# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=546 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 547 --- ## [If the intended value itself contains the 'field split', can we use kv processor?](https://discuss.elastic.co/t/if-the-intended-value-itself-contains-the-field-split-can-we-use-kv-processor/288540)
**Author:** [@shi](https://discuss.elastic.co/u/shi)\ **Replies:** 6\ **Last updated:** [November 6, 2021, 7:51pm UTC](https://discuss.elastic.co/t/if-the-intended-value-itself-contains-the-field-split-can-we-use-kv-processor/288540 "2021-11-06T19:51:29Z")
The following sample log entry , is in the form of key=value pairs action="blocked" direction="outgoing" msg="from ip is in blocklist" proto=6 I have tried the following kv processor in ingest pipeline for the log e… --- ## [Serval indices were created with different timestamp upon using new winlogbeat template](https://discuss.elastic.co/t/serval-indices-were-created-with-different-timestamp-upon-using-new-winlogbeat-template/288539)
**Author:** [@Alaxwora](https://discuss.elastic.co/u/Alaxwora)\ **Replies:** 1\ **Last updated:** [November 6, 2021, 4:06pm UTC](https://discuss.elastic.co/t/serval-indices-were-created-with-different-timestamp-upon-using-new-winlogbeat-template/288539 "2021-11-06T16:06:50Z")
Hello, I noted serval indices were created upon using my new winlogbeat template, and I already set ILM to rollover after 30 days or upon index size reaches 10 Giga but it seems that I made a mistake. the following scr… --- ## [I can not send logs to elastic cloud](https://discuss.elastic.co/t/i-can-not-send-logs-to-elastic-cloud/288411)
**Author:** [@Hugo\_Pacini](https://discuss.elastic.co/u/Hugo_Pacini)\ **Replies:** 5\ **Last updated:** [November 6, 2021, 2:16pm UTC](https://discuss.elastic.co/t/i-can-not-send-logs-to-elastic-cloud/288411 "2021-11-06T14:16:55Z")
I'm trying to send logs from Serilogs to Elastic Cloud but doesn't work and I can not see errors. Can I send logs to test using Postman? The URL is https://my-custom-domain.es.eastus2.azure.elastic-cloud.com:9243 var u… --- ## [Ingestion performance dropping by 10x daily](https://discuss.elastic.co/t/ingestion-performance-dropping-by-10x-daily/288537)
**Author:** [@TanguyB](https://discuss.elastic.co/u/TanguyB)\ **Replies:** 3\ **Last updated:** [November 6, 2021, 11:19am UTC](https://discuss.elastic.co/t/ingestion-performance-dropping-by-10x-daily/288537 "2021-11-06T11:19:46Z")
Hello, :wave: We are using Fluentbit to ingest Kubernetes cluster logs into Elasticsearch. Not sure what I am setting wrong, but every day, as the index grows, ingestion is worsening from 550k op/s to 40k op/s... Inge… --- ## [Large shard size](https://discuss.elastic.co/t/large-shard-size/288458)
**Author:** [@caseydm](https://discuss.elastic.co/u/caseydm)\ **Replies:** 3\ **Last updated:** [November 6, 2021, 4:57am UTC](https://discuss.elastic.co/t/large-shard-size/288458 "2021-11-06T04:57:56Z")
I am setting up a new Elasticsearch cluster that will hold around 300 million records in a single index to start. The documents are academic paper data. Right now I have two nodes, so I set my shards as 2 primary and 1 r… --- ## [Java Msgs in Log](https://discuss.elastic.co/t/java-msgs-in-log/287967)
**Author:** [@SteveP](https://discuss.elastic.co/u/SteveP)\ **Replies:** 8\ **Last updated:** [November 6, 2021, 2:13am UTC](https://discuss.elastic.co/t/java-msgs-in-log/287967 "2021-11-06T02:13:16Z")
Hello all, I have installed Elasticsearch for the first time and I am seeing msgs that a terminally deprecated method in java.lang.system has been called. Should I be concerned with this, even though it looks like Elast… --- ## [Python Client - unable to remove "read\_only" block](https://discuss.elastic.co/t/python-client-unable-to-remove-read-only-block/288032)
**Author:** [@philhagen](https://discuss.elastic.co/u/philhagen)\ **Replies:** 9\ **Last updated:** [November 5, 2021, 8:29pm UTC](https://discuss.elastic.co/t/python-client-unable-to-remove-read-only-block/288032 "2021-11-05T20:29:18Z")
When using the official Python client, I can't seem to find a way to change an index to normal "read-write" status once it's been marked "read\_only". This function works fine to go from read-write to read\_only, but I wa… --- ## [Build a Query based off the result of another query](https://discuss.elastic.co/t/build-a-query-based-off-the-result-of-another-query/288174)
**Author:** [@Wonjun\_Cho](https://discuss.elastic.co/u/Wonjun_Cho)\ **Replies:** 2\ **Last updated:** [November 5, 2021, 7:48pm UTC](https://discuss.elastic.co/t/build-a-query-based-off-the-result-of-another-query/288174 "2021-11-05T19:48:51Z")
Hi guys, I would like to know if it is possible to make a query based off the result of another query. For example, there are indices for school and students. School { "settings": { ... }, "mappings": { "propertie… --- ## [How do I add a filter to an Index Threshold alerting rule and alert per server?](https://discuss.elastic.co/t/how-do-i-add-a-filter-to-an-index-threshold-alerting-rule-and-alert-per-server/288519)
**Author:** [@nsouth](https://discuss.elastic.co/u/nsouth)\ **Replies:** 0\ **Last updated:** [November 5, 2021, 6:51pm UTC](https://discuss.elastic.co/t/how-do-i-add-a-filter-to-an-index-threshold-alerting-rule-and-alert-per-server/288519 "2021-11-05T18:51:41Z")
I want to be alerted when our logs indicate that the average duration of commands is over 1 second. However, I cannot figure out how to do the following: Filter the query to only log events which have duration informa… --- ## [Painless script: can not write type \[class java.math.BigDecimal\]](https://discuss.elastic.co/t/painless-script-can-not-write-type-class-java-math-bigdecimal/288517)
**Author:** [@catelling](https://discuss.elastic.co/u/catelling)\ **Replies:** 0\ **Last updated:** [November 5, 2021, 6:30pm UTC](https://discuss.elastic.co/t/painless-script-can-not-write-type-class-java-math-bigdecimal/288517 "2021-11-05T18:30:43Z")
I am facing this exception on my discover page when trying to view my logs. Previously, I had a field involving BigDecimal and worked fine. this was the script: if(!(doc\[‘obyts.keyword’\].size()==0)) { String b\_str… --- ## [Continuous Transform query, does it update?](https://discuss.elastic.co/t/continuous-transform-query-does-it-update/288443)
**Author:** [@iambatman](https://discuss.elastic.co/u/iambatman)\ **Replies:** 4\ **Last updated:** [November 5, 2021, 5:26pm UTC](https://discuss.elastic.co/t/continuous-transform-query-does-it-update/288443 "2021-11-05T17:26:23Z")
If you use a query when creating a continuous transform will it only ever work on the query subset that is created when the transform is started? { "bool": { "should": \[ { "match": { "state… --- ## [Recurring Date - What is the best patterns?](https://discuss.elastic.co/t/recurring-date-what-is-the-best-patterns/288515)
**Author:** [@Remy\_Letient](https://discuss.elastic.co/u/Remy_Letient)\ **Replies:** 0\ **Last updated:** [November 5, 2021, 5:19pm UTC](https://discuss.elastic.co/t/recurring-date-what-is-the-best-patterns/288515 "2021-11-05T17:19:11Z")
Hi, I need to represent "recurring event" like "each month" with the goal to create a calendar view of them. The events can be unlimited in time. What is the best way to represent this kind of data to permit query like… --- ## [How to make a nested term query](https://discuss.elastic.co/t/how-to-make-a-nested-term-query/288506)
**Author:** [@Araf\_Shihab](https://discuss.elastic.co/u/Araf_Shihab)\ **Replies:** 0\ **Last updated:** [November 5, 2021, 2:58pm UTC](https://discuss.elastic.co/t/how-to-make-a-nested-term-query/288506 "2021-11-05T14:58:59Z")
Hey Elasticsearch community. I have a nested query as such { "size": 20, "\_source": \["tags"\], "sort": \[ { "@timestamp": { "order": "desc" } } \], "query": { "nested" : { "path" : "tags… --- ## [Elasticsearch Java Client (elasticsearch-java) ready for production use?](https://discuss.elastic.co/t/elasticsearch-java-client-elasticsearch-java-ready-for-production-use/284759)
**Author:** [@roytmana](https://discuss.elastic.co/u/roytmana)\ **Replies:** 5\ **Last updated:** [November 5, 2021, 2:16pm UTC](https://discuss.elastic.co/t/elasticsearch-java-client-elasticsearch-java-ready-for-production-use/284759 "2021-11-05T14:16:40Z")
Hello, We have been using low level rest client avoiding high level rest client because its dependencies on elastic server. I noticed that the high level client is being deprecated in favor of a new elasticsearch-java c… --- ## [Docker replication does not work - error - Master is not discoverable](https://discuss.elastic.co/t/docker-replication-does-not-work-error-master-is-not-discoverable/288455)
**Author:** [@jitendragupta2](https://discuss.elastic.co/u/jitendragupta2)\ **Replies:** 3\ **Last updated:** [November 5, 2021, 1:59pm UTC](https://discuss.elastic.co/t/docker-replication-does-not-work-error-master-is-not-discoverable/288455 "2021-11-05T13:59:27Z")
Docker replication does not work - error - Master is not discoverable Detailed Error - "master not discovered yet, this node has not previously joined a bootstrapped (v7+) cluster, and this node must discover master-eli… --- ## [Query unique documents after my query](https://discuss.elastic.co/t/query-unique-documents-after-my-query/288496)
**Author:** [@Araf\_Shihab](https://discuss.elastic.co/u/Araf_Shihab)\ **Replies:** 0\ **Last updated:** [November 5, 2021, 1:41pm UTC](https://discuss.elastic.co/t/query-unique-documents-after-my-query/288496 "2021-11-05T13:41:02Z")
Hey stack overflow I have an Elasticsearch document that looks like below. I'm only interested in the 'tags' key. "\_index": "graph\_20211025t0909", "\_type": "\_doc", "\_id": "E12201A5-CC50-… --- ## [Exporting data into HTML table](https://discuss.elastic.co/t/exporting-data-into-html-table/288485)
**Author:** [@AlessandroKP](https://discuss.elastic.co/u/AlessandroKP)\ **Replies:** 0\ **Last updated:** [November 5, 2021, 10:30am UTC](https://discuss.elastic.co/t/exporting-data-into-html-table/288485 "2021-11-05T10:30:02Z")
Hello, I am looking for a tool that lets you export data stored in Elasticsearch on a file in HTML format. I know that you can use Kibana to export the content of an index (or a subset) into CSV format. Do you know if… --- ## [Create Aggregate field with separated by comma](https://discuss.elastic.co/t/create-aggregate-field-with-separated-by-comma/288463)
**Author:** [@ari\_wahyu\_nahar](https://discuss.elastic.co/u/ari_wahyu_nahar)\ **Replies:** 3\ **Last updated:** [November 5, 2021, 7:40am UTC](https://discuss.elastic.co/t/create-aggregate-field-with-separated-by-comma/288463 "2021-11-05T07:40:25Z")
Need Help. i have data like this: what steps should i take, to get results like this: A: 3 B: 3 C: 2 D: 3 E: 4 Thank you! --- ## [Dense\_vector in oss ES 7.6](https://discuss.elastic.co/t/dense-vector-in-oss-es-7-6/288471)
**Author:** [@gchakkalakkal](https://discuss.elastic.co/u/gchakkalakkal)\ **Replies:** 2\ **Last updated:** [November 5, 2021, 7:38am UTC](https://discuss.elastic.co/t/dense-vector-in-oss-es-7-6/288471 "2021-11-05T07:38:39Z")
hi All, Is dense\_vector available in OSS version of ES 7.6. As i getting below error while trying to create index using dense\_vector field type. "reason" : "No handler for type \[dense\_vector\] declared on field \[my\_vec… --- ## [Manage system indices with Curator \[Elasticsearch 7.14.2\]](https://discuss.elastic.co/t/manage-system-indices-with-curator-elasticsearch-7-14-2/288410)
**Author:** [@RdrgPorto](https://discuss.elastic.co/u/RdrgPorto)\ **Replies:** 2\ **Last updated:** [November 5, 2021, 6:41am UTC](https://discuss.elastic.co/t/manage-system-indices-with-curator-elasticsearch-7-14-2/288410 "2021-11-05T06:41:07Z")
Elasticsearch version: 7.14.2 Curator version: 5.8.4 Hi, everyone I have seen a warning message in Curator in which Elasticsearch reports that in a future major version direct access to system indices will be prevente… --- ## [Is there a way to get the key of the current aggregation bucket in script？](https://discuss.elastic.co/t/is-there-a-way-to-get-the-key-of-the-current-aggregation-bucket-in-script/288466)
**Author:** [@jakey](https://discuss.elastic.co/u/jakey)\ **Replies:** 0\ **Last updated:** [November 5, 2021, 5:27am UTC](https://discuss.elastic.co/t/is-there-a-way-to-get-the-key-of-the-current-aggregation-bucket-in-script/288466 "2021-11-05T05:27:36Z")
For example: how to get the key (country) of the current bucket in the script after aggregating countries? Hope to give a solution, thank you！ "aggs"{ "country\_group":{ "terms":{ "field":"country", "size":1000 … --- ## [Error i\_o\_exception on s3 repository](https://discuss.elastic.co/t/error-i-o-exception-on-s3-repository/288128)
**Author:** [@alfianaf](https://discuss.elastic.co/u/alfianaf)\ **Replies:** 15\ **Last updated:** [November 5, 2021, 3:10am UTC](https://discuss.elastic.co/t/error-i-o-exception-on-s3-repository/288128 "2021-11-05T03:10:53Z")
Hello, I make a repository that connect to storage with s3 protocol, after I declare the proxy.host, proxy.port, protocol, endpoint on Elasticsearch.yml, I also declare the access\_key and secret key on Elasticsearch keys… --- ## [Update mapping fails for the elastic (superuser)](https://discuss.elastic.co/t/update-mapping-fails-for-the-elastic-superuser/288450)
**Author:** [@dimitris\_sb](https://discuss.elastic.co/u/dimitris_sb)\ **Replies:** 2\ **Last updated:** [November 5, 2021, 12:31am UTC](https://discuss.elastic.co/t/update-mapping-fails-for-the-elastic-superuser/288450 "2021-11-05T00:31:11Z")
Dear All, We tried to update mapping of an existing field Request: PUT index-name\* { "mappings": { "properties": { "index\_field": { "type": "text", "fields": { "keyword": { … --- ## [7.15 auto heap for none data node](https://discuss.elastic.co/t/7-15-auto-heap-for-none-data-node/288446)
**Author:** [@linkerc](https://discuss.elastic.co/u/linkerc)\ **Replies:** 1\ **Last updated:** [November 4, 2021, 11:11pm UTC](https://discuss.elastic.co/t/7-15-auto-heap-for-none-data-node/288446 "2021-11-04T23:11:23Z")
I have noticed that none data node still allocates half of system RAM. Wouldn't it make more sense to allocate more RAM for ES heap in such node? We don't really need to leave too much RAM for the system since there's … --- ## [Recommended node hardware/settings for warm data](https://discuss.elastic.co/t/recommended-node-hardware-settings-for-warm-data/288447)
**Author:** [@Maycon\_Santos](https://discuss.elastic.co/u/Maycon_Santos)\ **Replies:** 1\ **Last updated:** [November 4, 2021, 7:02pm UTC](https://discuss.elastic.co/t/recommended-node-hardware-settings-for-warm-data/288447 "2021-11-04T19:02:33Z")
Hello, I am looking at an allocation strategy to move around 2800 indices that are mostly idle with few reads per week to slower nodes and with this, clean a bit of space in our high-performance nodes. These indices acc… --- ## [How to query all unique IP addresses](https://discuss.elastic.co/t/how-to-query-all-unique-ip-addresses/288420)
**Author:** [@jeromeat](https://discuss.elastic.co/u/jeromeat)\ **Replies:** 6\ **Last updated:** [November 4, 2021, 8:18pm UTC](https://discuss.elastic.co/t/how-to-query-all-unique-ip-addresses/288420 "2021-11-04T20:18:01Z")
I'm looking for help on how to query all unique IP addresses, however, the field types that the IPs get parsed to are setup as "keyword" and not "IP". And they are setup as ip\_src, ip\_dst, dst\_ip, src\_ip. Yes, I unders… --- ## [Elastic won't start on Windows after inserting a single document](https://discuss.elastic.co/t/elastic-wont-start-on-windows-after-inserting-a-single-document/288206)
**Author:** [@lubosvr](https://discuss.elastic.co/u/lubosvr)\ **Replies:** 14\ **Last updated:** [November 4, 2021, 7:00pm UTC](https://discuss.elastic.co/t/elastic-wont-start-on-windows-after-inserting-a-single-document/288206 "2021-11-04T19:00:39Z")
Hi everybody, I've just downloaded ES 7.15.1 and latest Kibana. I was able to start ES for the first time. Then I've added a single document and dtopped the Kibana and ES. Now I'm not able to start ES. In the logs I se… --- ## [Regex query for conexus-al](https://discuss.elastic.co/t/regex-query-for-conexus-al/288437)
**Author:** [@chapmantrain](https://discuss.elastic.co/u/chapmantrain)\ **Replies:** 3\ **Last updated:** [November 4, 2021, 6:46pm UTC](https://discuss.elastic.co/t/regex-query-for-conexus-al/288437 "2021-11-04T18:46:24Z")
I am trying to search out the devices with conexus-al in the device name. I can find the conexus devices with ".conexus.", however adding ".conexus-al." finds nothing. I have tried ".conexus.al." and ".conexus\\-al.". I a… --- ## [Metric On Shard Reads and Writes](https://discuss.elastic.co/t/metric-on-shard-reads-and-writes/287690)
**Author:** [@Nisar\_Adappadathil1](https://discuss.elastic.co/u/Nisar_Adappadathil1)\ **Replies:** 4\ **Last updated:** [November 4, 2021, 3:53pm UTC](https://discuss.elastic.co/t/metric-on-shard-reads-and-writes/287690 "2021-11-04T15:53:14Z")
We have a huge cluster with 250 nodes. Multiple nodes go high load at various times, so want to know which shards are actually having higher READs and WRITEs so that I can see any hot shards are there. How can log coun… --- ## [Search as you type and highlighter](https://discuss.elastic.co/t/search-as-you-type-and-highlighter/287341)
**Author:** [@mihalikv](https://discuss.elastic.co/u/mihalikv)\ **Replies:** 1\ **Last updated:** [November 4, 2021, 2:49pm UTC](https://discuss.elastic.co/t/search-as-you-type-and-highlighter/287341 "2021-11-04T14:49:07Z")
Hello, Env: ES 7.15.0 PUT my-index-000001 { "mappings": { "properties": { "my\_field": { "type": "search\_as\_you\_type" } } } } PUT my-index-000001/\_doc/1?refresh { "my\_field": "quick b… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=545) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=547)