# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=522 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 523 --- ## [Watcher for Heartbeat : challenging questions](https://discuss.elastic.co/t/watcher-for-heartbeat-challenging-questions/292454)
**Author:** [@appleyin1](https://discuss.elastic.co/u/appleyin1)\ **Replies:** 0\ **Last updated:** [December 20, 2021, 11:34am UTC](https://discuss.elastic.co/t/watcher-for-heartbeat-challenging-questions/292454 "2021-12-20T11:34:10Z")
Hi there: Need your advice in the following, “A cluster has configured with the heartbeat check for 10 URL. If 1 out of 10 heartbeat of the URL is down I would like the Watcher to be able send an email with monitor ID … --- ## [Elastic Cluster State Restore never really works for .kibana-x.x.x index (workarounds need to be applied)](https://discuss.elastic.co/t/elastic-cluster-state-restore-never-really-works-for-kibana-x-x-x-index-workarounds-need-to-be-applied/292491)
**Author:** [@Kosodrom](https://discuss.elastic.co/u/Kosodrom)\ **Replies:** 0\ **Last updated:** [December 20, 2021, 4:37pm UTC](https://discuss.elastic.co/t/elastic-cluster-state-restore-never-really-works-for-kibana-x-x-x-index-workarounds-need-to-be-applied/292491 "2021-12-20T16:37:04Z")
Hi, when I try to restore cluster state of a cluster with different version (for example right now I want to restore 7.13.2 to 7.16.2) from a snapshot the .kibana instance always crashes with the error: "type":"log","@… --- ## [Search Template : Watcher](https://discuss.elastic.co/t/search-template-watcher/292515)
**Author:** [@appleyin1](https://discuss.elastic.co/u/appleyin1)\ **Replies:** 0\ **Last updated:** [December 21, 2021, 3:36am UTC](https://discuss.elastic.co/t/search-template-watcher/292515 "2021-12-21T03:36:15Z")
Is that possible to create watcher with conditions and send an email if the conditions meet in a search template? Thanks --- ## [Wireshark json file cannot display in separate fields in Elasticsearch](https://discuss.elastic.co/t/wireshark-json-file-cannot-display-in-separate-fields-in-elasticsearch/291381)
**Author:** [@lauyatkin](https://discuss.elastic.co/u/lauyatkin)\ **Replies:** 30\ **Last updated:** [December 21, 2021, 2:38am UTC](https://discuss.elastic.co/t/wireshark-json-file-cannot-display-in-separate-fields-in-elasticsearch/291381 "2021-12-21T02:38:42Z")
I have investigated for a month and still cannot find a solution to structure the json data captured by Wireshark. I am using FileBeat in Elastic to import json data. However, all the json data are packed to the "message… --- ## [What is "score" in elasticsearch](https://discuss.elastic.co/t/what-is-score-in-elasticsearch/292498)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 2\ **Last updated:** [December 21, 2021, 1:32am UTC](https://discuss.elastic.co/t/what-is-score-in-elasticsearch/292498 "2021-12-21T01:32:55Z")
I want to understand the concept of score in Elasticsearch with an example and how it is work search engine. --- ## [Restoring deleted indexes from a data stream](https://discuss.elastic.co/t/restoring-deleted-indexes-from-a-data-stream/292512)
**Author:** [@Russell\_Fulton](https://discuss.elastic.co/u/Russell_Fulton)\ **Replies:** 0\ **Last updated:** [December 20, 2021, 11:29pm UTC](https://discuss.elastic.co/t/restoring-deleted-indexes-from-a-data-stream/292512 "2021-12-20T23:29:52Z")
I bungled setting up the retention policy for a data stream with the result that a bunch of indexes have been deleted when they should not have been. I have snapshots of most of the indexes scattered across several snap… --- ## [Default language for language detection](https://discuss.elastic.co/t/default-language-for-language-detection/292470)
**Author:** [@uu99ix](https://discuss.elastic.co/u/uu99ix)\ **Replies:** 2\ **Last updated:** [December 21, 2021, 1:01am UTC](https://discuss.elastic.co/t/default-language-for-language-detection/292470 "2021-12-21T01:01:37Z")
I don't know if this is the right category to post under, sorry if it's not. I followed this guide: Language identification | Machine Learning in the Elastic Stack \[7.16\] | Elastic and it seems to return Japanese ("ja")… --- ## [Invalid snapshot name, snapshot with the same name already exists](https://discuss.elastic.co/t/invalid-snapshot-name-snapshot-with-the-same-name-already-exists/292497)
**Author:** [@Ludovic9](https://discuss.elastic.co/u/Ludovic9)\ **Replies:** 3\ **Last updated:** [December 20, 2021, 11:29pm UTC](https://discuss.elastic.co/t/invalid-snapshot-name-snapshot-with-the-same-name-already-exists/292497 "2021-12-20T23:29:26Z")
Hello I have an index in my cluster with datas. The datas are shipped from logstatsh with this configuration index =\> "%{\[@metadata\]\[beat\]}-%{\[@metadata\]\[version\]}-%{+YYYY.MM}" So the index is named with the year and … --- ## [Elasticsearch OSS](https://discuss.elastic.co/t/elasticsearch-oss/292501)
**Author:** [@kfull6\_nike](https://discuss.elastic.co/u/kfull6_nike)\ **Replies:** 4\ **Last updated:** [December 20, 2021, 10:03pm UTC](https://discuss.elastic.co/t/elasticsearch-oss/292501 "2021-12-20T22:03:42Z")
I noticed that for the latest log4j2 vulnerabilities ES was updated. Any idea if and when Elasticsearch-oss will be updated? --- ## [Elasticsearch TSL configuration issue](https://discuss.elastic.co/t/elasticsearch-tsl-configuration-issue/292230)
**Author:** [@userR](https://discuss.elastic.co/u/userR)\ **Replies:** 4\ **Last updated:** [December 20, 2021, 9:12pm UTC](https://discuss.elastic.co/t/elasticsearch-tsl-configuration-issue/292230 "2021-12-20T21:12:06Z")
Following list of instructions here after configuring the basic security: Set up basic security for the Elastic Stack | Elasticsearch Guide \[7.16\] | Elastic Instead of ./bin, I am doing /usr/share/Elasticsearch/bin ... … --- ## [Update field vaule with base64 encode](https://discuss.elastic.co/t/update-field-vaule-with-base64-encode/292117)
**Author:** [@kannan\_raj](https://discuss.elastic.co/u/kannan_raj)\ **Replies:** 1\ **Last updated:** [December 20, 2021, 7:53pm UTC](https://discuss.elastic.co/t/update-field-vaule-with-base64-encode/292117 "2021-12-20T19:53:00Z")
Hello Team, I got a requirement that have to query and update some fields value with base64 code for all documents. can we change the field value to base64 by using \_update\_by\_query API. Ex: POST test/\_doc { "foo… --- ## [Long value displayed incorrectly in watcher email](https://discuss.elastic.co/t/long-value-displayed-incorrectly-in-watcher-email/292502)
**Author:** [@keyu](https://discuss.elastic.co/u/keyu)\ **Replies:** 0\ **Last updated:** [December 20, 2021, 7:38pm UTC](https://discuss.elastic.co/t/long-value-displayed-incorrectly-in-watcher-email/292502 "2021-12-20T19:38:58Z")
Hi, I have created runtime field using a field price(type is float). The runtime field is a long type field. "runtime\_mappings": { "longPrice": { "type": "long", "script": """ … --- ## [Where are the Rally node-stats saved?](https://discuss.elastic.co/t/where-are-the-rally-node-stats-saved/292496)
**Author:** [@toddschilling](https://discuss.elastic.co/u/toddschilling)\ **Replies:** 2\ **Last updated:** [December 20, 2021, 6:28pm UTC](https://discuss.elastic.co/t/where-are-the-rally-node-stats-saved/292496 "2021-12-20T18:28:50Z")
I must be missing something obvious. I turned on the node-stats telemetry for my benchmark test. Only process stats are turned on and I can change the log levels to DEBUG and see that the calls are being made during my… --- ## [Failure with sorts and new co.elastic.clients:elasticsearch-java client](https://discuss.elastic.co/t/failure-with-sorts-and-new-co-elastic-clients-elasticsearch-java-client/291511)
**Author:** [@ilgrosso](https://discuss.elastic.co/u/ilgrosso)\ **Replies:** 13\ **Last updated:** [December 20, 2021, 4:53pm UTC](https://discuss.elastic.co/t/failure-with-sorts-and-new-co-elastic-clients-elasticsearch-java-client/291511 "2021-12-20T16:53:14Z")
I am upgrading from Java High-level REST client 7.15 to the new Java client. I am almost done, it seems only one issue is left. I am currently using bare Map\ for documents, hence my index requests look … --- ## [Elasticsearch pod in Kubernetes failing for v 7.16.1](https://discuss.elastic.co/t/elasticsearch-pod-in-kubernetes-failing-for-v-7-16-1/292489)
**Author:** [@Arghya\_Chakraborty](https://discuss.elastic.co/u/Arghya_Chakraborty)\ **Replies:** 0\ **Last updated:** [December 20, 2021, 4:28pm UTC](https://discuss.elastic.co/t/elasticsearch-pod-in-kubernetes-failing-for-v-7-16-1/292489 "2021-12-20T16:28:51Z")
We are using Helm chart from GitHub - elastic/helm-charts: You know, for Kubernetes to deploy Elasticsearch & Kibana in AWS EKS cluster (Elasticsearch & kibana version: 7.15.0). While upgrading Elasticsearch version to 7… --- ## [Elastic Search Child Object filter](https://discuss.elastic.co/t/elastic-search-child-object-filter/292483)
**Author:** [@Tom\_Johnson](https://discuss.elastic.co/u/Tom_Johnson)\ **Replies:** 0\ **Last updated:** [December 20, 2021, 4:00pm UTC](https://discuss.elastic.co/t/elastic-search-child-object-filter/292483 "2021-12-20T16:00:43Z")
Hi All, I'm a beginner of Elasticsearch, My Elasticsearch response as below: { "took": 30, "timed\_out": false, "\_shards": { "total": 1, "successful": 1, "skipped": 0, "failed… --- ## [New Stack new problems - illegal\_argument\_exeption](https://discuss.elastic.co/t/new-stack-new-problems-illegal-argument-exeption/292341)
**Author:** [@Orpheus](https://discuss.elastic.co/u/Orpheus)\ **Replies:** 2\ **Last updated:** [December 20, 2021, 2:17pm UTC](https://discuss.elastic.co/t/new-stack-new-problems-illegal-argument-exeption/292341 "2021-12-20T14:17:37Z")
Hi, so due to a previous post's issues, I created a new ELK stack on a new machine. Completely re-installed the OS and recreated ELK with filebeats. After the installation and configurations, I get a new error saying "1… --- ## [Different sizes of nodes Shard /0 with segment files \`\_\_\*\*\*\`](https://discuss.elastic.co/t/different-sizes-of-nodes-shard-0-with-segment-files/292326)
**Author:** [@christians](https://discuss.elastic.co/u/christians)\ **Replies:** 3\ **Last updated:** [December 20, 2021, 1:24pm UTC](https://discuss.elastic.co/t/different-sizes-of-nodes-shard-0-with-segment-files/292326 "2021-12-20T13:24:55Z")
Hello, Hope this letter finds you well. Could you please help me with a question that i have. My question is about the generation of several segment files are incremented on a Node. I used elastic 6.8.12 and I have th… --- ## [Elastic Inconsistent log rotation(log4j2)](https://discuss.elastic.co/t/elastic-inconsistent-log-rotation-log4j2/292459)
**Author:** [@anandd4](https://discuss.elastic.co/u/anandd4)\ **Replies:** 0\ **Last updated:** [December 20, 2021, 11:55am UTC](https://discuss.elastic.co/t/elastic-inconsistent-log-rotation-log4j2/292459 "2021-12-20T11:55:36Z")
Problem Statement - Elastic log rotation(rolling.old & rolling) is inconsistent and displays random behavior across different nodes. We have noticed 3 main issues - log rotation doesn't happen daily as configured via … --- ## [Sudden unexplained increase in system load and read operations resulting in very slow indexing](https://discuss.elastic.co/t/sudden-unexplained-increase-in-system-load-and-read-operations-resulting-in-very-slow-indexing/292456)
**Author:** [@dd76](https://discuss.elastic.co/u/dd76)\ **Replies:** 0\ **Last updated:** [December 20, 2021, 11:40am UTC](https://discuss.elastic.co/t/sudden-unexplained-increase-in-system-load-and-read-operations-resulting-in-very-slow-indexing/292456 "2021-12-20T11:40:23Z")
We are running Elasticsearch 7.12.0 and have recently seen system load and read operations suddenly increase significantly on one data node despite there being no change to the number of query/index operations being exec… --- ## [Elastic Search, logstash and filebeat OSS 7.10.2 - Log4j Patch](https://discuss.elastic.co/t/elastic-search-logstash-and-filebeat-oss-7-10-2-log4j-patch/292425)
**Author:** [@marisubu](https://discuss.elastic.co/u/marisubu)\ **Replies:** 1\ **Last updated:** [December 20, 2021, 7:48am UTC](https://discuss.elastic.co/t/elastic-search-logstash-and-filebeat-oss-7-10-2-log4j-patch/292425 "2021-12-20T07:48:56Z")
Hi We are currently using the OSS 7.10.2 version elastic stack in our product. Will there be any Patch(log4j upgrade to latest version) for this version for elastic stack? Thanks --- ## [Help me! Search kanji and hikarana (kuromoji and Fuzziness)](https://discuss.elastic.co/t/help-me-search-kanji-and-hikarana-kuromoji-and-fuzziness/292272)
**Author:** [@mai\_quoc\_son](https://discuss.elastic.co/u/mai_quoc_son)\ **Replies:** 2\ **Last updated:** [December 20, 2021, 6:05am UTC](https://discuss.elastic.co/t/help-me-search-kanji-and-hikarana-kuromoji-and-fuzziness/292272 "2021-12-20T06:05:50Z")
I setting Index : mapping : Data : Create Index: Query search : Result : Please help me , i want result 3 row by query. Thanks I read info and demo in --- ## [Mirgation guide from 6.2.3 to 6.8.21?](https://discuss.elastic.co/t/mirgation-guide-from-6-2-3-to-6-8-21/291990)
**Author:** [@asp](https://discuss.elastic.co/u/asp)\ **Replies:** 2\ **Last updated:** [December 20, 2021, 6:02am UTC](https://discuss.elastic.co/t/mirgation-guide-from-6-2-3-to-6-8-21/291990 "2021-12-20T06:02:37Z")
Hi, we have one instance of elk stack of version 6.2.3. All components are running as docker images. To get rid of log4j CVEs we need to upgrade to latest 6.x version. Can I upgrade to latest 6.x. directly or do I nee… --- ## [How can we delete an index based on a scheduler using JAVA API's?](https://discuss.elastic.co/t/how-can-we-delete-an-index-based-on-a-scheduler-using-java-apis/292396)
**Author:** [@yash\_196](https://discuss.elastic.co/u/yash_196)\ **Replies:** 4\ **Last updated:** [December 20, 2021, 5:54am UTC](https://discuss.elastic.co/t/how-can-we-delete-an-index-based-on-a-scheduler-using-java-apis/292396 "2021-12-20T05:54:17Z")
Can anyone help me with a java code that can delete index based on a schedule? --- ## [CVE-2021-45105 for ELK 7.10.2](https://discuss.elastic.co/t/cve-2021-45105-for-elk-7-10-2/292420)
**Author:** [@Ram\_N](https://discuss.elastic.co/u/Ram_N)\ **Replies:** 3\ **Last updated:** [December 20, 2021, 3:51am UTC](https://discuss.elastic.co/t/cve-2021-45105-for-elk-7-10-2/292420 "2021-12-20T03:51:35Z")
Hi Pertaining to 44228, we have deleted the vulnerable class as per ELK suggestion. For this new 45105, do we need to take any action ? I read default Elasticsearch, logstash, Kibana 7.10.2 are not vulnerable. Is that f… --- ## [When will the next patch be released for Elasticsearch](https://discuss.elastic.co/t/when-will-the-next-patch-be-released-for-elasticsearch/292066)
**Author:** [@Aydan](https://discuss.elastic.co/u/Aydan)\ **Replies:** 7\ **Last updated:** [December 20, 2021, 3:41am UTC](https://discuss.elastic.co/t/when-will-the-next-patch-be-released-for-elasticsearch/292066 "2021-12-20T03:41:03Z")
When will be the next patch for Elasticsearch? --- ## [Shard Siem cause cluster red](https://discuss.elastic.co/t/shard-siem-cause-cluster-red/292107)
**Author:** [@labate](https://discuss.elastic.co/u/labate)\ **Replies:** 1\ **Last updated:** [December 20, 2021, 1:17am UTC](https://discuss.elastic.co/t/shard-siem-cause-cluster-red/292107 "2021-12-20T01:17:36Z")
Hello everyone, I have a problem with my .siem-signals-default index. The shard goes to red status and I can't reallocate the shard to another node. Because the shard seems to not be in my cluster and I can't get it bac… --- ## [Elastic SearchResponse - How to get raw response result](https://discuss.elastic.co/t/elastic-searchresponse-how-to-get-raw-response-result/291999)
**Author:** [@thadc](https://discuss.elastic.co/u/thadc)\ **Replies:** 0\ **Last updated:** [December 15, 2021, 2:56pm UTC](https://discuss.elastic.co/t/elastic-searchresponse-how-to-get-raw-response-result/291999 "2021-12-15T14:56:19Z")
I have a need to get the raw response from the Elasticsearch SearchResponse object. We have situations where navigating the hits/aggregations-based structure is too rigid for our formatting the response back to user. Gra… --- ## [Elasti search reindexing indexes only few 1000 or more documents but not to the original count of orginal index](https://discuss.elastic.co/t/elasti-search-reindexing-indexes-only-few-1000-or-more-documents-but-not-to-the-original-count-of-orginal-index/292044)
**Author:** [@Darshan\_R](https://discuss.elastic.co/u/Darshan_R)\ **Replies:** 1\ **Last updated:** [December 20, 2021, 1:12am UTC](https://discuss.elastic.co/t/elasti-search-reindexing-indexes-only-few-1000-or-more-documents-but-not-to-the-original-count-of-orginal-index/292044 "2021-12-20T01:12:40Z")
Elasti csearch reindexing indexes only few 1000 or more documents but not to the original count of orginal index I am using using AWS step functions with lambda to run reindexing for all 33 index paralley out of 33 onl… --- ## [Adds a new field inside in the existing index](https://discuss.elastic.co/t/adds-a-new-field-inside-in-the-existing-index/292030)
**Author:** [@rav3n](https://discuss.elastic.co/u/rav3n)\ **Replies:** 1\ **Last updated:** [December 20, 2021, 1:12am UTC](https://discuss.elastic.co/t/adds-a-new-field-inside-in-the-existing-index/292030 "2021-12-20T01:12:16Z")
Hey there, I'm trying to add a new field to the already existing index but every time I get this error : { "error" : { "root\_cause" : \[ { "type" : "mapper\_exception", "reason" : "the \[includ… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=521) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=523)