# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=534 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 535 --- ## [Elasticserach not starting](https://discuss.elastic.co/t/elasticserach-not-starting/289965)
**Author:** [@zanoob](https://discuss.elastic.co/u/zanoob)\ **Replies:** 8\ **Last updated:** [November 29, 2021, 9:38am UTC](https://discuss.elastic.co/t/elasticserach-not-starting/289965 "2021-11-29T09:38:50Z")
One of my Elasticsearch nodes stopped the service and moved the master to another node. The logs do not show much info, why but rather just say master moved to a different node. \[2021-11-23T13:57:21,216\]\[INFO \]\[o.e.n.N… --- ## [Elastic stack rules](https://discuss.elastic.co/t/elastic-stack-rules/290413)
**Author:** [@oliviawang](https://discuss.elastic.co/u/oliviawang)\ **Replies:** 0\ **Last updated:** [November 29, 2021, 9:31am UTC](https://discuss.elastic.co/t/elastic-stack-rules/290413 "2021-11-29T09:31:52Z")
Hi All, According to the document, I want to receive the notification only on status change, and already setting notify field for Only on Status change , but still receive a lot of same alerts.. Does any one have some … --- ## [Icinga integration with ELK](https://discuss.elastic.co/t/icinga-integration-with-elk/290397)
**Author:** [@mohammed.sabil](https://discuss.elastic.co/u/mohammed.sabil)\ **Replies:** 0\ **Last updated:** [November 29, 2021, 7:10am UTC](https://discuss.elastic.co/t/icinga-integration-with-elk/290397 "2021-11-29T07:10:58Z")
Hello All / @widhalm\_t I need your suggestion/assistance here to send the logstash logs to Icinga for monitoring purpose. Let me explain you my environment and scenario. We are using ubuntu 20.4 I have ELK stack runn… --- ## [Bulk vs Single operations for 1 document](https://discuss.elastic.co/t/bulk-vs-single-operations-for-1-document/289522)
**Author:** [@LinHuiqing](https://discuss.elastic.co/u/LinHuiqing)\ **Replies:** 4\ **Last updated:** [November 29, 2021, 6:45am UTC](https://discuss.elastic.co/t/bulk-vs-single-operations-for-1-document/289522 "2021-11-29T06:45:09Z")
Hi, I understand that using bulk operations when there are many operations to be made brings performance benefits based on forums and documentation. However, how does a bulk operation with a single operation compare to s… --- ## ["include\_in\_root" option with wildcard field causes "illegal\_argument\_exception"](https://discuss.elastic.co/t/include-in-root-option-with-wildcard-field-causes-illegal-argument-exception/290353)
**Author:** [@Tomo\_M](https://discuss.elastic.co/u/Tomo_M)\ **Replies:** 2\ **Last updated:** [November 29, 2021, 6:11am UTC](https://discuss.elastic.co/t/include-in-root-option-with-wildcard-field-causes-illegal-argument-exception/290353 "2021-11-29T06:11:43Z")
Hello, I tried to use "include\_in\_root" option with nesting wildcard field but got error. The Elasticsearch version is as follows: "version" : { "number" : "7.15.2", "build\_flavor" : "default", "build\_type… --- ## [Synonyms relevance help](https://discuss.elastic.co/t/synonyms-relevance-help/290172)
**Author:** [@sagarpatel](https://discuss.elastic.co/u/sagarpatel)\ **Replies:** 6\ **Last updated:** [November 29, 2021, 5:38am UTC](https://discuss.elastic.co/t/synonyms-relevance-help/290172 "2021-11-29T05:38:40Z")
HI, I am trying to configured synonyms in Elasticsearch and done the sample configuration as well. But not getting expected relevancy when i am searching data. Below is index Mapping configuration: PUT /test\_index { … --- ## [Rally Benchmark - Which race/benchmark to use for performance testing](https://discuss.elastic.co/t/rally-benchmark-which-race-benchmark-to-use-for-performance-testing/289994)
**Author:** [@mmadhana](https://discuss.elastic.co/u/mmadhana)\ **Replies:** 1\ **Last updated:** [November 29, 2021, 4:55am UTC](https://discuss.elastic.co/t/rally-benchmark-which-race-benchmark-to-use-for-performance-testing/289994 "2021-11-29T04:55:57Z")
Hi, I am using Rally on ECK to test the performance of my hardware - CPU cores/memory, storage, and network usage. Which benchmark/race is compute-intensive and has a mix of indexing and concurrent search workload? I use… --- ## [Elastic support diagnostics, Scrub.bat -c parameter](https://discuss.elastic.co/t/elastic-support-diagnostics-scrub-bat-c-parameter/290254)
**Author:** [@newschapmj1](https://discuss.elastic.co/u/newschapmj1)\ **Replies:** 1\ **Last updated:** [November 29, 2021, 4:46am UTC](https://discuss.elastic.co/t/elastic-support-diagnostics-scrub-bat-c-parameter/290254 "2021-11-29T04:46:54Z")
Contains an example /scrub.sh -i '/Users/adminuser/diagnostic output/diagnostics-20180621-161231.zip' -o /home/adminuser/sanitized-diags -c /home/adminuser/sanitized-diags/scrub.yml What is the -c parameter? scrub.b… --- ## [How to check the user details who delete the pipeline from Kibana or elasticseach](https://discuss.elastic.co/t/how-to-check-the-user-details-who-delete-the-pipeline-from-kibana-or-elasticseach/290276)
**Author:** [@muralikrishna](https://discuss.elastic.co/u/muralikrishna)\ **Replies:** 1\ **Last updated:** [November 28, 2021, 9:43pm UTC](https://discuss.elastic.co/t/how-to-check-the-user-details-who-delete-the-pipeline-from-kibana-or-elasticseach/290276 "2021-11-28T21:43:01Z")
Hello Everyone, We have situation that someone has deleted one of our Logstash pipeline from kibana (centrally managing from kibana) around 30 days back but we have noticed recently. Is there a possibility to check the… --- ## [How to get service status information from kafka connectors](https://discuss.elastic.co/t/how-to-get-service-status-information-from-kafka-connectors/290289)
**Author:** [@can.ozdemir](https://discuss.elastic.co/u/can.ozdemir)\ **Replies:** 0\ **Last updated:** [November 26, 2021, 1:13pm UTC](https://discuss.elastic.co/t/how-to-get-service-status-information-from-kafka-connectors/290289 "2021-11-26T13:13:16Z")
Hello, I have three kafka brokers take/ write data from everywhere into topics, after that filebeat kafka-connectors index all topics data into Elasticsearch indexes. My question is, are there any easy ways to get logs … --- ## [Indexing large number of transcripts](https://discuss.elastic.co/t/indexing-large-number-of-transcripts/290373)
**Author:** [@Chris\_Schutte](https://discuss.elastic.co/u/Chris_Schutte)\ **Replies:** 0\ **Last updated:** [November 28, 2021, 8:07pm UTC](https://discuss.elastic.co/t/indexing-large-number-of-transcripts/290373 "2021-11-28T20:07:13Z")
Hi all, I am new to elastic and have a modelling question. We have a large number of conversation transcripts and would like to index those using elastic. We have the identity of the speaker for each paragraph of the … --- ## [Docker swarm deployment: master\_not\_discovered\_exception](https://discuss.elastic.co/t/docker-swarm-deployment-master-not-discovered-exception/290348)
**Author:** [@AlanSBN](https://discuss.elastic.co/u/AlanSBN)\ **Replies:** 4\ **Last updated:** [November 28, 2021, 7:24pm UTC](https://discuss.elastic.co/t/docker-swarm-deployment-master-not-discovered-exception/290348 "2021-11-28T19:24:14Z")
I am basing my deployment off of the docker-compose.yml file found here. My modified yml file is pasted below. The docker swarm gets all three services running (only one replicated container per service) but the logs … --- ## [Curator Space filter not working correctly on small indexes](https://discuss.elastic.co/t/curator-space-filter-not-working-correctly-on-small-indexes/290370)
**Author:** [@Greg12](https://discuss.elastic.co/u/Greg12)\ **Replies:** 1\ **Last updated:** [November 28, 2021, 5:55pm UTC](https://discuss.elastic.co/t/curator-space-filter-not-working-correctly-on-small-indexes/290370 "2021-11-28T17:55:49Z")
I am trying to avoid reindexing larger indexes but the curator space filter seems to not see the space properly. I think it may have issues with indexes that are less than 1GB. What calls does curator make to get index … --- ## [Indeces with current date while using Index Life Management with file beat](https://discuss.elastic.co/t/indeces-with-current-date-while-using-index-life-management-with-file-beat/289222)
**Author:** [@shi](https://discuss.elastic.co/u/shi)\ **Replies:** 5\ **Last updated:** [November 28, 2021, 4:05pm UTC](https://discuss.elastic.co/t/indeces-with-current-date-while-using-index-life-management-with-file-beat/289222 "2021-11-28T16:05:34Z")
For bootstrapping an index for using ILM, with filebeat , the following command was used PUT lp\_index-otherfgtraffull-000001 { "aliases": { "lp\_index-otherfgtraffull": { "is\_write\_index": true } } } … --- ## [Upgrading Elasticsearch](https://discuss.elastic.co/t/upgrading-elasticsearch/289319)
**Author:** [@Farid\_N](https://discuss.elastic.co/u/Farid_N)\ **Replies:** 7\ **Last updated:** [November 28, 2021, 1:34am UTC](https://discuss.elastic.co/t/upgrading-elasticsearch/289319 "2021-11-28T01:34:02Z")
Dear team, I want to upgrade my ES cluster to a newer version. This is the version I\`m using: According to the bellow page: I just want to know can I upgrade my cluster with Rolling Upgrade ? Or which way should … --- ## [Running FSCrawler in Debian 10, results in \`command not found\`](https://discuss.elastic.co/t/running-fscrawler-in-debian-10-results-in-command-not-found/290095)
**Author:** [@ehsan\_kabiri\_33](https://discuss.elastic.co/u/ehsan_kabiri_33)\ **Replies:** 5\ **Last updated:** [November 28, 2021, 12:05am UTC](https://discuss.elastic.co/t/running-fscrawler-in-debian-10-results-in-command-not-found/290095 "2021-11-28T00:05:22Z")
I'm trying to run fscrawler on Debian 10. I have downloded both fscrawler-es7-2.8-SNAPSHOT.zip and fscrawler-es7-2.7.zip then exctract them to /home/myname/fscrawler, but running these codes always results in command not… --- ## [Point In Time Search using wild card index](https://discuss.elastic.co/t/point-in-time-search-using-wild-card-index/290329)
**Author:** [@rohith511](https://discuss.elastic.co/u/rohith511)\ **Replies:** 0\ **Last updated:** [November 27, 2021, 9:36am UTC](https://discuss.elastic.co/t/point-in-time-search-using-wild-card-index/290329 "2021-11-27T09:36:02Z")
Sometime back when we created elastic we created multiple indexes with same initial pattern and these are dynamic suffix. (eg : microservice\_logs\_XYZ , microservice\_logs\_abc , microservice\_logs\_pqr etc..) Not sure the… --- ## [NotSslRecordException: not an SSL/TLS record while adding New Node to Cluster](https://discuss.elastic.co/t/notsslrecordexception-not-an-ssl-tls-record-while-adding-new-node-to-cluster/289334)
**Author:** [@ankurthakur](https://discuss.elastic.co/u/ankurthakur)\ **Replies:** 2\ **Last updated:** [November 27, 2021, 6:44pm UTC](https://discuss.elastic.co/t/notsslrecordexception-not-an-ssl-tls-record-while-adding-new-node-to-cluster/289334 "2021-11-27T18:44:03Z")
Hi, Hope everyone is doing well! We are having trouble adding a New Node to a Cluster which has SSL enabled using XPack Security. Before I write further, please keep the below things in mind: Installed same version o… --- ## [Email alerts on kibana dashboard](https://discuss.elastic.co/t/email-alerts-on-kibana-dashboard/290312)
**Author:** [@Prasanth\_V](https://discuss.elastic.co/u/Prasanth_V)\ **Replies:** 1\ **Last updated:** [November 27, 2021, 5:44pm UTC](https://discuss.elastic.co/t/email-alerts-on-kibana-dashboard/290312 "2021-11-27T17:44:49Z")
Hi Team, Is it possible to implement email alerts on community edition. Kindly, suggest . Thanks! --- ## [Elasticsearch as a primary storage](https://discuss.elastic.co/t/elasticsearch-as-a-primary-storage/290196)
**Author:** [@xtapodi](https://discuss.elastic.co/u/xtapodi)\ **Replies:** 5\ **Last updated:** [November 26, 2021, 4:17am UTC](https://discuss.elastic.co/t/elasticsearch-as-a-primary-storage/290196 "2021-11-26T04:17:42Z")
We have lots of users(30-200 million). Each user has N(30-100) attributes. The attribute can be of type integer, text, timestamp or counter. Schema is not defined. We are looking for a database to which we can index and… --- ## [Elastic node can't start due to removed index setting](https://discuss.elastic.co/t/elastic-node-cant-start-due-to-removed-index-setting/290115)
**Author:** [@vvp199303](https://discuss.elastic.co/u/vvp199303)\ **Replies:** 5\ **Last updated:** [November 26, 2021, 6:50pm UTC](https://discuss.elastic.co/t/elastic-node-cant-start-due-to-removed-index-setting/290115 "2021-11-26T18:50:10Z")
Hi. I have a trouble with Elastic cluster (v 7.13.0) . Аfter adding an { "index.mapper.dynamic" : false } option for one index in cluster I was unable to restart cluster node. Also, I can't change "index.mapper.dynamic… --- ## [Is there a procedure on integrating wazuh with ldap?](https://discuss.elastic.co/t/is-there-a-procedure-on-integrating-wazuh-with-ldap/289632)
**Author:** [@nour.megahed](https://discuss.elastic.co/u/nour.megahed)\ **Replies:** 1\ **Last updated:** [November 26, 2021, 6:22pm UTC](https://discuss.elastic.co/t/is-there-a-procedure-on-integrating-wazuh-with-ldap/289632 "2021-11-26T18:22:23Z")
is there a procedure on integrating wazuh with ldap? --- ## [Elasticsearch partial update based on Aggregation result](https://discuss.elastic.co/t/elasticsearch-partial-update-based-on-aggregation-result/290198)
**Author:** [@orivard](https://discuss.elastic.co/u/orivard)\ **Replies:** 4\ **Last updated:** [November 26, 2021, 5:03pm UTC](https://discuss.elastic.co/t/elasticsearch-partial-update-based-on-aggregation-result/290198 "2021-11-26T17:03:09Z")
I want to update partially all objects that are based on aggregation result. Here is my object: { "name": "name", "identificationHash": "aslkdakldjka", "isDupe": false, ... } My goal is to set isDupe to "true" for… --- ## [Aggregation string response to get buckets](https://discuss.elastic.co/t/aggregation-string-response-to-get-buckets/290306)
**Author:** [@silviya](https://discuss.elastic.co/u/silviya)\ **Replies:** 0\ **Last updated:** [November 26, 2021, 3:35pm UTC](https://discuss.elastic.co/t/aggregation-string-response-to-get-buckets/290306 "2021-11-26T15:35:38Z")
Hi , I have a aggregation response in the format of string . i need to get the bucket counts . Is this possible to get bucket counts from string without taking from search response please help! Thanks in advance --- ## [NEST vs Elastic query inconsistency](https://discuss.elastic.co/t/nest-vs-elastic-query-inconsistency/290282)
**Author:** [@Perrow](https://discuss.elastic.co/u/Perrow)\ **Replies:** 1\ **Last updated:** [November 26, 2021, 2:03pm UTC](https://discuss.elastic.co/t/nest-vs-elastic-query-inconsistency/290282 "2021-11-26T14:03:19Z")
I'm updating an application that used Elastic 1.6 to version 7.15. I've gotten indexing to work and some searching but for some reason filters aren't working. The queries are built dynamically and I think I've managed to… --- ## [How can I take dump of freeze index?](https://discuss.elastic.co/t/how-can-i-take-dump-of-freeze-index/290268)
**Author:** [@Sage](https://discuss.elastic.co/u/Sage)\ **Replies:** 0\ **Last updated:** [November 26, 2021, 10:05am UTC](https://discuss.elastic.co/t/how-can-i-take-dump-of-freeze-index/290268 "2021-11-26T10:05:50Z")
Hi, I am facing an issue with elasticdump. I want to take dump of all index in which some of freeze indices but getting issue with freeze index. Can anyone tell me is possible to take dump of freeze index? --- ## [How to aggregate sub documents](https://discuss.elastic.co/t/how-to-aggregate-sub-documents/290184)
**Author:** [@Aleem\_Ktk](https://discuss.elastic.co/u/Aleem_Ktk)\ **Replies:** 2\ **Last updated:** [November 26, 2021, 9:47am UTC](https://discuss.elastic.co/t/how-to-aggregate-sub-documents/290184 "2021-11-26T09:47:09Z")
I have sub documents in the main document , below is the format: "activities:\[ { "code": "CODE1", "price":20 }, { "code": "CODE2", "price":24 } \] I want to sum the price group by code. However, the term aggreg… --- ## [Return latency\_info.keyword in a Watcher for Kibana elasticsearch](https://discuss.elastic.co/t/return-latency-info-keyword-in-a-watcher-for-kibana-elasticsearch/290261)
**Author:** [@Aitor\_MtzAm](https://discuss.elastic.co/u/Aitor_MtzAm)\ **Replies:** 0\ **Last updated:** [November 26, 2021, 9:43am UTC](https://discuss.elastic.co/t/return-latency-info-keyword-in-a-watcher-for-kibana-elasticsearch/290261 "2021-11-26T09:43:40Z")
Hello! I am really a little newbie in Elasticsearch. I need help returning the latency\_info.keyword field. I am setting up a wathcer for an API and I need a webhook in teams to show me that field. I have this created: "… --- ## [Missing documents after elastic restart](https://discuss.elastic.co/t/missing-documents-after-elastic-restart/290210)
**Author:** [@adminunix](https://discuss.elastic.co/u/adminunix)\ **Replies:** 5\ **Last updated:** [November 26, 2021, 9:28am UTC](https://discuss.elastic.co/t/missing-documents-after-elastic-restart/290210 "2021-11-26T09:28:16Z")
Hello, I have had a strange issue. An index has lost many documents and the elastic logs doesn´t show any message about it. These are monitoring visualizations about the index: I have noticed this issue after res… --- ## [Constructing a FunctionScoreQuery using NEST](https://discuss.elastic.co/t/constructing-a-functionscorequery-using-nest/290251)
**Author:** [@whisperingchild](https://discuss.elastic.co/u/whisperingchild)\ **Replies:** 1\ **Last updated:** [November 26, 2021, 8:54am UTC](https://discuss.elastic.co/t/constructing-a-functionscorequery-using-nest/290251 "2021-11-26T08:54:42Z")
I want to construct a query equivalent to the following JSON { "function\_score": { "script\_score": { "script": "doc\['some-field'\].value" } } } However, when I use the following code var q = new Funct… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=533) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=535)