# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=540 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 541 --- ## [Why aren't "flattened" fields usable via SQL?](https://discuss.elastic.co/t/why-arent-flattened-fields-usable-via-sql/288520)
**Author:** [@Jamshid](https://discuss.elastic.co/u/Jamshid)\ **Replies:** 2\ **Last updated:** [November 17, 2021, 10:31am UTC](https://discuss.elastic.co/t/why-arent-flattened-fields-usable-via-sql/288520 "2021-11-17T10:31:06Z")
Are flattened type fields really not usable with SQL queries? They're not mentioned in: I have an index with these fields: ... "mappings" : { "properties" : { "name" : { "type" : "keyword"… --- ## [Can NEST index multiple documents to a data stream?](https://discuss.elastic.co/t/can-nest-index-multiple-documents-to-a-data-stream/288949)
**Author:** [@buaaytt](https://discuss.elastic.co/u/buaaytt)\ **Replies:** 2\ **Last updated:** [November 17, 2021, 10:20am UTC](https://discuss.elastic.co/t/can-nest-index-multiple-documents-to-a-data-stream/288949 "2021-11-17T10:20:46Z")
The IndexMany method has no way to specify the op\_type. And the Bulk method doesn't seem to provide any configuration for op\_type either. --- ## ["ignore\_missing": true from geoip processor is not working](https://discuss.elastic.co/t/ignore-missing-true-from-geoip-processor-is-not-working/289420)
**Author:** [@f4d0](https://discuss.elastic.co/u/f4d0)\ **Replies:** 0\ **Last updated:** [November 17, 2021, 9:24am UTC](https://discuss.elastic.co/t/ignore-missing-true-from-geoip-processor-is-not-working/289420 "2021-11-17T09:24:06Z")
Hi Everyone, I am using Elasticsearch 7.15, and python to ingest data into Elasticsearch. Before I start the ingestion, I define a pipeline and a mapping. Everything works very smoothly without the geoip processor. Wh… --- ## [Elasticsearch reached the limit of ongoing initial primary recoveries](https://discuss.elastic.co/t/elasticsearch-reached-the-limit-of-ongoing-initial-primary-recoveries/289390)
**Author:** [@alfianaf](https://discuss.elastic.co/u/alfianaf)\ **Replies:** 8\ **Last updated:** [November 17, 2021, 8:58am UTC](https://discuss.elastic.co/t/elasticsearch-reached-the-limit-of-ongoing-initial-primary-recoveries/289390 "2021-11-17T08:58:40Z")
Hello, I've been monitoring my cluster performance and I found my cluster health turned into red when I check with GET \_cluster/allocation/explain?pretty I got this result "node\_allocation\_decisions" : \[ { "n… --- ## [Elasticsearch shows "master not discovered yet, this node has not previously joined a bootstrapped (v7+) cluster"](https://discuss.elastic.co/t/elasticsearch-shows-master-not-discovered-yet-this-node-has-not-previously-joined-a-bootstrapped-v7-cluster/289406)
**Author:** [@Shaiju\_Sam](https://discuss.elastic.co/u/Shaiju_Sam)\ **Replies:** 0\ **Last updated:** [November 17, 2021, 8:02am UTC](https://discuss.elastic.co/t/elasticsearch-shows-master-not-discovered-yet-this-node-has-not-previously-joined-a-bootstrapped-v7-cluster/289406 "2021-11-17T08:02:39Z")
Hello Team, Im setting up a single node cluster and below is my Elasticsearch.yml file cluster.name: my-application node.name: node-1 node.master: true node.data: true bootstrap.memory\_lock: true network.host: CZASM… --- ## [Restore cold indices on new cluster](https://discuss.elastic.co/t/restore-cold-indices-on-new-cluster/289315)
**Author:** [@maj7](https://discuss.elastic.co/u/maj7)\ **Replies:** 2\ **Last updated:** [November 17, 2021, 7:00am UTC](https://discuss.elastic.co/t/restore-cold-indices-on-new-cluster/289315 "2021-11-17T07:00:56Z")
Hello everyone, I have a cluster which has a big amount of data and I wanted to move my data to a new cluster. The problem is my new cluster will not have a cold node. I took a snapshot of my old cluster and when I tr… --- ## [Wordnet Korean Dictionary for synonym](https://discuss.elastic.co/t/wordnet-korean-dictionary-for-synonym/289397)
**Author:** [@user\_el](https://discuss.elastic.co/u/user_el)\ **Replies:** 0\ **Last updated:** [November 17, 2021, 6:59am UTC](https://discuss.elastic.co/t/wordnet-korean-dictionary-for-synonym/289397 "2021-11-17T06:59:10Z")
Hi I want to use synonyms for the Korean language in wordnet format. I am not able to find any dictionary. If anyone knows where can I get one. Please help. --- ## [How to set a condition in set processor (ingest node pipeline) to check if log.level= error](https://discuss.elastic.co/t/how-to-set-a-condition-in-set-processor-ingest-node-pipeline-to-check-if-log-level-error/289347)
**Author:** [@sidharth\_vijayakumar](https://discuss.elastic.co/u/sidharth_vijayakumar)\ **Replies:** 2\ **Last updated:** [November 17, 2021, 4:28am UTC](https://discuss.elastic.co/t/how-to-set-a-condition-in-set-processor-ingest-node-pipeline-to-check-if-log-level-error/289347 "2021-11-17T04:28:20Z")
Hi, my doc looks like this and I need to access log.level which is a nested field. can someone help me as I need a condition to set a new field called statuscode if log.level=error. tried ctx.messageinfo.log.level=="e… --- ## [Install watcher plugin](https://discuss.elastic.co/t/install-watcher-plugin/289320)
**Author:** [@Rizky\_Hudha](https://discuss.elastic.co/u/Rizky_Hudha)\ **Replies:** 2\ **Last updated:** [November 17, 2021, 3:46am UTC](https://discuss.elastic.co/t/install-watcher-plugin/289320 "2021-11-17T03:46:38Z")
Hello, hello I tried to install the watcher plugin on my centos server, but the package was not found, is there another way to install it. And this report error No package license available. Error: Nothing to do No … --- ## [Monitoring does not work (Metricbeat)](https://discuss.elastic.co/t/monitoring-does-not-work-metricbeat/289380)
**Author:** [@VellayLoket](https://discuss.elastic.co/u/VellayLoket)\ **Replies:** 1\ **Last updated:** [November 17, 2021, 2:26am UTC](https://discuss.elastic.co/t/monitoring-does-not-work-metricbeat/289380 "2021-11-17T02:26:17Z")
I'm trying to setup metricbeat, the service on Elasticsearch node started successfully, sending data, no problem. Kibana shows that metrics index was created and there are some information saved but when i try to migrate… --- ## [Doesn't a field support multiple types?](https://discuss.elastic.co/t/doesnt-a-field-support-multiple-types/289271)
**Author:** [@wajika](https://discuss.elastic.co/u/wajika)\ **Replies:** 4\ **Last updated:** [November 17, 2021, 2:23am UTC](https://discuss.elastic.co/t/doesnt-a-field-support-multiple-types/289271 "2021-11-17T02:23:52Z")
org.elasticsearch.index.mapper.MapperParsingException: object mapping for \[http.request.body.original\] tried to parse field \[original\] as object, but found a concrete value I plan to convert the http.request.body.orig… --- ## [Node roles distribution](https://discuss.elastic.co/t/node-roles-distribution/289373)
**Author:** [@gutierrezfj](https://discuss.elastic.co/u/gutierrezfj)\ **Replies:** 1\ **Last updated:** [November 16, 2021, 11:47pm UTC](https://discuss.elastic.co/t/node-roles-distribution/289373 "2021-11-16T23:47:27Z")
Hi community, I have 4 hosts to dedicate to Elasticsearch, what is the best distribution of master and data nodes as well as primary shards and replicas? thanks --- ## [Unable to restore snapshots](https://discuss.elastic.co/t/unable-to-restore-snapshots/289242)
**Author:** [@Prabakar](https://discuss.elastic.co/u/Prabakar)\ **Replies:** 1\ **Last updated:** [November 16, 2021, 11:27pm UTC](https://discuss.elastic.co/t/unable-to-restore-snapshots/289242 "2021-11-16T23:27:58Z")
Unable to restore snapshots and got below error. I have closed the indexes whatever we created. But still system asks us to close system indexes as well. But if we try to close the system indexes then I am getting warnin… --- ## [Elasticsearch per request circuit breakers and real memory](https://discuss.elastic.co/t/elasticsearch-per-request-circuit-breakers-and-real-memory/289295)
**Author:** [@zvonimir](https://discuss.elastic.co/u/zvonimir)\ **Replies:** 2\ **Last updated:** [November 16, 2021, 10:59pm UTC](https://discuss.elastic.co/t/elasticsearch-per-request-circuit-breakers-and-real-memory/289295 "2021-11-16T22:59:41Z")
Hi. After upgrading to version 7.13.1 with new circuit breakers that use real memory we are having issues with heavy aggregates on Elasticsearch cluster. Per request circuit breakers are not being tripped and nodes (58GB… --- ## [Cannot Load MaxMind GeoIP2-ISP.mmdb](https://discuss.elastic.co/t/cannot-load-maxmind-geoip2-isp-mmdb/289027)
**Author:** [@reyjrar](https://discuss.elastic.co/u/reyjrar)\ **Replies:** 6\ **Last updated:** [November 16, 2021, 10:45pm UTC](https://discuss.elastic.co/t/cannot-load-maxmind-geoip2-isp-mmdb/289027 "2021-11-16T22:45:25Z")
Hello, We use multiple GeoIP databases. We're using GeoIP2-City to get location information, and GeoIP-ISP to get as.number and as.organization.name. However, I cannot load the provided MaxMind GeoIP2-ISP.mmdb. { "d… --- ## [How do I setup different retentions](https://discuss.elastic.co/t/how-do-i-setup-different-retentions/289359)
**Author:** [@jnpetty](https://discuss.elastic.co/u/jnpetty)\ **Replies:** 3\ **Last updated:** [November 16, 2021, 10:36pm UTC](https://discuss.elastic.co/t/how-do-i-setup-different-retentions/289359 "2021-11-16T22:36:24Z")
We are currently using Curator to delete specific indicies at 30, 60 and 90 days. We have added 2 warm and 2 cold nodes to our cluster and still want to be able to do the same retention with ILM. Right now we just have a… --- ## [Using Elasticsearch for storing logs in microservice-based architecture](https://discuss.elastic.co/t/using-elasticsearch-for-storing-logs-in-microservice-based-architecture/289288)
**Author:** [@Oleksii88](https://discuss.elastic.co/u/Oleksii88)\ **Replies:** 1\ **Last updated:** [November 16, 2021, 10:30pm UTC](https://discuss.elastic.co/t/using-elasticsearch-for-storing-logs-in-microservice-based-architecture/289288 "2021-11-16T22:30:48Z")
Hi, I am writing a new microservice-based system and considering Elasticsearch for logging data storage. What are the best practices of using ElastiSearch for logging? For now, I have 2 questions? but if anybody has id… --- ## [Elastic agent on the cluster side?](https://discuss.elastic.co/t/elastic-agent-on-the-cluster-side/289272)
**Author:** [@marti1](https://discuss.elastic.co/u/marti1)\ **Replies:** 1\ **Last updated:** [November 16, 2021, 10:29pm UTC](https://discuss.elastic.co/t/elastic-agent-on-the-cluster-side/289272 "2021-11-16T22:29:56Z")
Hi, I'm setting up a cluster with three nodes OnPremise. Until now, I used metricbeat and filebeat to get metrics and logs about the nodes. Should I use Elastic Agents on the nodes instead? What do you recomend? Thank… --- ## [ConnectionError: connect ECONNREFUSED](https://discuss.elastic.co/t/connectionerror-connect-econnrefused/289287)
**Author:** [@Maks\_7v](https://discuss.elastic.co/u/Maks_7v)\ **Replies:** 0\ **Last updated:** [November 16, 2021, 9:28am UTC](https://discuss.elastic.co/t/connectionerror-connect-econnrefused/289287 "2021-11-16T09:28:01Z")
I've configured Elasticsearch in k8s with a separate master, data, and ingest nodes. xpack.security.enabled is set to true I'm trying to connect a Node.js application to Elasticsearch using Elasticsearch-js client but … --- ## [Elastic gives error when I enable SSL](https://discuss.elastic.co/t/elastic-gives-error-when-i-enable-ssl/289349)
**Author:** [@Jorge\_Dionisio](https://discuss.elastic.co/u/Jorge_Dionisio)\ **Replies:** 0\ **Last updated:** [November 16, 2021, 4:25pm UTC](https://discuss.elastic.co/t/elastic-gives-error-when-i-enable-ssl/289349 "2021-11-16T16:25:35Z")
Hi everyone, I'm trying to enable SSL on the transport and ssl layer in Elasticsearch. My configuration is: cluster.name: elasticsearch node.name: jd-elk-01 path.data: "/var/lib/elasticsearch" path.logs: "/var/log/ela… --- ## [Does ES2 Support scroll and search\_after for Retrieving \>10K Data](https://discuss.elastic.co/t/does-es2-support-scroll-and-search-after-for-retrieving-10k-data/289104)
**Author:** [@theodoreandrew](https://discuss.elastic.co/u/theodoreandrew)\ **Replies:** 5\ **Last updated:** [November 16, 2021, 5:27pm UTC](https://discuss.elastic.co/t/does-es2-support-scroll-and-search-after-for-retrieving-10k-data/289104 "2021-11-16T17:27:17Z")
Hey guys, I have a question about ES version 2. Does ES2 support scroll and search\_after for retrieving \>10K data? If ES2 doesn't support scroll and search\_after, how can I retrieve \>10K data on ES2? Thanks … --- ## [Fielddata error indexing string fields](https://discuss.elastic.co/t/fielddata-error-indexing-string-fields/289105)
**Author:** [@iamtheschmitzer](https://discuss.elastic.co/u/iamtheschmitzer)\ **Replies:** 2\ **Last updated:** [November 16, 2021, 4:18pm UTC](https://discuss.elastic.co/t/fielddata-error-indexing-string-fields/289105 "2021-11-16T16:18:25Z")
In notes of Part 5 of crash course I see By default, every string gets mapped twice as a text field and as a keyword multi-field. Each field type is primed for different types of requests. However, when I try to aggr… --- ## [Corelation Id not working](https://discuss.elastic.co/t/corelation-id-not-working/289243)
**Author:** [@Prabakar](https://discuss.elastic.co/u/Prabakar)\ **Replies:** 2\ **Last updated:** [November 16, 2021, 4:08pm UTC](https://discuss.elastic.co/t/corelation-id-not-working/289243 "2021-11-16T16:08:21Z")
We are passing co-relation id from postman GET request using Http header. But co-relation id is not getting printed in the logs. We would like to use co-relation id to monitor the logs to debug the issues. Can you guide … --- ## [Unable to verify the first certificate - kibana/elasticsearch](https://discuss.elastic.co/t/unable-to-verify-the-first-certificate-kibana-elasticsearch/289294)
**Author:** [@slashlinux](https://discuss.elastic.co/u/slashlinux)\ **Replies:** 2\ **Last updated:** [November 16, 2021, 3:49pm UTC](https://discuss.elastic.co/t/unable-to-verify-the-first-certificate-kibana-elasticsearch/289294 "2021-11-16T15:49:30Z")
Hi teams, I'm trying to configure xpack for Elasticsearch/kibana, I've activated the trial license for Elasticsearch, configured xpack for kibana/Elasticsearch and also I've generated ca.crt, node1-elk.crt, node1-elk.ke… --- ## [Search\_after queries are not performing as expected](https://discuss.elastic.co/t/search-after-queries-are-not-performing-as-expected/289174)
**Author:** [@manuel.pancorbo](https://discuss.elastic.co/u/manuel.pancorbo)\ **Replies:** 6\ **Last updated:** [November 16, 2021, 3:08pm UTC](https://discuss.elastic.co/t/search-after-queries-are-not-performing-as-expected/289174 "2021-11-16T15:08:42Z")
Hi all! I'm working on building a searcher for a site. This site generates a lot of writes (new or modified documents) so we need to use some mechanism to ensure pagination consistency by using certain criteria (freshne… --- ## [Sort Parent by Count of Unique Values of a Child Field](https://discuss.elastic.co/t/sort-parent-by-count-of-unique-values-of-a-child-field/289333)
**Author:** [@amarjotbhullar](https://discuss.elastic.co/u/amarjotbhullar)\ **Replies:** 0\ **Last updated:** [November 16, 2021, 1:49pm UTC](https://discuss.elastic.co/t/sort-parent-by-count-of-unique-values-of-a-child-field/289333 "2021-11-16T13:49:09Z")
Hi, I am currently working on a feature where I have a parent child relationship between driver and trips taken by driver. I need to sort drivers by unique count of no. of cars driven irrespective of number of trips tak… --- ## [Big-ish line missing n Elasticsearch 7.9.0](https://discuss.elastic.co/t/big-ish-line-missing-n-elasticsearch-7-9-0/289145)
**Author:** [@Rayyan](https://discuss.elastic.co/u/Rayyan)\ **Replies:** 1\ **Last updated:** [November 16, 2021, 12:48pm UTC](https://discuss.elastic.co/t/big-ish-line-missing-n-elasticsearch-7-9-0/289145 "2021-11-16T12:48:54Z")
We are using a standalone Elasticsearch on EC2 and the stack looks like Application (JSON) --\> Fluent Bit --\> Elasticsearch (7.9.0) on EC2 --\> Kibana on EC2 We have a scenario wherein if the application generated JSON l… --- ## [ML - Updated analytics task state to \[failed\] with reason \[Limit of total fields \[1000\] has been exceeded\]](https://discuss.elastic.co/t/ml-updated-analytics-task-state-to-failed-with-reason-limit-of-total-fields-1000-has-been-exceeded/288886)
**Author:** [@ciment](https://discuss.elastic.co/u/ciment)\ **Replies:** 2\ **Last updated:** [November 16, 2021, 11:24am UTC](https://discuss.elastic.co/t/ml-updated-analytics-task-state-to-failed-with-reason-limit-of-total-fields-1000-has-been-exceeded/288886 "2021-11-16T11:24:48Z")
Hi, I want to setup ML job with outlier detection for http statuses 4xx and 5xx. I use ELK stack version 7.15.1. This is the json of ML job. { "id": "ml-http-4xx", "create\_time": 1636545614078, "version": "7.15.… --- ## [Z names with an elastic index](https://discuss.elastic.co/t/z-names-with-an-elastic-index/289066)
**Author:** [@tractor\_boy](https://discuss.elastic.co/u/tractor_boy)\ **Replies:** 4\ **Last updated:** [November 16, 2021, 10:56am UTC](https://discuss.elastic.co/t/z-names-with-an-elastic-index/289066 "2021-11-16T10:56:55Z")
I support an environment similar to AWS where the server names are of limited(/no) value in their raw form, so we have aliased them such that they are meaningful. If the server were rebuilt the zname would change, but t… --- ## [Bucket selection (Elasticsearch 6.8)](https://discuss.elastic.co/t/bucket-selection-elasticsearch-6-8/287697)
**Author:** [@dev\_test](https://discuss.elastic.co/u/dev_test)\ **Replies:** 2\ **Last updated:** [November 16, 2021, 10:29am UTC](https://discuss.elastic.co/t/bucket-selection-elasticsearch-6-8/287697 "2021-11-16T10:29:39Z")
Hi, I'm running this query GET assignment/\_search?size=0 { "query": { "bool": { "must": \[ { "term": { "user\_post": "post" } }, { "nested": { … [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=539) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=541)