# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=532 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 533 --- ## [DSL query for indices not receiving any documents for the past 5 mins](https://discuss.elastic.co/t/dsl-query-for-indices-not-receiving-any-documents-for-the-past-5-mins/290710)
**Author:** [@antonisnyc94](https://discuss.elastic.co/u/antonisnyc94)\ **Replies:** 0\ **Last updated:** [December 1, 2021, 8:55pm UTC](https://discuss.elastic.co/t/dsl-query-for-indices-not-receiving-any-documents-for-the-past-5-mins/290710 "2021-12-01T20:55:10Z")
Hello, We want to set up an alert using opendistro for indices not receiving any docs for the past 5 mins. I used the must\_not exist field "@timestamp" since it always exists in all documents but i get no results.. Does… --- ## [Elasticsearch Node Running on docker only shows Disk Available 50 GB](https://discuss.elastic.co/t/elasticsearch-node-running-on-docker-only-shows-disk-available-50-gb/290704)
**Author:** [@Mmatos](https://discuss.elastic.co/u/Mmatos)\ **Replies:** 2\ **Last updated:** [December 1, 2021, 8:22pm UTC](https://discuss.elastic.co/t/elasticsearch-node-running-on-docker-only-shows-disk-available-50-gb/290704 "2021-12-01T20:22:25Z")
Hi, I am running the Docker-Elk Stack 7.14.1 and noticed that in the Stack Monitoring Tab Elastic reports it only has a 50 GB disk. The host running the container has 700 GB free. How can I expand this container so it … --- ## [How do i fix Unassigned Replicas on cluster?](https://discuss.elastic.co/t/how-do-i-fix-unassigned-replicas-on-cluster/290699)
**Author:** [@Shreesh\_Narayanan](https://discuss.elastic.co/u/Shreesh_Narayanan)\ **Replies:** 5\ **Last updated:** [December 1, 2021, 6:12pm UTC](https://discuss.elastic.co/t/how-do-i-fix-unassigned-replicas-on-cluster/290699 "2021-12-01T18:12:45Z")
Hello, we recently created a cluster on 2 VMs , 1 with Elasticsearch as MASTER node and another with Elasticsearch as DATA node . How do i allocate the replicas ? it seems the primary is allocated but the replicas … --- ## [ES-SQL UNION alternative \[Was: Sql query canvas\]](https://discuss.elastic.co/t/es-sql-union-alternative-was-sql-query-canvas/290637)
**Author:** [@asmaalqasem4](https://discuss.elastic.co/u/asmaalqasem4)\ **Replies:** 7\ **Last updated:** [December 1, 2021, 4:44pm UTC](https://discuss.elastic.co/t/es-sql-union-alternative-was-sql-query-canvas/290637 "2021-12-01T16:44:04Z")
Hello,, I need to implement this query in the canvas but it is not working. is there another way to get the same result? SELECT SUM(amount) \*\* \*FROM (SELECT AMOUNT as amount FROM "payment-index "\* UNION \*\* \*SELECT P… --- ## [Dynamically passing to query](https://discuss.elastic.co/t/dynamically-passing-to-query/290471)
**Author:** [@cool999](https://discuss.elastic.co/u/cool999)\ **Replies:** 3\ **Last updated:** [December 1, 2021, 4:29pm UTC](https://discuss.elastic.co/t/dynamically-passing-to-query/290471 "2021-12-01T16:29:52Z")
Hi Team, I have below similar logs. I have created dummy index and created mapping like below, PUT new { "mappings": { "properties": { "@timestamp": { "type": "date", "format": "yyyy-MM-d… --- ## [How to confine geopoint aggregation bucket count](https://discuss.elastic.co/t/how-to-confine-geopoint-aggregation-bucket-count/290681)
**Author:** [@FURKAN\_KURT](https://discuss.elastic.co/u/FURKAN_KURT)\ **Replies:** 0\ **Last updated:** [December 1, 2021, 2:45pm UTC](https://discuss.elastic.co/t/how-to-confine-geopoint-aggregation-bucket-count/290681 "2021-12-01T14:45:57Z")
Hello. I could not find how to confine coming aggregated bucket size. I want them to split into smaller pieces if they surpass 100 elements each. Thank you --- ## [When do delete policies in ILM actually get applied?](https://discuss.elastic.co/t/when-do-delete-policies-in-ilm-actually-get-applied/290563)
**Author:** [@riahc3](https://discuss.elastic.co/u/riahc3)\ **Replies:** 5\ **Last updated:** [December 1, 2021, 1:56pm UTC](https://discuss.elastic.co/t/when-do-delete-policies-in-ilm-actually-get-applied/290563 "2021-12-01T13:56:27Z")
Hello We have a ILM policy that deletes logs older than 240 days. We also have a monitoring system that watches the mount point where the logs get stored for space. Every 1-2 months, we get a alert that it gets near i… --- ## [Elasticsearch write performance](https://discuss.elastic.co/t/elasticsearch-write-performance/290646)
**Author:** [@qixian](https://discuss.elastic.co/u/qixian)\ **Replies:** 4\ **Last updated:** [December 1, 2021, 1:20pm UTC](https://discuss.elastic.co/t/elasticsearch-write-performance/290646 "2021-12-01T13:20:56Z")
helllo,when i write data to Elasticsearch using the bulk api,which process is flink consume the data of kafka then write to Elasticsearch.sometimes the write performance has Large fluctuations，I want to kown when the ela… --- ## [Disapearing fields during kv parsing](https://discuss.elastic.co/t/disapearing-fields-during-kv-parsing/290652)
**Author:** [@ddoroshenko](https://discuss.elastic.co/u/ddoroshenko)\ **Replies:** 1\ **Last updated:** [December 1, 2021, 1:20pm UTC](https://discuss.elastic.co/t/disapearing-fields-during-kv-parsing/290652 "2021-12-01T13:20:03Z")
Hi! I'm trying to parse the following log record \_\_policy\_id\_tag:"product=APP1 & APP2\[db\_tag={ABCDEF}; mgmt=abcd; date=123456789; policy\_name=foo\]"; product:"APP1 & APP2"; mgmt:"abcd"; event:"Canceled" and when I use … --- ## [ElasticSearch does not allow IPv6-mapped IPv4 address in field of type ip\_range](https://discuss.elastic.co/t/elasticsearch-does-not-allow-ipv6-mapped-ipv4-address-in-field-of-type-ip-range/290656)
**Author:** [@swapnil\_vaidya](https://discuss.elastic.co/u/swapnil_vaidya)\ **Replies:** 0\ **Last updated:** [December 1, 2021, 11:17am UTC](https://discuss.elastic.co/t/elasticsearch-does-not-allow-ipv6-mapped-ipv4-address-in-field-of-type-ip-range/290656 "2021-12-01T11:17:08Z")
Hi All, I am trying to index the document with field having value as IPV6 mapped IPV4 address in the field with type as ip\_range. However ES throws following error: CIDR notation is not allowed with IPv6-mapped IPv4 a… --- ## [Fast vector highlighter (fvh) making searches slower](https://discuss.elastic.co/t/fast-vector-highlighter-fvh-making-searches-slower/290634)
**Author:** [@Pyppe](https://discuss.elastic.co/u/Pyppe)\ **Replies:** 6\ **Last updated:** [December 1, 2021, 10:45am UTC](https://discuss.elastic.co/t/fast-vector-highlighter-fvh-making-searches-slower/290634 "2021-12-01T10:45:04Z")
Hi! We recently improved our hit highlighting by utilizing fvh (Lucene Fast Vector Highlighter). The highlighting is done as follows: { "query": {...}, "highlight": { "fields": { "searchableName": { … --- ## [Problem to create a TermsQuery using list of integers](https://discuss.elastic.co/t/problem-to-create-a-termsquery-using-list-of-integers/290644)
**Author:** [@Kirtash](https://discuss.elastic.co/u/Kirtash)\ **Replies:** 0\ **Last updated:** [December 1, 2021, 9:40am UTC](https://discuss.elastic.co/t/problem-to-create-a-termsquery-using-list-of-integers/290644 "2021-12-01T09:40:02Z")
Good morning, I'm using the library nest in C# to write bool queries but I would like create a termsquery with a list of integers, like when I use strings: List\ hiValues = new List\(); … --- ## [Filebeat incompatibility when upgrading elasticsearch](https://discuss.elastic.co/t/filebeat-incompatibility-when-upgrading-elasticsearch/290607)
**Author:** [@bruce289](https://discuss.elastic.co/u/bruce289)\ **Replies:** 2\ **Last updated:** [December 1, 2021, 8:28am UTC](https://discuss.elastic.co/t/filebeat-incompatibility-when-upgrading-elasticsearch/290607 "2021-12-01T08:28:38Z")
Hi. We're currently testing an upgrade from Elasticsearch 6.8 to 7.15 and we noticed that when we upgrade the cluster, the Filebeat agents on some of our hosts can no longer write to the indices and we see the errors li… --- ## [Gpg: no valid OpenPGP data found](https://discuss.elastic.co/t/gpg-no-valid-openpgp-data-found/290633)
**Author:** [@ethical20](https://discuss.elastic.co/u/ethical20)\ **Replies:** 0\ **Last updated:** [December 1, 2021, 7:23am UTC](https://discuss.elastic.co/t/gpg-no-valid-openpgp-data-found/290633 "2021-12-01T07:23:00Z")
Hi, I already have an ELK environment running at version 7.13, I'm trying to update to 7.15. But when trying to use the below command: wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | sudo apt-key add - … --- ## [What is a good number of fields to have in an index?](https://discuss.elastic.co/t/what-is-a-good-number-of-fields-to-have-in-an-index/290618)
**Author:** [@sidharth\_vijayakumar](https://discuss.elastic.co/u/sidharth_vijayakumar)\ **Replies:** 3\ **Last updated:** [December 1, 2021, 7:53am UTC](https://discuss.elastic.co/t/what-is-a-good-number-of-fields-to-have-in-an-index/290618 "2021-12-01T07:53:19Z")
I am trying to manage the index and I would like to know how many fields must be present inside an index for it to have good performance. Currently, I have 6000 fields in my index but not all documents have 6000 fields i… --- ## [Elasticsearch wont run](https://discuss.elastic.co/t/elasticsearch-wont-run/290395)
**Author:** [@Farid\_N](https://discuss.elastic.co/u/Farid_N)\ **Replies:** 7\ **Last updated:** [December 1, 2021, 6:20am UTC](https://discuss.elastic.co/t/elasticsearch-wont-run/290395 "2021-12-01T06:20:27Z")
Hi dears I have upgraded the Elasticsearch and removed old version and copy all the new Elasticsearch parts in the same directory (upgrading ES 7.6.2 to 7.15.2) Unfortunately when I want to start the service with sysV … --- ## ["environment: - xpack.security.enabled=true" does not work with docker-compose](https://discuss.elastic.co/t/environment-xpack-security-enabled-true-does-not-work-with-docker-compose/290389)
**Author:** [@tadashi.oya](https://discuss.elastic.co/u/tadashi.oya)\ **Replies:** 2\ **Last updated:** [December 1, 2021, 5:20am UTC](https://discuss.elastic.co/t/environment-xpack-security-enabled-true-does-not-work-with-docker-compose/290389 "2021-12-01T05:20:49Z")
Hi, I'm trying to specify xpack.security.enabled as an environment variable for the Elasticsearch container in the docker-compose configuration of T-Pot, a honeypot framework. However, the following statement does not w… --- ## [Trying to use snapshot and restore for pushing index data from one cluster to another](https://discuss.elastic.co/t/trying-to-use-snapshot-and-restore-for-pushing-index-data-from-one-cluster-to-another/290612)
**Author:** [@milindyedge](https://discuss.elastic.co/u/milindyedge)\ **Replies:** 1\ **Last updated:** [November 30, 2021, 11:49pm UTC](https://discuss.elastic.co/t/trying-to-use-snapshot-and-restore-for-pushing-index-data-from-one-cluster-to-another/290612 "2021-11-30T23:49:19Z")
I am working on to try and use Snapshot and Restore feature to push index data from one running/live cluster to another live cluster without needing to have any downtime in destination cluster. I have spun up 2 multi-nod… --- ## [Analyzers at Index time and search time are not matching](https://discuss.elastic.co/t/analyzers-at-index-time-and-search-time-are-not-matching/290614)
**Author:** [@Nikesh](https://discuss.elastic.co/u/Nikesh)\ **Replies:** 0\ **Last updated:** [November 30, 2021, 11:48pm UTC](https://discuss.elastic.co/t/analyzers-at-index-time-and-search-time-are-not-matching/290614 "2021-11-30T23:48:15Z")
Hi, I am trying to use synsets in Elasticsearch to build a pseudo QA System. My mapping file looks something as below: { "settings": { "analysis": { "analyzer": { "synset": { "tokenizer… --- ## [Does Elasticsearch provide highlighting on "copy\_to" field in their newer versions?](https://discuss.elastic.co/t/does-elasticsearch-provide-highlighting-on-copy-to-field-in-their-newer-versions/290611)
**Author:** [@Nikesh](https://discuss.elastic.co/u/Nikesh)\ **Replies:** 0\ **Last updated:** [November 30, 2021, 11:24pm UTC](https://discuss.elastic.co/t/does-elasticsearch-provide-highlighting-on-copy-to-field-in-their-newer-versions/290611 "2021-11-30T23:24:10Z")
I had used Elasticsearch few years ago(version 6.4.0) and they had no provision to provide highlight the "copy\_to" field. I would like to know if they have this provision now? If yes, how do I avoid the highlighting of … --- ## [AccessDeniedException when taking a snapshot of ES index in local machine](https://discuss.elastic.co/t/accessdeniedexception-when-taking-a-snapshot-of-es-index-in-local-machine/289848)
**Author:** [@milindyedge](https://discuss.elastic.co/u/milindyedge)\ **Replies:** 2\ **Last updated:** [November 30, 2021, 11:15pm UTC](https://discuss.elastic.co/t/accessdeniedexception-when-taking-a-snapshot-of-es-index-in-local-machine/289848 "2021-11-30T23:15:00Z")
Getting below error when taking snapshot of the index. ----------------------- Error ----------------------- java.lang.IllegalStateException: Unable to access 'path.repo' (/Users/mlyedge/gitrepos/search-query-service/c… --- ## [Disable doc\_values and index for nested type fields](https://discuss.elastic.co/t/disable-doc-values-and-index-for-nested-type-fields/290609)
**Author:** [@NLSVTN](https://discuss.elastic.co/u/NLSVTN)\ **Replies:** 0\ **Last updated:** [November 30, 2021, 10:42pm UTC](https://discuss.elastic.co/t/disable-doc-values-and-index-for-nested-type-fields/290609 "2021-11-30T22:42:40Z")
I set 'doc\_values' to 'False' on nested fields but it does not work in index creation got stuck. I wonder how to correctly disable 'doc\_values' and 'index' on 'nested' fields? Should I disable it just on the level of the… --- ## [Elasticsearch for Two Services](https://discuss.elastic.co/t/elasticsearch-for-two-services/290344)
**Author:** [@Klaus\_Salazar](https://discuss.elastic.co/u/Klaus_Salazar)\ **Replies:** 2\ **Last updated:** [November 30, 2021, 9:44pm UTC](https://discuss.elastic.co/t/elasticsearch-for-two-services/290344 "2021-11-30T21:44:09Z")
Hi, is possible that Elasticsearch can support two services on the same server, for example i have a wazuh server and this use Elasticsearch but i need install in this same sserver thehive that also use Elasticsearch, is… --- ## [About the timeout of elasticsearch](https://discuss.elastic.co/t/about-the-timeout-of-elasticsearch/290555)
**Author:** [@zekaifeng](https://discuss.elastic.co/u/zekaifeng)\ **Replies:** 0\ **Last updated:** [November 30, 2021, 12:14pm UTC](https://discuss.elastic.co/t/about-the-timeout-of-elasticsearch/290555 "2021-11-30T12:14:10Z")
When using the Java highlevel API to execute a query, the timeout is specified. The client timeout is abnormal, but the server is still querying. This timeout only be for the client? Or another way of saying that the … --- ## [Some networks were defined but are not used by any service: elastic](https://discuss.elastic.co/t/some-networks-were-defined-but-are-not-used-by-any-service-elastic/290480)
**Author:** [@iruushi\_lol](https://discuss.elastic.co/u/iruushi_lol)\ **Replies:** 10\ **Last updated:** [November 30, 2021, 6:43pm UTC](https://discuss.elastic.co/t/some-networks-were-defined-but-are-not-used-by-any-service-elastic/290480 "2021-11-30T18:43:36Z")
hey, i have a little problem with elastic, i have a error message : some networks were defined but are not used by any service: elastic, i have install kibana and this error appeared. i want to create ELK server on doc… --- ## [ES 1.7.1 - Node health chcks](https://discuss.elastic.co/t/es-1-7-1-node-health-chcks/290562)
**Author:** [@Deepak\_Soni](https://discuss.elastic.co/u/Deepak_Soni)\ **Replies:** 1\ **Last updated:** [November 30, 2021, 8:23pm UTC](https://discuss.elastic.co/t/es-1-7-1-node-health-chcks/290562 "2021-11-30T20:23:09Z")
Hello, We have a ES cluster using very old version of Elasticsearch 1.7.1. We are hosting it using EC2. We had a data node failure caused by EBS impairment. This failure was not detected as node failure by the data node … --- ## [Mapping conflict](https://discuss.elastic.co/t/mapping-conflict/290571)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 2\ **Last updated:** [November 30, 2021, 7:16pm UTC](https://discuss.elastic.co/t/mapping-conflict/290571 "2021-11-30T19:16:08Z")
I have mapping conflict. I know which field it has it. and I know what happen. using 7.14.1 basically one of the field which suppose to be float 0.0 become text "0.0" I scan whole index and updated about 17,000 docume… --- ## [Copy String field to new Integer Field gives error](https://discuss.elastic.co/t/copy-string-field-to-new-integer-field-gives-error/290590)
**Author:** [@A\_Mightiev](https://discuss.elastic.co/u/A_Mightiev)\ **Replies:** 0\ **Last updated:** [November 30, 2021, 6:31pm UTC](https://discuss.elastic.co/t/copy-string-field-to-new-integer-field-gives-error/290590 "2021-11-30T18:31:07Z")
Hello I have a keyword field that it should be a numeric instead. To avoid reindexing all my data I created a new field with the right numeric mapping. I would like to add the old data to the new mapping I am trying th… --- ## [Best practice for handling \_ids in get and search results](https://discuss.elastic.co/t/best-practice-for-handling-ids-in-get-and-search-results/290500)
**Author:** [@davestewart](https://discuss.elastic.co/u/davestewart)\ **Replies:** 5\ **Last updated:** [November 30, 2021, 4:19pm UTC](https://discuss.elastic.co/t/best-practice-for-handling-ids-in-get-and-search-results/290500 "2021-11-30T16:19:52Z")
Hello, Frontend engineer here, slowly improving at using Elasticsearch. Does anyone have any advice on how to best work with document \_ids, specifically with regards to sending them to the front end after a \_search or \_… --- ## [Attachment Pipeline Support for Old MS Word and Excel Format](https://discuss.elastic.co/t/attachment-pipeline-support-for-old-ms-word-and-excel-format/290141)
**Author:** [@David\_Chan](https://discuss.elastic.co/u/David_Chan)\ **Replies:** 3\ **Last updated:** [November 30, 2021, 4:14pm UTC](https://discuss.elastic.co/t/attachment-pipeline-support-for-old-ms-word-and-excel-format/290141 "2021-11-30T16:14:23Z")
Hi All! I'm uploading a Microsoft Word in .doc format, instead of .docx, to Elasticsearch using attachment pipeline, and I receive the following response. { "error": { "root\_cause": \[ { … [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=531) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=533)