# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=535 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 536 --- ## [Constructing a FunctionScoreQuery using NEST](https://discuss.elastic.co/t/constructing-a-functionscorequery-using-nest/290251)
**Author:** [@whisperingchild](https://discuss.elastic.co/u/whisperingchild)\ **Replies:** 1\ **Last updated:** [November 26, 2021, 8:54am UTC](https://discuss.elastic.co/t/constructing-a-functionscorequery-using-nest/290251 "2021-11-26T08:54:42Z")
I want to construct a query equivalent to the following JSON { "function\_score": { "script\_score": { "script": "doc\['some-field'\].value" } } } However, when I use the following code var q = new Funct… --- ## [Match with dynamic synonyms with Fasttext vectors](https://discuss.elastic.co/t/match-with-dynamic-synonyms-with-fasttext-vectors/290252)
**Author:** [@gevezex](https://discuss.elastic.co/u/gevezex)\ **Replies:** 0\ **Last updated:** [November 26, 2021, 8:10am UTC](https://discuss.elastic.co/t/match-with-dynamic-synonyms-with-fasttext-vectors/290252 "2021-11-26T08:10:21Z")
In my backend application I want to catch the search keywords of a user and find all synonyms with fasttext before passing it to es. So the idea is as follow: search terms of user: "couch fabric" fasttext will return: … --- ## [How many logstash can connect to elasticsearch cluster?](https://discuss.elastic.co/t/how-many-logstash-can-connect-to-elasticsearch-cluster/290242)
**Author:** [@kannan\_raj](https://discuss.elastic.co/u/kannan_raj)\ **Replies:** 1\ **Last updated:** [November 26, 2021, 7:43am UTC](https://discuss.elastic.co/t/how-many-logstash-can-connect-to-elasticsearch-cluster/290242 "2021-11-26T07:43:01Z")
we have logstash with 4 pipeline and each pipeline.worker is set to 120 and Elasticsearch cluster has 6 data nodes.(c5.9xlarge) we are facing high cpu usage in Elasticsearch data nodes when we have more than 10 logstash… --- ## [How to access nested field in ingest node pipeline?](https://discuss.elastic.co/t/how-to-access-nested-field-in-ingest-node-pipeline/290231)
**Author:** [@sidharth\_vijayakumar](https://discuss.elastic.co/u/sidharth_vijayakumar)\ **Replies:** 0\ **Last updated:** [November 26, 2021, 5:51am UTC](https://discuss.elastic.co/t/how-to-access-nested-field-in-ingest-node-pipeline/290231 "2021-11-26T05:51:27Z")
I need to access the field "kind" and it's nested I have shared how the data in json looks like. I want to use a set processor in ingest node pipelines and add a new field if this has a value pod. How do I achieve this? … --- ## [How to ignore a field from search if the field is not part of mappings?](https://discuss.elastic.co/t/how-to-ignore-a-field-from-search-if-the-field-is-not-part-of-mappings/290228)
**Author:** [@Raghavan\_TV](https://discuss.elastic.co/u/Raghavan_TV)\ **Replies:** 0\ **Last updated:** [November 26, 2021, 4:28am UTC](https://discuss.elastic.co/t/how-to-ignore-a-field-from-search-if-the-field-is-not-part-of-mappings/290228 "2021-11-26T04:28:00Z")
The document in elastic has field mappings only for the fields catalog and @type . now if a user sends an non-existing field ( countryCode ) in the search, is there a way in elastic to instruct to ignore the field in the… --- ## [How to config esrally metric store so that "meta" of rally-metrics-\* can record "took" of each query](https://discuss.elastic.co/t/how-to-config-esrally-metric-store-so-that-meta-of-rally-metrics-can-record-took-of-each-query/290024)
**Author:** [@kingswan](https://discuss.elastic.co/u/kingswan)\ **Replies:** 7\ **Last updated:** [November 26, 2021, 3:02am UTC](https://discuss.elastic.co/t/how-to-config-esrally-metric-store-so-that-meta-of-rally-metrics-can-record-took-of-each-query/290024 "2021-11-26T03:02:32Z")
I use metric store to save esrally results. Some of my results, the "meta" includes "took" of each query: "meta": { "plugins": \[ "test\_plugin" \], "attribute\_xpack.installed"… --- ## [How to implement deflate (best compression)?](https://discuss.elastic.co/t/how-to-implement-deflate-best-compression/289984)
**Author:** [@Linuxuser](https://discuss.elastic.co/u/Linuxuser)\ **Replies:** 23\ **Last updated:** [November 25, 2021, 11:00pm UTC](https://discuss.elastic.co/t/how-to-implement-deflate-best-compression/289984 "2021-11-25T23:00:24Z")
Hello, kindly help me out. My elastic version is 6.3 how can i implement best compression for the log stored by elastic. Thanks --- ## [How to make WebStorm / TypeScript completion work?](https://discuss.elastic.co/t/how-to-make-webstorm-typescript-completion-work/290222)
**Author:** [@davestewart](https://discuss.elastic.co/u/davestewart)\ **Replies:** 0\ **Last updated:** [November 25, 2021, 10:09pm UTC](https://discuss.elastic.co/t/how-to-make-webstorm-typescript-completion-work/290222 "2021-11-25T22:09:09Z")
Hi there, I'm pretty new to Elastic, been using it on and off for about a year, using the JavaScript client. I finally seem to be at the stage where I understand how to build complex queries, bool, match\_phrase\_prefix,… --- ## [Stats aggregation returning inconsistent results](https://discuss.elastic.co/t/stats-aggregation-returning-inconsistent-results/289377)
**Author:** [@Doug\_Coburn](https://discuss.elastic.co/u/Doug_Coburn)\ **Replies:** 1\ **Last updated:** [November 25, 2021, 7:27pm UTC](https://discuss.elastic.co/t/stats-aggregation-returning-inconsistent-results/289377 "2021-11-25T19:27:00Z")
Using version 7.9.2 curl -X POST 172.31.26.133:9200/5cab6838-5c3a-455d-9486-a708f6cb20a7/\_search --data-raw '{"aggs":{"Stats":{"stats":{"field":"Date & Time"}}},"size":0}' -H 'content-type: application/json' { "too… --- ## [How to configure ELK for geoip](https://discuss.elastic.co/t/how-to-configure-elk-for-geoip/289590)
**Author:** [@root\_linux](https://discuss.elastic.co/u/root_linux)\ **Replies:** 21\ **Last updated:** [November 25, 2021, 6:50pm UTC](https://discuss.elastic.co/t/how-to-configure-elk-for-geoip/289590 "2021-11-25T18:50:21Z")
Hi, I want to configure ELK stack. Elasticsearch, Kibana and Logstash will configure at one server and there will be multiple filebeat client. How can I configure for geoip? What need to configure in Elasticsearch, Kiba… --- ## [Group data and create a new index whit it](https://discuss.elastic.co/t/group-data-and-create-a-new-index-whit-it/290208)
**Author:** [@lino\_alejandro](https://discuss.elastic.co/u/lino_alejandro)\ **Replies:** 0\ **Last updated:** [November 25, 2021, 6:19pm UTC](https://discuss.elastic.co/t/group-data-and-create-a-new-index-whit-it/290208 "2021-11-25T18:19:54Z")
I have this data in my index { "filekey": "book1", "word": "carlos", "page": 1 }, { "filekey": "book1", "word": "license", "page": 1 }, { "filekey": "book1", "word": "carlos", … --- ## [Is it possible to mask field name in mappings?](https://discuss.elastic.co/t/is-it-possible-to-mask-field-name-in-mappings/290193)
**Author:** [@ddoroshenko](https://discuss.elastic.co/u/ddoroshenko)\ **Replies:** 1\ **Last updated:** [November 25, 2021, 3:21pm UTC](https://discuss.elastic.co/t/is-it-possible-to-mask-field-name-in-mappings/290193 "2021-11-25T15:21:58Z")
Hello! I'd like to set all fields type as keyword except some custom fields. "properties": { "field1": { "type" : "text" }, "\*": { "type" : "keyword" } } doesn't work ant the fields mapping dynamically. Is there… --- ## [Pagination with PIT query required on each request?](https://discuss.elastic.co/t/pagination-with-pit-query-required-on-each-request/290144)
**Author:** [@tamis-laan](https://discuss.elastic.co/u/tamis-laan)\ **Replies:** 1\ **Last updated:** [November 25, 2021, 2:49pm UTC](https://discuss.elastic.co/t/pagination-with-pit-query-required-on-each-request/290144 "2021-11-25T14:49:44Z")
When you start a query and request a PIT ID do you need to send the query along in subsequent requests? Is the search index and query not cached and referenced by the PIT id? And if the query is required, what happens … --- ## [Concatenating array objects in elasticsearch transform aggregations](https://discuss.elastic.co/t/concatenating-array-objects-in-elasticsearch-transform-aggregations/289980)
**Author:** [@kbirk](https://discuss.elastic.co/u/kbirk)\ **Replies:** 2\ **Last updated:** [November 25, 2021, 2:42pm UTC](https://discuss.elastic.co/t/concatenating-array-objects-in-elasticsearch-transform-aggregations/289980 "2021-11-25T14:42:12Z")
I'm currently using an Elasticsearch transform in order to "merge" similar documents. It works very well, however I've run into an issue attempting to concatenate fields that contain an array of objects. For example, I… --- ## [Elasticsearch cluster load balancing](https://discuss.elastic.co/t/elasticsearch-cluster-load-balancing/290187)
**Author:** [@dooger21](https://discuss.elastic.co/u/dooger21)\ **Replies:** 0\ **Last updated:** [November 25, 2021, 1:56pm UTC](https://discuss.elastic.co/t/elasticsearch-cluster-load-balancing/290187 "2021-11-25T13:56:41Z")
Hi everyone, Please I need your help with the following: I have an Elasticsearch cluster (3 nodes) in version 7.14 configured and working, as it is in a productive environment, the following safeguards were implemented … --- ## [In NEST how to make the match query conditional?](https://discuss.elastic.co/t/in-nest-how-to-make-the-match-query-conditional/290178)
**Author:** [@S\_Zaman](https://discuss.elastic.co/u/S_Zaman)\ **Replies:** 0\ **Last updated:** [November 25, 2021, 1:10pm UTC](https://discuss.elastic.co/t/in-nest-how-to-make-the-match-query-conditional/290178 "2021-11-25T13:10:52Z")
How to make the match conditionally added/removed in c# .NET NEST? var response = client.Search\(s =\> s .Index("mytweetindex") //or specify index via settings.DefaultIndex("mytweetindex"); .From(0) .Si… --- ## [User keyword and zero\_terms\_query in the same query](https://discuss.elastic.co/t/user-keyword-and-zero-terms-query-in-the-same-query/290177)
**Author:** [@fabry](https://discuss.elastic.co/u/fabry)\ **Replies:** 0\ **Last updated:** [November 25, 2021, 1:06pm UTC](https://discuss.elastic.co/t/user-keyword-and-zero-terms-query-in-the-same-query/290177 "2021-11-25T13:06:52Z")
Hi we would like to build a query like the following ... ... bool: { must: \[ match : { myfield.myfield2 : { query: "myvalue", zero\_terms\_query: "all" } } \] } ... .… --- ## [Encoded bytes are incorrect length issue](https://discuss.elastic.co/t/encoded-bytes-are-incorrect-length-issue/289547)
**Author:** [@Akaren](https://discuss.elastic.co/u/Akaren)\ **Replies:** 3\ **Last updated:** [November 25, 2021, 10:57am UTC](https://discuss.elastic.co/t/encoded-bytes-are-incorrect-length-issue/289547 "2021-11-25T10:57:32Z")
Hi, my Elasticsearch 7.7.1 sometimes returns encoded bytes are incorrect length error with 400. It's only sometimes, when I do the same search again, it suddently works. Can you tell me the meaning? What can be couse of… --- ## [Nodes restarting with shards initializing](https://discuss.elastic.co/t/nodes-restarting-with-shards-initializing/289489)
**Author:** [@Ayca](https://discuss.elastic.co/u/Ayca)\ **Replies:** 3\ **Last updated:** [November 25, 2021, 10:06am UTC](https://discuss.elastic.co/t/nodes-restarting-with-shards-initializing/289489 "2021-11-25T10:06:01Z")
Our elastic cluster had some nodes restarted with a network outage and when they were back, we were monitoring the shard reallocations. The question is, even on unaffected nodes were there shards in the state of "INITI… --- ## [Machine learning error: persistent task is awating node assignment](https://discuss.elastic.co/t/machine-learning-error-persistent-task-is-awating-node-assignment/290043)
**Author:** [@parthmaniar](https://discuss.elastic.co/u/parthmaniar)\ **Replies:** 3\ **Last updated:** [November 25, 2021, 9:54am UTC](https://discuss.elastic.co/t/machine-learning-error-persistent-task-is-awating-node-assignment/290043 "2021-11-25T09:54:43Z")
Hello, I hope this message finds Elastic community and their loved ones safe and healthy. I have a three node cluster: Node-1 and Node-2 hold data & carry out computation: both have has 24 GB of RAM with jvm set to… --- ## [Spark/ES on kubernetes, co-location ok?](https://discuss.elastic.co/t/spark-es-on-kubernetes-co-location-ok/290153)
**Author:** [@rzrucher](https://discuss.elastic.co/u/rzrucher)\ **Replies:** 0\ **Last updated:** [November 25, 2021, 9:53am UTC](https://discuss.elastic.co/t/spark-es-on-kubernetes-co-location-ok/290153 "2021-11-25T09:53:35Z")
Hi all, I've a question related to architecture. As anyone experienced a deployment of Elasticsearch and spark on a kubernetes cluster ? My main concern is how to es-hadoop connector works in this situation in regards … --- ## [Build fails with "Invalid version format: '20.10.8+dfsg1'. Should be major.minor.revision\[-extra\]"](https://discuss.elastic.co/t/build-fails-with-invalid-version-format-20-10-8-dfsg1-should-be-major-minor-revision-extra/288018)
**Author:** [@TimRuehsen](https://discuss.elastic.co/u/TimRuehsen)\ **Replies:** 1\ **Last updated:** [November 25, 2021, 9:11am UTC](https://discuss.elastic.co/t/build-fails-with-invalid-version-format-20-10-8-dfsg1-should-be-major-minor-revision-extra/288018 "2021-11-25T09:11:48Z")
Just cloned the repository from GH (commit e5251bc5a0d5382c64e3751953e4f38fb67633e1) and the build fails with the above mentioned error. I am on Debian testing amd64. The command and output is $ ./gradlew assemble ===… --- ## [Connect to Elasticsearch remotely](https://discuss.elastic.co/t/connect-to-elasticsearch-remotely/289919)
**Author:** [@AlexM566](https://discuss.elastic.co/u/AlexM566)\ **Replies:** 14\ **Last updated:** [November 24, 2021, 9:26am UTC](https://discuss.elastic.co/t/connect-to-elasticsearch-remotely/289919 "2021-11-24T09:26:37Z")
Hello community, I have a problem. I have installed on ubuntu 20.04 an ELK stack 7.15.2. My goal is to connect remotely to Elasticsearch to ingest data from a web form into Elasticsearch and my problem is that I cannot … --- ## [Long running uncancellable transport task](https://discuss.elastic.co/t/long-running-uncancellable-transport-task/290138)
**Author:** [@hunsw](https://discuss.elastic.co/u/hunsw)\ **Replies:** 0\ **Last updated:** [November 25, 2021, 8:10am UTC](https://discuss.elastic.co/t/long-running-uncancellable-transport-task/290138 "2021-11-25T08:10:23Z")
I have a transport task that cannot be cancelled, but has been running for 60+ days. I have 2 questions: Is there anything I can do to make this task disappear OTHER than restarting the node? (E.g. should I try to cl… --- ## [How to guarantee exact retention time for logs?](https://discuss.elastic.co/t/how-to-guarantee-exact-retention-time-for-logs/290056)
**Author:** [@Kosodrom](https://discuss.elastic.co/u/Kosodrom)\ **Replies:** 2\ **Last updated:** [November 25, 2021, 6:04am UTC](https://discuss.elastic.co/t/how-to-guarantee-exact-retention-time-for-logs/290056 "2021-11-25T06:04:35Z")
Hi folks, I have following question: I store logs in Elasticsearch cluster and want to guarantee the promised retention time of 30 days to the developer. I have configured my Lifecycle policy to rollover after 30 days… --- ## [Elasticsearch unreachable from service declared in docker-compose](https://discuss.elastic.co/t/elasticsearch-unreachable-from-service-declared-in-docker-compose/290110)
**Author:** [@ray2](https://discuss.elastic.co/u/ray2)\ **Replies:** 0\ **Last updated:** [November 24, 2021, 10:01pm UTC](https://discuss.elastic.co/t/elasticsearch-unreachable-from-service-declared-in-docker-compose/290110 "2021-11-24T22:01:11Z")
Hello everyone ! I have a problem to reach the Elasticsearch container from a service inside the docker network. So I'm running a single node instance and If I try to reach from localhost:9202 everything looks good but … --- ## [Sametimes logs are not parsed](https://discuss.elastic.co/t/sametimes-logs-are-not-parsed/289940)
**Author:** [@gabrielfsousa](https://discuss.elastic.co/u/gabrielfsousa)\ **Replies:** 1\ **Last updated:** [November 24, 2021, 9:04pm UTC](https://discuss.elastic.co/t/sametimes-logs-are-not-parsed/289940 "2021-11-24T21:04:18Z")
Using filebeat 7.10.2 and sending to ES 7.10.2 , same times are logs not parsed, with no errors, exemple of a log not parsed {"type":"log","@timestamp":"2021-10-26T14:04:32Z","tags":\["info","plugins","security","audit",… --- ## [Generating node certificate](https://discuss.elastic.co/t/generating-node-certificate/290055)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 2\ **Last updated:** [November 24, 2021, 8:17pm UTC](https://discuss.elastic.co/t/generating-node-certificate/290055 "2021-11-24T20:17:46Z")
Using elk 7.15 i just have small doubt that in earlier 7.10 elasticsearch documentation https://www.elastic.co/guide/en/elasticsearch/reference/7.10/configuring-tls.html#tls-transport Encrypting communications between… --- ## [Elasticsearch with non-root user - Backup restore is not working](https://discuss.elastic.co/t/elasticsearch-with-non-root-user-backup-restore-is-not-working/288177)
**Author:** [@Sagarika\_Mahalik](https://discuss.elastic.co/u/Sagarika_Mahalik)\ **Replies:** 2\ **Last updated:** [November 24, 2021, 7:46pm UTC](https://discuss.elastic.co/t/elasticsearch-with-non-root-user-backup-restore-is-not-working/288177 "2021-11-24T19:46:32Z")
We have a docker image for Elasticsearch where I added. a non-root user as it is required to fix some vulnerabilities. After adding non-root user, we are facing with the backup-restore functionalities. I am getting error… --- ## [Get the @timestamp of the document that has the max of a value](https://discuss.elastic.co/t/get-the-timestamp-of-the-document-that-has-the-max-of-a-value/290093)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 3\ **Last updated:** [November 24, 2021, 6:31pm UTC](https://discuss.elastic.co/t/get-the-timestamp-of-the-document-that-has-the-max-of-a-value/290093 "2021-11-24T18:31:00Z")
Hi I need to get the max of memory usage per host in a time range, I think I can do this with the query below, but I also need the @timestamp of the document when the max memory usage happens. how can I do this? GET me… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=534) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=536)