# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=525 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 526 --- ## [Date math index name throwing error in Watcher input](https://discuss.elastic.co/t/date-math-index-name-throwing-error-in-watcher-input/290638)
**Author:** [@Munavir\_Chavody](https://discuss.elastic.co/u/Munavir_Chavody)\ **Replies:** 1\ **Last updated:** [December 15, 2021, 4:05pm UTC](https://discuss.elastic.co/t/date-math-index-name-throwing-error-in-watcher-input/290638 "2021-12-15T16:05:41Z")
I've the date math name in one of the watcher search input as below. "indices": \["\<.watcher-history-13-{now/d}\>"\] But the execution fails with below error. "result": { "execution\_time": "2021-12-01T07:57:46.049Z",… --- ## [Drop some field when we restore](https://discuss.elastic.co/t/drop-some-field-when-we-restore/291915)
**Author:** [@kannan\_raj](https://discuss.elastic.co/u/kannan_raj)\ **Replies:** 1\ **Last updated:** [December 15, 2021, 2:37pm UTC](https://discuss.elastic.co/t/drop-some-field-when-we-restore/291915 "2021-12-15T14:37:38Z")
Hi Team, Is it possible to remove some fields while restoring indices from snapshots? Ex: let's assume the doc in the index and take the snapshot { "foo": "bar", "bar": "foo" } Here would like to remove the f… --- ## [ElasticSearch 7.9.2 getting issue with Query latency and Flush latency](https://discuss.elastic.co/t/elasticsearch-7-9-2-getting-issue-with-query-latency-and-flush-latency/291245)
**Author:** [@balac](https://discuss.elastic.co/u/balac)\ **Replies:** 2\ **Last updated:** [December 15, 2021, 1:55pm UTC](https://discuss.elastic.co/t/elasticsearch-7-9-2-getting-issue-with-query-latency-and-flush-latency/291245 "2021-12-15T13:55:32Z")
Hi , In Elasticsearch:7.9.2 we are getting Query latency and Flush Latency alert. We setup this new cluster and moved it from standalone ES cluster to 3 node cluster in kubernetes. We are monitoring ES cluster with Zabb… --- ## [Building oss tar from source code Elasticsearch 7.10](https://discuss.elastic.co/t/building-oss-tar-from-source-code-elasticsearch-7-10/291966)
**Author:** [@dhina](https://discuss.elastic.co/u/dhina)\ **Replies:** 0\ **Last updated:** [December 15, 2021, 12:10pm UTC](https://discuss.elastic.co/t/building-oss-tar-from-source-code-elasticsearch-7-10/291966 "2021-12-15T12:10:43Z")
Hi, References Is there a way we could build the oss version of the Elasticsearch from source code. We have a requirement like, we have to build the Elasticsearch OSS from source code and use it instead of downloadi… --- ## [Dynamic range in charts and alerts](https://discuss.elastic.co/t/dynamic-range-in-charts-and-alerts/291961)
**Author:** [@vishal\_bisa](https://discuss.elastic.co/u/vishal_bisa)\ **Replies:** 0\ **Last updated:** [December 15, 2021, 11:53am UTC](https://discuss.elastic.co/t/dynamic-range-in-charts-and-alerts/291961 "2021-12-15T11:53:06Z")
Hi Team, I have a query here regarding the Kibana dashboard where I have a guage chart to display the license count for a particular tool and also set up a watcher alert if the count is less than specific value, but now… --- ## [Unable to allocate index](https://discuss.elastic.co/t/unable-to-allocate-index/291919)
**Author:** [@usrrandom](https://discuss.elastic.co/u/usrrandom)\ **Replies:** 1\ **Last updated:** [December 15, 2021, 10:57am UTC](https://discuss.elastic.co/t/unable-to-allocate-index/291919 "2021-12-15T10:57:22Z")
Hi all, My ES index is showing red. It is a single node and has no replicas. Its running on version 5.5 On checking allocation status, I get the following { "index": "tm", "shard": 0, "primary": true, … --- ## [How to detect log4shell in the application logs?](https://discuss.elastic.co/t/how-to-detect-log4shell-in-the-application-logs/291947)
**Author:** [@Kosodrom](https://discuss.elastic.co/u/Kosodrom)\ **Replies:** 0\ **Last updated:** [December 15, 2021, 10:40am UTC](https://discuss.elastic.co/t/how-to-detect-log4shell-in-the-application-logs/291947 "2021-12-15T10:40:21Z")
Hi folks, I wonder if anyone of you guys have already tried to find possible log4shell exploit based on the logs in your elastic cluster using kibana. I am aware that this can be done using the Elastic Security as descr… --- ## [Tracking the cause of write queues](https://discuss.elastic.co/t/tracking-the-cause-of-write-queues/291865)
**Author:** [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Replies:** 5\ **Last updated:** [December 15, 2021, 10:30am UTC](https://discuss.elastic.co/t/tracking-the-cause-of-write-queues/291865 "2021-12-15T10:30:59Z")
Hello, I've been trying to find the cause of a high load the happens randomly on one of my hot nodes for a couple of months. Currently I have a 25 nodes cluster, with 3 dedicated masters, 18 warm nodes and 4 hot nodes,… --- ## [Querying nested objects](https://discuss.elastic.co/t/querying-nested-objects/291850)
**Author:** [@OmarDacca](https://discuss.elastic.co/u/OmarDacca)\ **Replies:** 3\ **Last updated:** [December 15, 2021, 9:17am UTC](https://discuss.elastic.co/t/querying-nested-objects/291850 "2021-12-15T09:17:50Z")
hello, I have an index called session\_details, here is an example of a document: { "clientIdAsString" : "100", "sessionStart" : "2021-12-14T17:14:49.000Z", "user\_id" : "0Bl301Me7x080r5o2K8m9D86Z", "wz\_s… --- ## [Painless - check if string contains word](https://discuss.elastic.co/t/painless-check-if-string-contains-word/291914)
**Author:** [@sagar\_cherukuri](https://discuss.elastic.co/u/sagar_cherukuri)\ **Replies:** 0\ **Last updated:** [December 15, 2021, 7:50am UTC](https://discuss.elastic.co/t/painless-check-if-string-contains-word/291914 "2021-12-15T07:50:32Z")
Is it possible to check if a string contains the word in a nested array? I am accessing the fields through params.\_source and I have created a painless script as below, but it's throwing me errors at contains(). How to c… --- ## [Native memory leak with frequent index delete/create](https://discuss.elastic.co/t/native-memory-leak-with-frequent-index-delete-create/290070)
**Author:** [@sreekanth](https://discuss.elastic.co/u/sreekanth)\ **Replies:** 1\ **Last updated:** [December 15, 2021, 5:36am UTC](https://discuss.elastic.co/t/native-memory-leak-with-frequent-index-delete-create/290070 "2021-12-15T05:36:54Z")
As part of some flow, we used to create and delete an index just to do smoke test kind of regularly. Over months, we saw native memory is growing very badly. And finally, it touches max limits of OS memory and crashes. … --- ## [DeprecationWarning: The 'body' parameter is deprecated for the 'index' API and will be removed in a future version](https://discuss.elastic.co/t/deprecationwarning-the-body-parameter-is-deprecated-for-the-index-api-and-will-be-removed-in-a-future-version/291876)
**Author:** [@ingmar](https://discuss.elastic.co/u/ingmar)\ **Replies:** 0\ **Last updated:** [December 14, 2021, 10:15pm UTC](https://discuss.elastic.co/t/deprecationwarning-the-body-parameter-is-deprecated-for-the-index-api-and-will-be-removed-in-a-future-version/291876 "2021-12-14T22:15:06Z")
Describe the feature: Elasticsearch version 7.15 elasticsearch-py version (elasticsearch.\_\_versionstr\_\_): 7.15.2 Please make sure the major version matches the Elasticsearch server you are running. Description of th… --- ## [Id size check](https://discuss.elastic.co/t/id-size-check/291870)
**Author:** [@thinkdffrnt](https://discuss.elastic.co/u/thinkdffrnt)\ **Replies:** 0\ **Last updated:** [December 14, 2021, 8:39pm UTC](https://discuss.elastic.co/t/id-size-check/291870 "2021-12-14T20:39:09Z")
\_id is limited to 512 bytes in size and larger values will be rejected How can I check the bytes size in Java? Is this UTF 8 encoding? I can't find any info --- ## [Benchmarking ES using Rally store size metric increase and decrease](https://discuss.elastic.co/t/benchmarking-es-using-rally-store-size-metric-increase-and-decrease/291804)
**Author:** [@fargolk](https://discuss.elastic.co/u/fargolk)\ **Replies:** 2\ **Last updated:** [December 14, 2021, 8:25pm UTC](https://discuss.elastic.co/t/benchmarking-es-using-rally-store-size-metric-increase-and-decrease/291804 "2021-12-14T20:25:13Z")
I was benchmarking an ES index with different shard numbers using esrally. to find the shard number with best throughput for the specific index. As I read in documents store size is index size (translog excluded) In … --- ## [ElasticSearch autocomplete/suggest by token](https://discuss.elastic.co/t/elasticsearch-autocomplete-suggest-by-token/291854)
**Author:** [@abhinav-nath](https://discuss.elastic.co/u/abhinav-nath)\ **Replies:** 0\ **Last updated:** [December 14, 2021, 6:15pm UTC](https://discuss.elastic.co/t/elasticsearch-autocomplete-suggest-by-token/291854 "2021-12-14T18:15:12Z")
I want to create search suggestions based on the tokens (and not full documents) that are present in my index. For example: I have a simple index for movies in which I have these two documents: {"name":"Captain Ameri… --- ## [Search UI sorting by date: No mapping found error](https://discuss.elastic.co/t/search-ui-sorting-by-date-no-mapping-found-error/291857)
**Author:** [@asorondo](https://discuss.elastic.co/u/asorondo)\ **Replies:** 0\ **Last updated:** [December 14, 2021, 6:36pm UTC](https://discuss.elastic.co/t/search-ui-sorting-by-date-no-mapping-found-error/291857 "2021-12-14T18:36:41Z")
Hi! I'm using Elasticsearch and search UI and wish to sort by different fields. I'm using the search UI component "Sorting" as follows: \ **Author:** [@gursahibsahni](https://discuss.elastic.co/u/gursahibsahni)\ **Replies:** 3\ **Last updated:** [December 14, 2021, 4:51pm UTC](https://discuss.elastic.co/t/missing-field-value-for-nested-field-function-score-query-v7-10-2/291365 "2021-12-14T16:51:22Z") I have been trying for a long time now but the nested field value is always saying missing field value while calculating the score. Mapping: { "main\_idx" : { "mappings" : { "properties" : { "\_class"… --- ## [Aggregation buckets custom order](https://discuss.elastic.co/t/aggregation-buckets-custom-order/291838)
**Author:** [@mmoreram](https://discuss.elastic.co/u/mmoreram)\ **Replies:** 0\ **Last updated:** [December 14, 2021, 4:24pm UTC](https://discuss.elastic.co/t/aggregation-buckets-custom-order/291838 "2021-12-14T16:24:09Z")
I'd like to define by hand the order of a term aggregation. Of course, these values should appear only when they are part of the result. Is there a way this can be done? Custom agg1 (x) Custom agg2 (x) Other1 (x) Oth… --- ## [Elasticsearch 5.6.6 security vulnerability log4j](https://discuss.elastic.co/t/elasticsearch-5-6-6-security-vulnerability-log4j/291821)
**Author:** [@William1](https://discuss.elastic.co/u/William1)\ **Replies:** 0\ **Last updated:** [December 14, 2021, 3:01pm UTC](https://discuss.elastic.co/t/elasticsearch-5-6-6-security-vulnerability-log4j/291821 "2021-12-14T15:01:08Z")
Hello all, I would like to ask if we can keep our current version 5.6.6 and setting the JVM option, in order to mitigate this vulnerability? This since upgrading is not possible. Thanks for your help! --- ## [Index rollover issues](https://discuss.elastic.co/t/index-rollover-issues/290669)
**Author:** [@sandeepmuthathi](https://discuss.elastic.co/u/sandeepmuthathi)\ **Replies:** 7\ **Last updated:** [December 14, 2021, 2:31pm UTC](https://discuss.elastic.co/t/index-rollover-issues/290669 "2021-12-14T14:31:19Z")
Suppose I'm creating the ES index using beat system or logstash with date time interpolation. how do I configure rolling over of index if size reaches at certain GBs in a single day? I did the following but I'm doing … --- ## [Painless: How to simulate a hashmap as a variable for painless lab?](https://discuss.elastic.co/t/painless-how-to-simulate-a-hashmap-as-a-variable-for-painless-lab/291813)
**Author:** [@kelk](https://discuss.elastic.co/u/kelk)\ **Replies:** 0\ **Last updated:** [December 14, 2021, 2:24pm UTC](https://discuss.elastic.co/t/painless-how-to-simulate-a-hashmap-as-a-variable-for-painless-lab/291813 "2021-12-14T14:24:29Z")
Hi, I've got below painless snippet // define sample data as hashmap (similar to Elastic output) def buy\_list = ' \[{doc\_count=13, category={buckets=\[{doc\_count=11, key=apple}, {doc\_count=12, key=mango}, {doc\_count=13, … --- ## [How convert Hashmap to JSON string in painless script?](https://discuss.elastic.co/t/how-convert-hashmap-to-json-string-in-painless-script/291812)
**Author:** [@kelk](https://discuss.elastic.co/u/kelk)\ **Replies:** 0\ **Last updated:** [December 14, 2021, 2:20pm UTC](https://discuss.elastic.co/t/how-convert-hashmap-to-json-string-in-painless-script/291812 "2021-12-14T14:20:22Z")
Hi , this is very same question : How convert Hashmap to JSON string in painless script? Just checking is this possible in Logstash 7.x? Mostly wanted to convert a hashmap format to pure JSON for output purposes --- ## [Log4j 2 delete action error](https://discuss.elastic.co/t/log4j-2-delete-action-error/291807)
**Author:** [@Jeffy](https://discuss.elastic.co/u/Jeffy)\ **Replies:** 0\ **Last updated:** [December 14, 2021, 1:38pm UTC](https://discuss.elastic.co/t/log4j-2-delete-action-error/291807 "2021-12-14T13:38:32Z")
when I configured action delete policy for rolling over log, logger alerts error said: access denied(UserInformation related) and the rolling log shows file permission as rwx---r-- can further advise? --- ## [Elastic cloud on Azure, coworkers can't reach my deployment in cloud.elastic.co](https://discuss.elastic.co/t/elastic-cloud-on-azure-coworkers-cant-reach-my-deployment-in-cloud-elastic-co/291752)
**Author:** [@rebeccabl](https://discuss.elastic.co/u/rebeccabl)\ **Replies:** 4\ **Last updated:** [December 14, 2021, 1:31pm UTC](https://discuss.elastic.co/t/elastic-cloud-on-azure-coworkers-cant-reach-my-deployment-in-cloud-elastic-co/291752 "2021-12-14T13:31:57Z")
Hello there! We are having several issues, but the most problematic at this point is that only I am able to see the cluster in cloud.elastic.co where as my coworkers cannot. All of us can get into the Kibana, and we ha… --- ## [Does 7.16.1 work for anyone?](https://discuss.elastic.co/t/does-7-16-1-work-for-anyone/291767)
**Author:** [@richard.penarroya](https://discuss.elastic.co/u/richard.penarroya)\ **Replies:** 1\ **Last updated:** [December 14, 2021, 1:05pm UTC](https://discuss.elastic.co/t/does-7-16-1-work-for-anyone/291767 "2021-12-14T13:05:29Z")
Following the latest announcements regarding log4j vulnerabilities, we have updated our Elastic platform from 7.16.0 to 7.16.1. Just after this update, Elasticsearch failed to index anything.... be it data coming from … --- ## [Elastic data nodes are randomly getting unresponsive](https://discuss.elastic.co/t/elastic-data-nodes-are-randomly-getting-unresponsive/291793)
**Author:** [@fschoell](https://discuss.elastic.co/u/fschoell)\ **Replies:** 0\ **Last updated:** [December 14, 2021, 12:21pm UTC](https://discuss.elastic.co/t/elastic-data-nodes-are-randomly-getting-unresponsive/291793 "2021-12-14T12:21:21Z")
Hello, we run an Elasticsearch cluster with 12 data nodes of which groups of 4 share a larger dom server and are run in linux containers (dom servers are currently 48 core CPUs with 1.5 TB of memory and large SSD arrays)… --- ## [Is that possible to use certificates signed by openssl instead of elasticsearch-certutil?](https://discuss.elastic.co/t/is-that-possible-to-use-certificates-signed-by-openssl-instead-of-elasticsearch-certutil/291724)
**Author:** [@v\_melnyk](https://discuss.elastic.co/u/v_melnyk)\ **Replies:** 1\ **Last updated:** [December 14, 2021, 10:51am UTC](https://discuss.elastic.co/t/is-that-possible-to-use-certificates-signed-by-openssl-instead-of-elasticsearch-certutil/291724 "2021-12-14T10:51:06Z")
Hello, I'd like to sign the nodes' certificates by openssl (instead of Elasticsearch-certutil). Is that ever possible? When I have a PKCS12 keystore made by Elasticsearch-certutil, everything works like a charm. Here's… --- ## [Secure log4j for elasticsearch](https://discuss.elastic.co/t/secure-log4j-for-elasticsearch/291684)
**Author:** [@beci](https://discuss.elastic.co/u/beci)\ **Replies:** 1\ **Last updated:** [December 14, 2021, 10:47am UTC](https://discuss.elastic.co/t/secure-log4j-for-elasticsearch/291684 "2021-12-14T10:47:12Z")
Hello, We have a server with logstash and Elasticsearch installed on it, I updated these two items to 7.16.1. When I search for files that say "\* log4j \*", there are always items mentioning version 2.11.1 of log4j : /… --- ## [Iterate over searchResponse](https://discuss.elastic.co/t/iterate-over-searchresponse/291648)
**Author:** [@Katgust](https://discuss.elastic.co/u/Katgust)\ **Replies:** 1\ **Last updated:** [December 14, 2021, 10:06am UTC](https://discuss.elastic.co/t/iterate-over-searchresponse/291648 "2021-12-14T10:06:20Z")
I'd like to iterate over my searchResponse so I can use the value from an id field in every found document in order to do a new search where this id matches another one in another index. So first I'm doing this var… --- ## [Can not get any logs after create a datastream](https://discuss.elastic.co/t/can-not-get-any-logs-after-create-a-datastream/291629)
**Author:** [@bilgicsin](https://discuss.elastic.co/u/bilgicsin)\ **Replies:** 2\ **Last updated:** [December 14, 2021, 8:48am UTC](https://discuss.elastic.co/t/can-not-get-any-logs-after-create-a-datastream/291629 "2021-12-14T08:48:11Z")
Hi Everyone! I am trying to change my data to the datastream. Normally I can get logs, I can see indice first. After I create a datastream I could not get any logs even though logs keep coming. I followed this steps: … [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=524) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=526)