21T10:18:24Z")
Hi , we are using the Elasticsearch 7.3.2 it runs on jdk8, for log4j2 properties changes what are the things need to do in JVM file. --- ## [Addressing log4j vulnerability for 1.x and 2.x elasticsearch](https://discuss.elastic.co/t/addressing-log4j-vulnerability-for-1-x-and-2-x-elasticsearch/292531)
**Author:** [@stecino](https://discuss.elastic.co/u/stecino)\ **Replies:** 1\ **Last updated:** [December 21, 2021, 8:47am UTC](https://discuss.elastic.co/t/addressing-log4j-vulnerability-for-1-x-and-2-x-elasticsearch/292531 "2021-12-21T08:47:07Z")
I am sure there are still people out there who are using this. Anyone with 1.7 and/or 2.3 that have to deal with this? --- ## [URI Parts Processor decodes an encoded & in URL query](https://discuss.elastic.co/t/uri-parts-processor-decodes-an-encoded-in-url-query/292534)
**Author:** [@plailla](https://discuss.elastic.co/u/plailla)\ **Replies:** 0\ **Last updated:** [December 21, 2021, 8:34am UTC](https://discuss.elastic.co/t/uri-parts-processor-decodes-an-encoded-in-url-query/292534 "2021-12-21T08:34:13Z")
Hello, I'm fairly new to the Elastic Stack. I've set up a cluster that receives Tomcat access logs from Filebeats. I'm using the default Ingest Pipeline created by the Apache module in Filebeat, which uses the processo… --- ## [Unexpected behaviour for auto\_create\_index](https://discuss.elastic.co/t/unexpected-behaviour-for-auto-create-index/292487)
**Author:** [@hapeka](https://discuss.elastic.co/u/hapeka)\ **Replies:** 4\ **Last updated:** [December 21, 2021, 8:15am UTC](https://discuss.elastic.co/t/unexpected-behaviour-for-auto-create-index/292487 "2021-12-21T08:15:53Z")
Hi, I have a question about the cluster setting "action.auto\_create\_index". I set it to "false" to avoid indices from being created automatically when a PUT is sent to index a document. It works without problem when I … --- ## [Receiving "timed out waiting for all nodes to process published state"](https://discuss.elastic.co/t/receiving-timed-out-waiting-for-all-nodes-to-process-published-state/291670)
**Author:** [@pratiksha](https://discuss.elastic.co/u/pratiksha)\ **Replies:** 13\ **Last updated:** [December 21, 2021, 7:44am UTC](https://discuss.elastic.co/t/receiving-timed-out-waiting-for-all-nodes-to-process-published-state/291670 "2021-12-21T07:44:44Z")
I am using Elasticsearch v6.6.1. There are total 16 nodes (10 data, 3 master, 3 client). I see a frequent message in elected master logs: {"type":"log","host":"Elasticsearch-master-55ff74b94d-ckhfw","level":"WARN", "ti… --- ## [Native controller process has stopped - no new native processes can be started and then elasticsearch node stoped](https://discuss.elastic.co/t/native-controller-process-has-stopped-no-new-native-processes-can-be-started-and-then-elasticsearch-node-stoped/292527)
**Author:** [@qinkkai](https://discuss.elastic.co/u/qinkkai)\ **Replies:** 0\ **Last updated:** [December 21, 2021, 6:43am UTC](https://discuss.elastic.co/t/native-controller-process-has-stopped-no-new-native-processes-can-be-started-and-then-elasticsearch-node-stoped/292527 "2021-12-21T06:43:50Z")
I have two nodes in my Elasticsearch cluster and have same configurations and environment. cat /etc/centos-release CentOS Linux release 7.8.2003 (Core) uname -r 3.10.0-1127.8.2.el7.x86\_64 sysctl vm.max\_map\_count vm… --- ## [Elasticsearch MUST query with nestedQuery() ScoreMode.NONE vs FILTER with nested Query SCOREMODE.NONE performance](https://discuss.elastic.co/t/elasticsearch-must-query-with-nestedquery-scoremode-none-vs-filter-with-nested-query-scoremode-none-performance/292524)
**Author:** [@Akshayyha\_Krishnamur](https://discuss.elastic.co/u/Akshayyha_Krishnamur)\ **Replies:** 0\ **Last updated:** [December 21, 2021, 5:56am UTC](https://discuss.elastic.co/t/elasticsearch-must-query-with-nestedquery-scoremode-none-vs-filter-with-nested-query-scoremode-none-performance/292524 "2021-12-21T05:56:56Z")
I am developing an Elasticsearch logic for searching certain fields and we are not concerned about relevance scoring. I already implemented the logic with MUST queries having nestedQuery ScoreMode.NONE. However, I came a… --- ## [Elasticsearch Re-indexing Issue](https://discuss.elastic.co/t/elasticsearch-re-indexing-issue/289529)
**Author:** [@Akshayyha\_Krishnamur](https://discuss.elastic.co/u/Akshayyha_Krishnamur)\ **Replies:** 7\ **Last updated:** [December 21, 2021, 5:42am UTC](https://discuss.elastic.co/t/elasticsearch-re-indexing-issue/289529 "2021-12-21T05:42:27Z")
We use a single node environment since we have adopted Elasticsearch recently. We are facing Elasticsearch indexing issues when 4 subsequent indexing requests were made at approximately 50 - 100ms interval each. Elastics… --- ## [How to calculate elapsed time between two events in different documents](https://discuss.elastic.co/t/how-to-calculate-elapsed-time-between-two-events-in-different-documents/292522)
**Author:** [@syunusic](https://discuss.elastic.co/u/syunusic)\ **Replies:** 0\ **Last updated:** [December 21, 2021, 5:42am UTC](https://discuss.elastic.co/t/how-to-calculate-elapsed-time-between-two-events-in-different-documents/292522 "2021-12-21T05:42:08Z")
Hi all, If I have a log with: @timestamp EVENTNO (Event number) and DEVICEID (Device ID) and this happen: always when a specific event occurs, it does have a start (EVENTNO="300095") and an end (EVENTNO="300096"). I … --- ## [Caught exception while handling client http traffic, closing connection Netty4HttpChannel{localAddress=/](https://discuss.elastic.co/t/caught-exception-while-handling-client-http-traffic-closing-connection-netty4httpchannel-localaddress/292521)
**Author:** [@haipeng.zhao](https://discuss.elastic.co/u/haipeng.zhao)\ **Replies:** 1\ **Last updated:** [December 21, 2021, 5:35am UTC](https://discuss.elastic.co/t/caught-exception-while-handling-client-http-traffic-closing-connection-netty4httpchannel-localaddress/292521 "2021-12-21T05:35:53Z")
{"type": "server", "timestamp": "2021-12-17T19:45:21,865Z", "level": "WARN", "component": "o.e.h.AbstractHttpServerTransport", "cluster.name": "dev", "node.name": "dev-es-data-node-hot-0", "message": "caught exception wh… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=520) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=522)