# Elasticsearch

**URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=538

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 539

---

## [Get a number und events per minute](https://discuss.elastic.co/t/get-a-number-und-events-per-minute/289217)

<div class="topic-metadata">

**Author:** [@bitnapper](https://discuss.elastic.co/u/bitnapper)\
**Replies:** 3\
**Last updated:** [November 19, 2021, 3:57pm UTC](https://discuss.elastic.co/t/get-a-number-und-events-per-minute/289217 "2021-11-19T15:57:35Z")

</div>

Hi, I tried to figure out how many documents come in per minute. I coulnt find anything useful in stack monitoring so I tried with kibana and failed. I built a query giving me the documents from last 90 days but I cant …

---

## [Global Ordinals execution hint](https://discuss.elastic.co/t/global-ordinals-execution-hint/289699)

<div class="topic-metadata">

**Author:** [@ananth](https://discuss.elastic.co/u/ananth)\
**Replies:** 0\
**Last updated:** [November 19, 2021, 2:42pm UTC](https://discuss.elastic.co/t/global-ordinals-execution-hint/289699 "2021-11-19T14:42:30Z")

</div>

Hi All, I went through all the global ordinal related blogs and previous questions such as Global ordinals performance and size on-heap" Whether execution\_hint = map will operate in segment-private ordinal space ? My …

---

## [Efficient filtering in custom plugin](https://discuss.elastic.co/t/efficient-filtering-in-custom-plugin/289697)

<div class="topic-metadata">

**Author:** [@mjanuszkiewicz-tt](https://discuss.elastic.co/u/mjanuszkiewicz-tt)\
**Replies:** 0\
**Last updated:** [November 19, 2021, 2:40pm UTC](https://discuss.elastic.co/t/efficient-filtering-in-custom-plugin/289697 "2021-11-19T14:40:37Z")

</div>

Hello, I'm writing a custom plugin that allows filtering/scoring using an external service. The overhead of calling the service is relatively high: filtering a single document takes 80ms, filtering 10k documents takes 1…

---

## [How to get search results with exact matches sorted by popularity within themselves and then partial matches sorted by popularity within themselves?](https://discuss.elastic.co/t/how-to-get-search-results-with-exact-matches-sorted-by-popularity-within-themselves-and-then-partial-matches-sorted-by-popularity-within-themselves/289685)

<div class="topic-metadata">

**Author:** [@f3dd3rn](https://discuss.elastic.co/u/f3dd3rn)\
**Replies:** 0\
**Last updated:** [November 19, 2021, 12:49pm UTC](https://discuss.elastic.co/t/how-to-get-search-results-with-exact-matches-sorted-by-popularity-within-themselves-and-then-partial-matches-sorted-by-popularity-within-themselves/289685 "2021-11-19T12:49:06Z")

</div>

Hello Elastic community, I am new to Elasticsearch and feel lost as to how to accomplish this. I have tried a lot of different things, but was not able to accomplish this. Let me explain the expected search results wi…

---

## [Query with wildcard do not return result if the item has data repeat more than 2 times](https://discuss.elastic.co/t/query-with-wildcard-do-not-return-result-if-the-item-has-data-repeat-more-than-2-times/289500)

<div class="topic-metadata">

**Author:** [@Tu\_Phan](https://discuss.elastic.co/u/Tu_Phan)\
**Replies:** 2\
**Last updated:** [November 19, 2021, 11:11am UTC](https://discuss.elastic.co/t/query-with-wildcard-do-not-return-result-if-the-item-has-data-repeat-more-than-2-times/289500 "2021-11-19T11:11:46Z")

</div>

Hi Elastic team & community, I got a trouble with wildcard query do not return expected result when having items with repeated data. With the code below I expected that search query returns 2 items but it returns only …

---

## [Elasticsearch files in tmp folder: how to change there location](https://discuss.elastic.co/t/elasticsearch-files-in-tmp-folder-how-to-change-there-location/289543)

<div class="topic-metadata">

**Author:** [@1ac727ff300829bca0fa](https://discuss.elastic.co/u/1ac727ff300829bca0fa)\
**Replies:** 4\
**Last updated:** [November 19, 2021, 7:02am UTC](https://discuss.elastic.co/t/elasticsearch-files-in-tmp-folder-how-to-change-there-location/289543 "2021-11-19T07:02:16Z")

</div>

Hello guys, I have set up elk in linx server using tar, but my tmp directory gets filled with files in following formates /tmp/elasticsearch-17741669071348173933 How to change there location?

---

## [Java application using BulkProcessing hangs When "circuit\_breaking\_exception" occurs](https://discuss.elastic.co/t/java-application-using-bulkprocessing-hangs-when-circuit-breaking-exception-occurs/289660)

<div class="topic-metadata">

**Author:** [@Vinay\_Gayki](https://discuss.elastic.co/u/Vinay_Gayki)\
**Replies:** 0\
**Last updated:** [November 19, 2021, 6:27am UTC](https://discuss.elastic.co/t/java-application-using-bulkprocessing-hangs-when-circuit-breaking-exception-occurs/289660 "2021-11-19T06:27:20Z")

</div>

Using ES 7.5.1 as the server and RestHighLevelClient in java application. Java application hangs after circuit\_breaking\_exception and becomes unresponsive. We are indexing data using bulk API. Stack trace: Name: Orac…

---

## [Comparison of two aggregation results](https://discuss.elastic.co/t/comparison-of-two-aggregation-results/289659)

<div class="topic-metadata">

**Author:** [@Nikita95](https://discuss.elastic.co/u/Nikita95)\
**Replies:** 0\
**Last updated:** [November 19, 2021, 6:19am UTC](https://discuss.elastic.co/t/comparison-of-two-aggregation-results/289659 "2021-11-19T06:19:08Z")

</div>

Hi everyone! I'm new to elastic. The question arises, how can I compare two aggregation results and output the number of matches and differences. { "size": 0, "aggs": { "list\_ids\_in\_current\_range": { "ra…

---

## [Do I need to clear all scroll id when get difference scroll id in mutiple scroll request?](https://discuss.elastic.co/t/do-i-need-to-clear-all-scroll-id-when-get-difference-scroll-id-in-mutiple-scroll-request/289574)

<div class="topic-metadata">

**Author:** [@yuhaowin](https://discuss.elastic.co/u/yuhaowin)\
**Replies:** 2\
**Last updated:** [November 19, 2021, 5:57am UTC](https://discuss.elastic.co/t/do-i-need-to-clear-all-scroll-id-when-get-difference-scroll-id-in-mutiple-scroll-request/289574 "2021-11-19T05:57:41Z")

</div>

I know in every scroll request we may get difference scroll id,, when I have a list of difference scroll id, need clear all of them? I see search-scroll api example in elasticsearch guide, just clear recently scroll id. …

---

## [Super user that creates api keys on behalf of other user](https://discuss.elastic.co/t/super-user-that-creates-api-keys-on-behalf-of-other-user/289511)

<div class="topic-metadata">

**Author:** [@Scotturbina](https://discuss.elastic.co/u/Scotturbina)\
**Replies:** 1\
**Last updated:** [November 19, 2021, 4:36am UTC](https://discuss.elastic.co/t/super-user-that-creates-api-keys-on-behalf-of-other-user/289511 "2021-11-19T04:36:05Z")

</div>

I got a super user, I need this super user can grant api keys on behalf other user (these users are not native, they sign in via SSO with Open Id) I saw that Grant API key API | Elasticsearch Guide \[7.15\] | Elastic need…

---

## [Confluence(Cloud) Sync Error](https://discuss.elastic.co/t/confluence-cloud-sync-error/289516)

<div class="topic-metadata">

**Author:** [@sungho](https://discuss.elastic.co/u/sungho)\
**Replies:** 1\
**Last updated:** [November 19, 2021, 4:28am UTC](https://discuss.elastic.co/t/confluence-cloud-sync-error/289516 "2021-11-19T04:28:57Z")

</div>

"incremental": \[ { "createdAt": "2021-11-17T22:40:41Z", "status": "complete", "fatalException": null, "errorReason": null, "completedAt": "2021-11-17T22:40:50Z", "durationSeconds": 9.0, "documentErrorCount": 1, …

---

## [Total Indices size per node drops every midnight and back to normal after an hour](https://discuss.elastic.co/t/total-indices-size-per-node-drops-every-midnight-and-back-to-normal-after-an-hour/289541)

<div class="topic-metadata">

**Author:** [@binmats](https://discuss.elastic.co/u/binmats)\
**Replies:** 0\
**Last updated:** [November 18, 2021, 8:08am UTC](https://discuss.elastic.co/t/total-indices-size-per-node-drops-every-midnight-and-back-to-normal-after-an-hour/289541 "2021-11-18T08:08:17Z")

</div>

Hi , We have 3 master and 3 data node clusters. We are monitoring the stats with metricbeat. We use elastic 7.9.3 version and metricbeat 7.11 This is the metric: Elasticsearch.node.stats.indices.store.size.bytes We ha…

---

## [Enabling xpack security TLS](https://discuss.elastic.co/t/enabling-xpack-security-tls/289636)

<div class="topic-metadata">

**Author:** [@mwoods269](https://discuss.elastic.co/u/mwoods269)\
**Replies:** 1\
**Last updated:** [November 19, 2021, 4:22am UTC](https://discuss.elastic.co/t/enabling-xpack-security-tls/289636 "2021-11-19T04:22:30Z")

</div>

Just upgraded 3 node cluster (sandbox) to 7.15.2 Basic license Following these instructions to enable security and ultimately tls transport communications. directions say to enable security -enabled security -Elas…

---

## [How do I process sended data?](https://discuss.elastic.co/t/how-do-i-process-sended-data/288991)

<div class="topic-metadata">

**Author:** [@smam](https://discuss.elastic.co/u/smam)\
**Replies:** 6\
**Last updated:** [November 19, 2021, 4:04am UTC](https://discuss.elastic.co/t/how-do-i-process-sended-data/288991 "2021-11-19T04:04:28Z")

</div>

Hello, I managed to send my data to Elasticsearch via Logstash/Filebeat and the modules Plugin aknowledges that. ("Received data from this module") but how can I actually get from the Elasticsearch start page to the Ana…

---

## [Date\_histogram date formatter results in error in ElasticSearch Version 7.15 & above](https://discuss.elastic.co/t/date-histogram-date-formatter-results-in-error-in-elasticsearch-version-7-15-above/289626)

<div class="topic-metadata">

**Author:** [@inspirebharath](https://discuss.elastic.co/u/inspirebharath)\
**Replies:** 0\
**Last updated:** [November 18, 2021, 5:12pm UTC](https://discuss.elastic.co/t/date-histogram-date-formatter-results-in-error-in-elasticsearch-version-7-15-above/289626 "2021-11-18T17:12:48Z")

</div>

The below query used to work fine in the Elasticsearch Versions 6.8.x to 7.13.4. But the same breaks from 7.15.x version. Kindly suggest the fix for this. { "size": 0, "\_source": false, "query": { "…

---

## [How to enable https connection in the Bitnami ES](https://discuss.elastic.co/t/how-to-enable-https-connection-in-the-bitnami-es/289650)

<div class="topic-metadata">

**Author:** [@maulin](https://discuss.elastic.co/u/maulin)\
**Replies:** 1\
**Last updated:** [November 19, 2021, 4:00am UTC](https://discuss.elastic.co/t/how-to-enable-https-connection-in-the-bitnami-es/289650 "2021-11-19T04:00:54Z")

</div>

Need to Enable HTTPS connection in Bitnami Elasticsearch cluster

---

## [Java ssl "Too Short" error](https://discuss.elastic.co/t/java-ssl-too-short-error/289244)

<div class="topic-metadata">

**Author:** [@bchill](https://discuss.elastic.co/u/bchill)\
**Replies:** 3\
**Last updated:** [November 19, 2021, 1:54am UTC](https://discuss.elastic.co/t/java-ssl-too-short-error/289244 "2021-11-19T01:54:30Z")

</div>

I have an odd problem with a cert signed by our local CA. I get a java error about something being 'too short', but I have no clue what that is. The problem definitely seems to be related to the locally-signed cert, bec…

---

## [ELasticseacrh Cluster won't form bc of no username/pass but setting up user/pass needs a healthy cluster](https://discuss.elastic.co/t/elasticseacrh-cluster-wont-form-bc-of-no-username-pass-but-setting-up-user-pass-needs-a-healthy-cluster/289601)

<div class="topic-metadata">

**Author:** [@Maryam2021](https://discuss.elastic.co/u/Maryam2021)\
**Replies:** 1\
**Last updated:** [November 18, 2021, 11:17pm UTC](https://discuss.elastic.co/t/elasticseacrh-cluster-wont-form-bc-of-no-username-pass-but-setting-up-user-pass-needs-a-healthy-cluster/289601 "2021-11-18T23:17:49Z")

</div>

Hi All, I am new and probably missing something, stuck in an infinite loop! I am trying to build an ES cluster of 3 nodes. without any xpack it works fine and comes up. now I need to enable the security (btw I am on bas…

---

## [Composite Aggregation Impact on ES Performance](https://discuss.elastic.co/t/composite-aggregation-impact-on-es-performance/289638)

<div class="topic-metadata">

**Author:** [@RahulSingh1905](https://discuss.elastic.co/u/RahulSingh1905)\
**Replies:** 0\
**Last updated:** [November 18, 2021, 7:30pm UTC](https://discuss.elastic.co/t/composite-aggregation-impact-on-es-performance/289638 "2021-11-18T19:30:45Z")

</div>

The ES7.x doc for composite aggregation warns that : “The composite aggregation is expensive. Load test your application before deploying a composite aggregation in production.” Some context: My team and I are hoping to…

---

## [Elasticsearch 7.10 .zip installation, Windows service will not start](https://discuss.elastic.co/t/elasticsearch-7-10-zip-installation-windows-service-will-not-start/289629)

<div class="topic-metadata">

**Author:** [@newschapmj1](https://discuss.elastic.co/u/newschapmj1)\
**Replies:** 1\
**Last updated:** [November 18, 2021, 6:31pm UTC](https://discuss.elastic.co/t/elasticsearch-7-10-zip-installation-windows-service-will-not-start/289629 "2021-11-18T18:31:42Z")

</div>

Followed the install steps. Installed Elastic as a service. Started service. Service failed to start Nothing in the logs folders Using dedicated service account (not local system) System error log error 7034 ...se…

---

## [Elastic migrating from 6.8.8 to 7.10.2 in cluster mode : 1st node not starting until 2nd node starts in earlier version this was not the case](https://discuss.elastic.co/t/elastic-migrating-from-6-8-8-to-7-10-2-in-cluster-mode-1st-node-not-starting-until-2nd-node-starts-in-earlier-version-this-was-not-the-case/289610)

<div class="topic-metadata">

**Author:** [@cssingh](https://discuss.elastic.co/u/cssingh)\
**Replies:** 3\
**Last updated:** [November 18, 2021, 6:03pm UTC](https://discuss.elastic.co/t/elastic-migrating-from-6-8-8-to-7-10-2-in-cluster-mode-1st-node-not-starting-until-2nd-node-starts-in-earlier-version-this-was-not-the-case/289610 "2021-11-18T18:03:56Z")

</div>

I am making 3 node cluster. Below is my elastic.yml file cluster.name: SpectrumCluster node.name: node-1 cluster.initial\_master\_nodes: 10.2.107.14:9300,172.30.6.22:9300,172.30.5.255:9300 discovery.seed\_hosts: 10.2.10…

---

## [Add Default Date Format on Mapping](https://discuss.elastic.co/t/add-default-date-format-on-mapping/289341)

<div class="topic-metadata">

**Author:** [@Mehmet\_Gencol](https://discuss.elastic.co/u/Mehmet_Gencol)\
**Replies:** 12\
**Last updated:** [November 18, 2021, 5:45pm UTC](https://discuss.elastic.co/t/add-default-date-format-on-mapping/289341 "2021-11-18T17:45:19Z")

</div>

I have a mapping that dynamically detects date and stores. Fields are dynamically created, and I don't have any configuration about date formatting. so dates are detected and stored as their formats. They are generally s…

---

## [Unable to Parse Syslog messages into Elasticsearch](https://discuss.elastic.co/t/unable-to-parse-syslog-messages-into-elasticsearch/288755)

<div class="topic-metadata">

**Author:** [@Elie\_Sbat1](https://discuss.elastic.co/u/Elie_Sbat1)\
**Replies:** 9\
**Last updated:** [November 18, 2021, 5:34pm UTC](https://discuss.elastic.co/t/unable-to-parse-syslog-messages-into-elasticsearch/288755 "2021-11-18T17:34:48Z")

</div>

Hello, I am sending syslog messages from barracuda mail spammer directly into Elasticsearch database. The index got populated with data but the data are not parsed correctly. The log attributes are all shown in the mes…

---

## [Multi Terms aggregation does not exist in Java High Level REST Client！](https://discuss.elastic.co/t/multi-terms-aggregation-does-not-exist-in-java-high-level-rest-client/288609)

<div class="topic-metadata">

**Author:** [@Ethan.Winst](https://discuss.elastic.co/u/Ethan.Winst)\
**Replies:** 1\
**Last updated:** [November 18, 2021, 4:40pm UTC](https://discuss.elastic.co/t/multi-terms-aggregation-does-not-exist-in-java-high-level-rest-client/288609 "2021-11-18T16:40:07Z")

</div>

Multi Terms aggregation does not exist in Java High Level REST Client！ Does Multi Terms aggregation currently only provide this function for kibana?

---

## [Copy a value from one field to other if a field exists by using ingestnode pipeline](https://discuss.elastic.co/t/copy-a-value-from-one-field-to-other-if-a-field-exists-by-using-ingestnode-pipeline/289484)

<div class="topic-metadata">

**Author:** [@sidharth\_vijayakumar](https://discuss.elastic.co/u/sidharth_vijayakumar)\
**Replies:** 10\
**Last updated:** [November 18, 2021, 4:39pm UTC](https://discuss.elastic.co/t/copy-a-value-from-one-field-to-other-if-a-field-exists-by-using-ingestnode-pipeline/289484 "2021-11-18T16:39:28Z")

</div>

Hi Team, I want to create a new field called kubernetes.pod.name if fields called prometheus.labels.pod exists in the logs. I found out that from the set processor I could copy the value which is present in prometheus.l…

---

## [Combined nested query returning wrong result](https://discuss.elastic.co/t/combined-nested-query-returning-wrong-result/289612)

<div class="topic-metadata">

**Author:** [@identify](https://discuss.elastic.co/u/identify)\
**Replies:** 1\
**Last updated:** [November 18, 2021, 3:56pm UTC](https://discuss.elastic.co/t/combined-nested-query-returning-wrong-result/289612 "2021-11-18T15:56:51Z")

</div>

Hello, I am trying to do a query with two conditions within the "must" part of a "bool" query. Each condition is a nested query. The query is as follows: { "query":{ "bool":{ "filter":\[ { …

---

## [Tableau Connector with TLS on HTTP layer](https://discuss.elastic.co/t/tableau-connector-with-tls-on-http-layer/289335)

<div class="topic-metadata">

**Author:** [@6igwig](https://discuss.elastic.co/u/6igwig)\
**Replies:** 1\
**Last updated:** [November 18, 2021, 3:39pm UTC](https://discuss.elastic.co/t/tableau-connector-with-tls-on-http-layer/289335 "2021-11-18T15:39:02Z")

</div>

How do I configure the tableau connector Elasticsearch by Elastic to include the certificate for my production cluster? I have followed the instructions to Set up basic security for the Elastic Stack plus secured HTTPS …

---

## [Elasticsearch query](https://discuss.elastic.co/t/elasticsearch-query/288504)

<div class="topic-metadata">

**Author:** [@Elk\_huh](https://discuss.elastic.co/u/Elk_huh)\
**Replies:** 5\
**Last updated:** [November 18, 2021, 3:06pm UTC](https://discuss.elastic.co/t/elasticsearch-query/288504 "2021-11-18T15:06:23Z")

</div>

I cannot get this query to work. Note i cannot use the Filter field i GET /index-\*/\_search { "query": { "term": { "result": "Reputation" }, "range": { "@timestamp": { "gte":…

---

## [elasticsearch.exceptions.RequestError: RequestError(400, 'search\_phase\_execution\_exception', '\[match\] analyzer \[name\_phonetic\] not found')](https://discuss.elastic.co/t/elasticsearch-exceptions-requesterror-requesterror-400-search-phase-execution-exception-match-analyzer-name-phonetic-not-found/289572)

<div class="topic-metadata">

**Author:** [@pk5859](https://discuss.elastic.co/u/pk5859)\
**Replies:** 3\
**Last updated:** [November 18, 2021, 2:03pm UTC](https://discuss.elastic.co/t/elasticsearch-exceptions-requesterror-requesterror-400-search-phase-execution-exception-match-analyzer-name-phonetic-not-found/289572 "2021-11-18T14:03:40Z")

</div>

Mapping example- spouseNameQuery = { "match": { "Spouse\_Name": { # "query": input\_dict\['Spouse\_Name'\], "query": val, "analyzer": "name\_phonetic", …

---

## [How to match all tokens? (get rid of false positive result)](https://discuss.elastic.co/t/how-to-match-all-tokens-get-rid-of-false-positive-result/289602)

<div class="topic-metadata">

**Author:** [@vavra7](https://discuss.elastic.co/u/vavra7)\
**Replies:** 0\
**Last updated:** [November 18, 2021, 1:54pm UTC](https://discuss.elastic.co/t/how-to-match-all-tokens-get-rid-of-false-positive-result/289602 "2021-11-18T13:54:02Z")

</div>

Hi, I need to find out by the title whether searched game already exists in my ES. I use custom analyzer to meet my needs with features like transform roman numerals, lowercase, custom stopwords etc... So when I create…

[Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=537)

[Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=539)
