# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=527 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 528 --- ## [Can't access our cluster through Grafana](https://discuss.elastic.co/t/cant-access-our-cluster-through-grafana/291548)
**Author:** [@mertkaant](https://discuss.elastic.co/u/mertkaant)\ **Replies:** 0\ **Last updated:** [December 12, 2021, 3:43pm UTC](https://discuss.elastic.co/t/cant-access-our-cluster-through-grafana/291548 "2021-12-12T15:43:15Z")
Hello, dear community, We recently have upgraded our ELK to 7.15.2. from 7.7.0. Here are some details from our cluster This is one of our cluster's health: { "cluster\_name" : "xxxxxxxxxxx", "status" : "green", … --- ## [Raise bulkindexerror](https://discuss.elastic.co/t/raise-bulkindexerror/291546)
**Author:** [@FUNZAR](https://discuss.elastic.co/u/FUNZAR)\ **Replies:** 0\ **Last updated:** [December 12, 2021, 2:19pm UTC](https://discuss.elastic.co/t/raise-bulkindexerror/291546 "2021-12-12T14:19:44Z")
Hello everyone! Need a help here. Here is my code: import json import os from elasticsearch import Elasticsearch, RequestError from elasticsearch.helpers import bulk def create\_index(es\_client, index\_name, setting… --- ## [How distinguish records at file](https://discuss.elastic.co/t/how-distinguish-records-at-file/291518)
**Author:** [@Alpork](https://discuss.elastic.co/u/Alpork)\ **Replies:** 0\ **Last updated:** [December 11, 2021, 7:34pm UTC](https://discuss.elastic.co/t/how-distinguish-records-at-file/291518 "2021-12-11T19:34:05Z")
Hello I have these records at file. 1639243031955|120|0|100|1|344405511|1|1906||sw|34esae3d||sdsw| 1639044203391|207|0|2009030129|http:\\126.198.81.51|5|1|10500| I use Processors-\>CSV for extracting values for these r… --- ## [Ingest processor: remove a line from a CSV?](https://discuss.elastic.co/t/ingest-processor-remove-a-line-from-a-csv/291137)
**Author:** [@QuartoStato](https://discuss.elastic.co/u/QuartoStato)\ **Replies:** 8\ **Last updated:** [December 11, 2021, 12:58pm UTC](https://discuss.elastic.co/t/ingest-processor-remove-a-line-from-a-csv/291137 "2021-12-11T12:58:40Z")
Hi all, I'm trying to create a processor for an ingest pipeline. I'm checking all available existing processor but I can't understand if it's possible to remove a line from a CSV. The data we need to import has 2 header… --- ## [What is the correct way to support Global search across multiple document types?](https://discuss.elastic.co/t/what-is-the-correct-way-to-support-global-search-across-multiple-document-types/291388)
**Author:** [@abm\_a](https://discuss.elastic.co/u/abm_a)\ **Replies:** 3\ **Last updated:** [December 11, 2021, 9:23am UTC](https://discuss.elastic.co/t/what-is-the-correct-way-to-support-global-search-across-multiple-document-types/291388 "2021-12-11T09:23:36Z")
Let's say in a Microservices architecture there are 100s of different entities and search needs to be supported that can look for matches in all those entities. I see a few ways of doing this. Create one index for each… --- ## [Nested Script Sorting - Access all matching nested documents inside script](https://discuss.elastic.co/t/nested-script-sorting-access-all-matching-nested-documents-inside-script/291497)
**Author:** [@Ruan23](https://discuss.elastic.co/u/Ruan23)\ **Replies:** 0\ **Last updated:** [December 11, 2021, 8:26am UTC](https://discuss.elastic.co/t/nested-script-sorting-access-all-matching-nested-documents-inside-script/291497 "2021-12-11T08:26:23Z")
I am trying to find a way to sort root documents, based on the cumulative price of all the matching nested documents. Each vendor is stored as the root document, with all their products stored as nested documents: { … --- ## [Rolling up Data Streams](https://discuss.elastic.co/t/rolling-up-data-streams/288328)
**Author:** [@seanziee](https://discuss.elastic.co/u/seanziee)\ **Replies:** 7\ **Last updated:** [December 11, 2021, 6:21am UTC](https://discuss.elastic.co/t/rolling-up-data-streams/288328 "2021-12-11T06:21:24Z")
Hi there, I'm curious if making rollups from data streams is recommended/possible? It would be great after rolling over data from my data stream if I could also roll it up into bigger time chunks. Thanks! --- ## [How to connect Elasticsearch correctly in a Kafka connector?](https://discuss.elastic.co/t/how-to-connect-elasticsearch-correctly-in-a-kafka-connector/290949)
**Author:** [@Hongbo-Miao](https://discuss.elastic.co/u/Hongbo-Miao)\ **Replies:** 2\ **Last updated:** [December 11, 2021, 5:29am UTC](https://discuss.elastic.co/t/how-to-connect-elasticsearch-correctly-in-a-kafka-connector/290949 "2021-12-11T05:29:12Z")
Step 1 - Deploy Elasticsearch in Kubernetes (succeed) I deployed Elasticsearch in Kubernetes by following the tutorial apiVersion: elasticsearch.k8s.elastic.co/v1 kind: Elasticsearch metadata: name: hm-elasticsearch… --- ## [Elasticsearch Scoring Inconsistency](https://discuss.elastic.co/t/elasticsearch-scoring-inconsistency/291488)
**Author:** [@powerte](https://discuss.elastic.co/u/powerte)\ **Replies:** 0\ **Last updated:** [December 11, 2021, 12:30am UTC](https://discuss.elastic.co/t/elasticsearch-scoring-inconsistency/291488 "2021-12-11T00:30:31Z")
Our API uses Elasticsearch to return results based on scoring (relevance). In our use case, it's important we consistently return documents in the same sort order. We currently see that queries with larger result sets … --- ## [In which conditions does bootstrap.password actually work?](https://discuss.elastic.co/t/in-which-conditions-does-bootstrap-password-actually-work/291465)
**Author:** [@Niwa\_7](https://discuss.elastic.co/u/Niwa_7)\ **Replies:** 0\ **Last updated:** [December 10, 2021, 8:29pm UTC](https://discuss.elastic.co/t/in-which-conditions-does-bootstrap-password-actually-work/291465 "2021-12-10T20:29:53Z")
Hi, I am trying to automate Elasticsearch 7.16 cluster deployment, including system user passwords. For that I'd add bootstrap.password to elastic keystore and use that password to set the permanent password for elastic … --- ## [SSL certificate issues after partial cluster migration \[ES 7.14\]](https://discuss.elastic.co/t/ssl-certificate-issues-after-partial-cluster-migration-es-7-14/291463)
**Author:** [@djordan66](https://discuss.elastic.co/u/djordan66)\ **Replies:** 0\ **Last updated:** [December 10, 2021, 7:54pm UTC](https://discuss.elastic.co/t/ssl-certificate-issues-after-partial-cluster-migration-es-7-14/291463 "2021-12-10T19:54:59Z")
Hi all, I'm running into an issue migrating machines in a cluster. Quick breakdown of the setup: We had a cluster running in one site on one network subnet (network a). We are being ushered out of the building, so we b… --- ## [Rolling upgrade from 7.8.0-OSS to 7.15.2](https://discuss.elastic.co/t/rolling-upgrade-from-7-8-0-oss-to-7-15-2/291448)
**Author:** [@s.moran](https://discuss.elastic.co/u/s.moran)\ **Replies:** 0\ **Last updated:** [December 10, 2021, 5:50pm UTC](https://discuss.elastic.co/t/rolling-upgrade-from-7-8-0-oss-to-7-15-2/291448 "2021-12-10T17:50:00Z")
We are trying to upgrade our 7.8.0-OSS cluster to 7.15.2 using an automated deployment method where all new nodes are added to the cluster before the old nodes are taken down 1-by-1. We have noticed that during deployme… --- ## [EC2 cURL localhost:9200 - security\_exception](https://discuss.elastic.co/t/ec2-curl-localhost-9200-security-exception/291441)
**Author:** [@kmiklas](https://discuss.elastic.co/u/kmiklas)\ **Replies:** 2\ **Last updated:** [December 10, 2021, 5:21pm UTC](https://discuss.elastic.co/t/ec2-curl-localhost-9200-security-exception/291441 "2021-12-10T17:21:37Z")
What is the simplest way to enable the health check of Elasticsearch? Do I have to set up AWS authentication, or can I bypass it for troubleshooting? Connected to an AWS EC2 instance using a .pem file. Elasticsearch is… --- ## [Error while sniffing nodes](https://discuss.elastic.co/t/error-while-sniffing-nodes/291186)
**Author:** [@Hayk\_Hovhanisyan](https://discuss.elastic.co/u/Hayk_Hovhanisyan)\ **Replies:** 2\ **Last updated:** [December 10, 2021, 2:04pm UTC](https://discuss.elastic.co/t/error-while-sniffing-nodes/291186 "2021-12-10T14:04:00Z")
Environment: JDK 1.8.0\_301 Grails 5.0.2 Spring Boot 2.5.7 Groovy 3.0.7 Elasticsearch 7.10.2 (also tried 7.12.1) Situation: Hi dear colleagues, could you please clarify the error while sniffing nodes. Task: Running … --- ## [Using a bucket key for filtering in the according aggregation](https://discuss.elastic.co/t/using-a-bucket-key-for-filtering-in-the-according-aggregation/291423)
**Author:** [@Marc\_Zahn](https://discuss.elastic.co/u/Marc_Zahn)\ **Replies:** 0\ **Last updated:** [December 10, 2021, 12:27pm UTC](https://discuss.elastic.co/t/using-a-bucket-key-for-filtering-in-the-according-aggregation/291423 "2021-12-10T12:27:10Z")
Hello, maybe I searched for the wrong things, but I have a problem and don't know if it is possible to solve it: I have a terms aggregation where I need to filter the documents by matching the bucket keys against an inp… --- ## [OutOfMemoryError after PDTrueTypeFont Using fallback font warnings](https://discuss.elastic.co/t/outofmemoryerror-after-pdtruetypefont-using-fallback-font-warnings/290322)
**Author:** [@Cordobel](https://discuss.elastic.co/u/Cordobel)\ **Replies:** 7\ **Last updated:** [December 10, 2021, 10:04am UTC](https://discuss.elastic.co/t/outofmemoryerror-after-pdtruetypefont-using-fallback-font-warnings/290322 "2021-12-10T10:04:34Z")
I noticed twice that Elasticsearch crashed after some warnings about PDTrueTypeFont Using fallback font. After these warnings, the garbage collector starts to alert about the overload. Then a fatal error - lambda $MaybeD… --- ## [Best way to enrich by IP subnets](https://discuss.elastic.co/t/best-way-to-enrich-by-ip-subnets/232771)
**Author:** [@nemhods](https://discuss.elastic.co/u/nemhods)\ **Replies:** 3\ **Last updated:** [December 10, 2021, 9:34am UTC](https://discuss.elastic.co/t/best-way-to-enrich-by-ip-subnets/232771 "2021-12-10T09:34:40Z")
I want to enrich incoming ECS-compatible documents with a tag if they come from VPN IPs. From my testing, the enrich processor cannot deal with IP-ranges. However, i want to use IP-ranges and not manually (or by a scrip… --- ## [Bulksearch with multiple terms and multiple values](https://discuss.elastic.co/t/bulksearch-with-multiple-terms-and-multiple-values/291407)
**Author:** [@GopiSumanth](https://discuss.elastic.co/u/GopiSumanth)\ **Replies:** 0\ **Last updated:** [December 10, 2021, 9:33am UTC](https://discuss.elastic.co/t/bulksearch-with-multiple-terms-and-multiple-values/291407 "2021-12-10T09:33:22Z")
Hi, Currently, we are using the below JSON for search in the repository index. Here we are using one term with multiple values(list of values). Can we change the JSON to search using multiple terms by passing multiple v… --- ## [How could I compare these two time values using painless script?](https://discuss.elastic.co/t/how-could-i-compare-these-two-time-values-using-painless-script/291034)
**Author:** [@Peilin](https://discuss.elastic.co/u/Peilin)\ **Replies:** 6\ **Last updated:** [December 10, 2021, 8:25am UTC](https://discuss.elastic.co/t/how-could-i-compare-these-two-time-values-using-painless-script/291034 "2021-12-10T08:25:59Z")
I am using ES to analysis medical data. how can i using painless script compare these two time values(beginDateTime, endDateTime).deep values. if it's not deep value, i found a solution like this { "query": { … --- ## [Read containers log files using fleet](https://discuss.elastic.co/t/read-containers-log-files-using-fleet/288067)
**Author:** [@vovan13111](https://discuss.elastic.co/u/vovan13111)\ **Replies:** 3\ **Last updated:** [December 10, 2021, 4:50am UTC](https://discuss.elastic.co/t/read-containers-log-files-using-fleet/288067 "2021-12-10T04:50:46Z")
Good afternoon. When studying Fleet and apm agents, the question arose, is it possible to somehow collect logs from docker containers, as done in filebeat, or is there no such possibility yet? --- ## [Elastic search storage exception](https://discuss.elastic.co/t/elastic-search-storage-exception/290642)
**Author:** [@mehmood1](https://discuss.elastic.co/u/mehmood1)\ **Replies:** 8\ **Last updated:** [December 10, 2021, 4:03am UTC](https://discuss.elastic.co/t/elastic-search-storage-exception/290642 "2021-12-10T04:03:25Z")
Elasticsearch run in read only mode due to storage. i dont want to extend storage this time because it is only for testing purpose. below is Elasticsearch yml file # ======================== Elasticsearch Configuratio… --- ## [No audit log file in /usr/share/elasticsearch/logs directory when I opend the audit log configuration](https://discuss.elastic.co/t/no-audit-log-file-in-usr-share-elasticsearch-logs-directory-when-i-opend-the-audit-log-configuration/291387)
**Author:** [@Hello-Linux](https://discuss.elastic.co/u/Hello-Linux)\ **Replies:** 0\ **Last updated:** [December 10, 2021, 3:43am UTC](https://discuss.elastic.co/t/no-audit-log-file-in-usr-share-elasticsearch-logs-directory-when-i-opend-the-audit-log-configuration/291387 "2021-12-10T03:43:38Z")
I have set the config xpack.security.audit.enabled: true,and restart Elasticsearch,but in the logs file I can't find the json file what name is \_audit.json,why? look at No audit log file in /usr/share/elasticsearch/logs … --- ## [Case insensitive term query (case\_insensitive) performance penalty?](https://discuss.elastic.co/t/case-insensitive-term-query-case-insensitive-performance-penalty/291371)
**Author:** [@roytmana](https://discuss.elastic.co/u/roytmana)\ **Replies:** 0\ **Last updated:** [December 9, 2021, 11:20pm UTC](https://discuss.elastic.co/t/case-insensitive-term-query-case-insensitive-performance-penalty/291371 "2021-12-09T23:20:28Z")
Hello, Is there any significant performance penalty for using case\_insensitive: true in term queries? If I use keyword mapping with lowercase normalizer, highlighter would emit lowercased results which I would like to … --- ## [High system CPU usage with Elasticsearch on Kubernetes (using ECK) using ES v7.10.0+ (but not in v7.6.1)](https://discuss.elastic.co/t/high-system-cpu-usage-with-elasticsearch-on-kubernetes-using-eck-using-es-v7-10-0-but-not-in-v7-6-1/290904)
**Author:** [@YannV](https://discuss.elastic.co/u/YannV)\ **Replies:** 5\ **Last updated:** [December 9, 2021, 10:20pm UTC](https://discuss.elastic.co/t/high-system-cpu-usage-with-elasticsearch-on-kubernetes-using-eck-using-es-v7-10-0-but-not-in-v7-6-1/290904 "2021-12-09T22:20:19Z")
Elasticsearch version: 7.10.0 & 7.14.2 (but not reproduced in ES v7.6.1) Plugins installed: None JVM version: Bundled in official Elasticsearch docker image OS version: Reproduced on CentOS 7.9 with kernel 3.10.0 and … --- ## [Replace string in elastic](https://discuss.elastic.co/t/replace-string-in-elastic/291320)
**Author:** [@idoweiss1](https://discuss.elastic.co/u/idoweiss1)\ **Replies:** 1\ **Last updated:** [December 9, 2021, 9:52pm UTC](https://discuss.elastic.co/t/replace-string-in-elastic/291320 "2021-12-09T21:52:07Z")
Hi , I have a string from the kibana and need to change the output : from "mdc.correlationId" to "correlation-id" --- ## [ES not found documents](https://discuss.elastic.co/t/es-not-found-documents/291227)
**Author:** [@xunterix](https://discuss.elastic.co/u/xunterix)\ **Replies:** 6\ **Last updated:** [December 9, 2021, 7:39pm UTC](https://discuss.elastic.co/t/es-not-found-documents/291227 "2021-12-09T19:39:47Z")
Hi, after resetting the index and re-indexing, the search stopped finding any documents. In the logs I see all shards failed. What could be the problem? { "cluster\_name" : "elasticsearch", "status" : "yellow", "ti… --- ## [Get status snapshot does not work for snapshots that are not currently running](https://discuss.elastic.co/t/get-status-snapshot-does-not-work-for-snapshots-that-are-not-currently-running/291271)
**Author:** [@Hannah\_Chung](https://discuss.elastic.co/u/Hannah_Chung)\ **Replies:** 0\ **Last updated:** [December 8, 2021, 11:57pm UTC](https://discuss.elastic.co/t/get-status-snapshot-does-not-work-for-snapshots-that-are-not-currently-running/291271 "2021-12-08T23:57:01Z")
Based on the documentation for Get snapshot status here, I expect to see the state of my snapshot even if it is not currently running. I confirmed I am making the call GET /\_snapshot/\/\/\_sta… --- ## [High CPU utilization on master node](https://discuss.elastic.co/t/high-cpu-utilization-on-master-node/290096)
**Author:** [@guptaparv-rlr](https://discuss.elastic.co/u/guptaparv-rlr)\ **Replies:** 26\ **Last updated:** [December 9, 2021, 5:01pm UTC](https://discuss.elastic.co/t/high-cpu-utilization-on-master-node/290096 "2021-12-09T17:01:58Z")
I'm operating a Elasticsearch cluster using ECK Operator. Recently, we have observed high CPU utilization on master nodes. Here is the topology of the cluster: 3 master nodes 3 data nodes On running the nodes hot thr… --- ## [Conditional indexing in metricbeat using Ingest node pipeline creates a datastream](https://discuss.elastic.co/t/conditional-indexing-in-metricbeat-using-ingest-node-pipeline-creates-a-datastream/291344)
**Author:** [@sidharth\_vijayakumar](https://discuss.elastic.co/u/sidharth_vijayakumar)\ **Replies:** 0\ **Last updated:** [December 9, 2021, 4:08pm UTC](https://discuss.elastic.co/t/conditional-indexing-in-metricbeat-using-ingest-node-pipeline-creates-a-datastream/291344 "2021-12-09T16:08:21Z")
I am trying to achieve conditional indexing for namespaces in elastic using ingest node pipelines. I used the below pipeline but the index getting created when I add the pipeline in metricbeat.yml is in form of datastrea… --- ## [Painless in Script Ingest Pipeline : Get fields name](https://discuss.elastic.co/t/painless-in-script-ingest-pipeline-get-fields-name/291341)
**Author:** [@GinkoLucas](https://discuss.elastic.co/u/GinkoLucas)\ **Replies:** 0\ **Last updated:** [December 9, 2021, 3:44pm UTC](https://discuss.elastic.co/t/painless-in-script-ingest-pipeline-get-fields-name/291341 "2021-12-09T15:44:29Z")
Hi, I need to know the names of the fields entering the pipeline. Because I would like to place in a different index the documents with an extra field, or an unknown field. Is there a solution with script processor ? [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=526) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=528)