# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=547 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 548 --- ## [Frozen Tier CPU spikes - in relation to siem alerts](https://discuss.elastic.co/t/frozen-tier-cpu-spikes-in-relation-to-siem-alerts/288214)
**Author:** [@probson](https://discuss.elastic.co/u/probson)\ **Replies:** 8\ **Last updated:** [November 4, 2021, 2:29pm UTC](https://discuss.elastic.co/t/frozen-tier-cpu-spikes-in-relation-to-siem-alerts/288214 "2021-11-04T14:29:59Z")
I have a been reconfiguring my elastic cloud setup to try and improve performance. I created a frozen tier node, alot of indices have moved from warm to searchable snapshots. However looking at the CPU of the frozen node… --- ## [Node won’t start up due to duplicate alias/index names (HELP)](https://discuss.elastic.co/t/node-won-t-start-up-due-to-duplicate-alias-index-names-help/288123)
**Author:** [@Rabih\_harb](https://discuss.elastic.co/u/Rabih_harb)\ **Replies:** 3\ **Last updated:** [November 4, 2021, 2:08pm UTC](https://discuss.elastic.co/t/node-won-t-start-up-due-to-duplicate-alias-index-names-help/288123 "2021-11-04T14:08:27Z")
Dear community, we have a major issue in our production cluster (2.4.6): previous cluster setup: 4 nodes ( master and data) the upgrade done on the cluster was: 4 nodes---\> set as data only master false. 2 additio… --- ## [Filtering data before search](https://discuss.elastic.co/t/filtering-data-before-search/288409)
**Author:** [@Victor\_Dusautois](https://discuss.elastic.co/u/Victor_Dusautois)\ **Replies:** 1\ **Last updated:** [November 4, 2021, 1:45pm UTC](https://discuss.elastic.co/t/filtering-data-before-search/288409 "2021-11-04T13:45:53Z")
Hello, I am trying what I thought was going to be an easy fix with Elasticsearch. It appears I'm stumbling on achieving a sort on a simple name field containing civility: Here is some sample (fake) data: \[ { "name… --- ## [Esrally "Could not connect to your Elasticsearch metrics store."](https://discuss.elastic.co/t/esrally-could-not-connect-to-your-elasticsearch-metrics-store/288403)
**Author:** [@gabbar](https://discuss.elastic.co/u/gabbar)\ **Replies:** 3\ **Last updated:** [November 4, 2021, 12:48pm UTC](https://discuss.elastic.co/t/esrally-could-not-connect-to-your-elasticsearch-metrics-store/288403 "2021-11-04T12:48:39Z")
Hello Elasticworld, I'm striving to run a race on my test cluster, but it's apparently not able to connect to ES I'm running 2 ES 6.8.18 nodes running on RH 7.9 rally runs from RH 8.4 \[esrally@uttest01 ~\]$ esrally --… --- ## [EQL Sequence and elapsed time calculation](https://discuss.elastic.co/t/eql-sequence-and-elapsed-time-calculation/288101)
**Author:** [@Iriana\_Arguedas](https://discuss.elastic.co/u/Iriana_Arguedas)\ **Replies:** 1\ **Last updated:** [November 4, 2021, 10:39am UTC](https://discuss.elastic.co/t/eql-sequence-and-elapsed-time-calculation/288101 "2021-11-04T10:39:20Z")
With EQL is easy to identify when a process was executed/started and when it did finish. Is there a way to calculate the elapsed time of the execution inside the EQL query? Or is it better to use an external tool to pr… --- ## [Collapse performance with heavy operations](https://discuss.elastic.co/t/collapse-performance-with-heavy-operations/288085)
**Author:** [@DrParanoia](https://discuss.elastic.co/u/DrParanoia)\ **Replies:** 11\ **Last updated:** [November 4, 2021, 10:11am UTC](https://discuss.elastic.co/t/collapse-performance-with-heavy-operations/288085 "2021-11-04T10:11:30Z")
DISCLAIMER: I am relatively new to Elasticsearch, so I apologize in case my question is too "basic" or falls into "everybody should know this" category :smile: Hi! I have a performance question. Let's say, we have this … --- ## [Elasticsearch log "level": "WARN" "component": "r.suppressed" "message": "path: /\_prometheus/metrics, params: {}"](https://discuss.elastic.co/t/elasticsearch-log-level-warn-component-r-suppressed-message-path-prometheus-metrics-params/288394)
**Author:** [@Farzad\_Ebrahimi](https://discuss.elastic.co/u/Farzad_Ebrahimi)\ **Replies:** 0\ **Last updated:** [November 4, 2021, 9:04am UTC](https://discuss.elastic.co/t/elasticsearch-log-level-warn-component-r-suppressed-message-path-prometheus-metrics-params/288394 "2021-11-04T09:04:11Z")
Hi everyone, i have one node Elasticsearch:7.12.0 in docker with this configs: environment: - bootstrap.memory\_lock=true - "ES\_JAVA\_OPTS=-Xms31G -Xmx31G" - cluster.routing.allocation.disk.threshold\_enabled=… --- ## [Manually import data from indices folder](https://discuss.elastic.co/t/manually-import-data-from-indices-folder/288388)
**Author:** [@Tojo\_Rakotoarimanana](https://discuss.elastic.co/u/Tojo_Rakotoarimanana)\ **Replies:** 5\ **Last updated:** [November 4, 2021, 8:59am UTC](https://discuss.elastic.co/t/manually-import-data-from-indices-folder/288388 "2021-11-04T08:59:35Z")
Hello all, For unknown reason, our index was deleted automatically. we have a backup but just the folder in path.data, no snapshot. is there any tricky method to import index from this backup? thanks --- ## [How to filter with pipeline aggregations in all aggregated results](https://discuss.elastic.co/t/how-to-filter-with-pipeline-aggregations-in-all-aggregated-results/288340)
**Author:** [@elina](https://discuss.elastic.co/u/elina)\ **Replies:** 0\ **Last updated:** [November 3, 2021, 3:12pm UTC](https://discuss.elastic.co/t/how-to-filter-with-pipeline-aggregations-in-all-aggregated-results/288340 "2021-11-03T15:12:52Z")
Hi! I'm working on a project with elasticseach. I'am stuck with the below problem. I can't figure this out no matter what I have tried so far. Firstly, I would like to group by "keyword" in buckets using the terms aggre… --- ## [Elastic 2.4 Compatibility matrix](https://discuss.elastic.co/t/elastic-2-4-compatibility-matrix/288307)
**Author:** [@rschirin](https://discuss.elastic.co/u/rschirin)\ **Replies:** 4\ **Last updated:** [November 4, 2021, 8:20am UTC](https://discuss.elastic.co/t/elastic-2-4-compatibility-matrix/288307 "2021-11-04T08:20:40Z")
hey there, is there a link to a compatibility matrix related to Elasticsearch 2.4? I know its EOL, I would like to know any compatibility with Java, OS and so on.... thanks --- ## [Technicality on throughput-based cluster sizing](https://discuss.elastic.co/t/technicality-on-throughput-based-cluster-sizing/288346)
**Author:** [@AlessandroKP](https://discuss.elastic.co/u/AlessandroKP)\ **Replies:** 2\ **Last updated:** [November 4, 2021, 8:27am UTC](https://discuss.elastic.co/t/technicality-on-throughput-based-cluster-sizing/288346 "2021-11-04T08:27:26Z")
Hello, I have a question about sizing an Elasticsearch cluster based on throughput. I'm following this webinar: Elasticsearch sizing and capacity planning. If I understood correctly, the throughput-based sizing method… --- ## [ElasticSearch relational data](https://discuss.elastic.co/t/elasticsearch-relational-data/288387)
**Author:** [@muhammadahmad](https://discuss.elastic.co/u/muhammadahmad)\ **Replies:** 0\ **Last updated:** [November 4, 2021, 7:31am UTC](https://discuss.elastic.co/t/elasticsearch-relational-data/288387 "2021-11-04T07:31:11Z")
Hello , I need some help in managing following data, for example , I have five entities A, B, C, D ,E A has one to many relation with B, B has one to many relation with C, C has One to many relation with D, D has … --- ## [Warm indices is not compressed](https://discuss.elastic.co/t/warm-indices-is-not-compressed/288288)
**Author:** [@alfianaf](https://discuss.elastic.co/u/alfianaf)\ **Replies:** 18\ **Last updated:** [November 4, 2021, 4:59am UTC](https://discuss.elastic.co/t/warm-indices-is-not-compressed/288288 "2021-11-04T04:59:44Z")
I read on elastic documentation that warm phase could reduce index size, but it didn't state clearly how much index will be compressed on warm phase. It is stated that warm phase also have shrink and force merge featur… --- ## [Cluster restore with security on - with what users..?](https://discuss.elastic.co/t/cluster-restore-with-security-on-with-what-users/288292)
**Author:** [@raulk89](https://discuss.elastic.co/u/raulk89)\ **Replies:** 2\ **Last updated:** [November 4, 2021, 1:14am UTC](https://discuss.elastic.co/t/cluster-restore-with-security-on-with-what-users/288292 "2021-11-04T01:14:34Z")
Hi Elastic 7.15 My question is. When security is on, whenever I need to restore data to a new cluster, then how I am supposed to do that..? I mean, I install necessary packages, replace all the configuration files, th… --- ## [Clone index API vs. Scan and Scroll API](https://discuss.elastic.co/t/clone-index-api-vs-scan-and-scroll-api/288311)
**Author:** [@madshov](https://discuss.elastic.co/u/madshov)\ **Replies:** 1\ **Last updated:** [November 4, 2021, 12:13am UTC](https://discuss.elastic.co/t/clone-index-api-vs-scan-and-scroll-api/288311 "2021-11-04T00:13:12Z")
Hi, What's the better way to create a clone of my index for reindex purposes? Use the clone API or the scroll API and then bulk index? What are the pro and cons of each method? --- ## [Access from the Local Network](https://discuss.elastic.co/t/access-from-the-local-network/288351)
**Author:** [@SteveP](https://discuss.elastic.co/u/SteveP)\ **Replies:** 5\ **Last updated:** [November 4, 2021, 12:10am UTC](https://discuss.elastic.co/t/access-from-the-local-network/288351 "2021-11-04T00:10:29Z")
I have a one node Elasticsearch server that is sitting on 192.168.30.6. I would like a number of devices, on different local subnets to be able to hit this server on port 9200. I have my Elasticsearch.yml configured so t… --- ## [Old Elasticsearch Plugin location](https://discuss.elastic.co/t/old-elasticsearch-plugin-location/288368)
**Author:** [@Edgar1](https://discuss.elastic.co/u/Edgar1)\ **Replies:** 2\ **Last updated:** [November 4, 2021, 12:06am UTC](https://discuss.elastic.co/t/old-elasticsearch-plugin-location/288368 "2021-11-04T00:06:10Z")
I'm trying to find old plugins for the 2.x.x version of Elasticsearch. Specifically I'm looking for the repository-s3 plugin. I tried using the command sudo bin/elasticsearch-plugin install repository-s3 and sudo bin/plu… --- ## ["all shards failed"](https://discuss.elastic.co/t/all-shards-failed/288230)
**Author:** [@mmuzammil45](https://discuss.elastic.co/u/mmuzammil45)\ **Replies:** 3\ **Last updated:** [November 3, 2021, 11:44pm UTC](https://discuss.elastic.co/t/all-shards-failed/288230 "2021-11-03T23:44:14Z")
I am indexing nested JSON object. The issue is when the number of fields in the object approached to 1200, it started giving the error "all shards failed". I have tried multiple solutions but nothing has worked so far.… --- ## [What are the best practices for reading logs/data from cold or frozen data (more than 3, 6 or 12 months old)](https://discuss.elastic.co/t/what-are-the-best-practices-for-reading-logs-data-from-cold-or-frozen-data-more-than-3-6-or-12-months-old/288167)
**Author:** [@parasavelli](https://discuss.elastic.co/u/parasavelli)\ **Replies:** 2\ **Last updated:** [November 3, 2021, 8:16pm UTC](https://discuss.elastic.co/t/what-are-the-best-practices-for-reading-logs-data-from-cold-or-frozen-data-more-than-3-6-or-12-months-old/288167 "2021-11-03T20:16:29Z")
I would like to explore the best practices to search frozen data. Can you please help me to understand all the available options and best approaches. Thanks. --- ## [Best similarity for retrieving exact matches first](https://discuss.elastic.co/t/best-similarity-for-retrieving-exact-matches-first/288319)
**Author:** [@Giovanni\_Montobbio](https://discuss.elastic.co/u/Giovanni_Montobbio)\ **Replies:** 7\ **Last updated:** [November 3, 2021, 7:04pm UTC](https://discuss.elastic.co/t/best-similarity-for-retrieving-exact-matches-first/288319 "2021-11-03T19:04:14Z")
Hi I'm working on a project with elasticseach. I have an index with 1 million phrases inside and I want to retrieve phrases from the index which match with some query phrases. The phrases are in italian and I use an ital… --- ## [Nodejs ingest pdf](https://discuss.elastic.co/t/nodejs-ingest-pdf/288335)
**Author:** [@uros87](https://discuss.elastic.co/u/uros87)\ **Replies:** 3\ **Last updated:** [November 3, 2021, 3:58pm UTC](https://discuss.elastic.co/t/nodejs-ingest-pdf/288335 "2021-11-03T15:58:20Z")
Hello, I've tried to inject pdf file to elastic. PUT \_ingest/pipeline/pdfnew { "description": "Extract attachment information encoded in Base64 with UTF-8 charset", "processors": \[ { "attachment": { … --- ## [Enable Elastic Security prebuilt ML jobs \[2\]](https://discuss.elastic.co/t/enable-elastic-security-prebuilt-ml-jobs-2/288345)
**Author:** [@bil\_15](https://discuss.elastic.co/u/bil_15)\ **Replies:** 0\ **Last updated:** [November 3, 2021, 3:36pm UTC](https://discuss.elastic.co/t/enable-elastic-security-prebuilt-ml-jobs-2/288345 "2021-11-03T15:36:20Z")
Hello! Reference: \[Enable Elastic Security prebuilt rules and ML jobs\] So, I've uploaded ML Jobs bundled with datafeed through API using the request: PUT \_ml/anomaly\_detectors/custom\_rare\_process\_by\_host\_linux\_ecs { … --- ## [Logstash getting 429 error and data processing getting delayed](https://discuss.elastic.co/t/logstash-getting-429-error-and-data-processing-getting-delayed/288325)
**Author:** [@Sarat\_Khilar](https://discuss.elastic.co/u/Sarat_Khilar)\ **Replies:** 5\ **Last updated:** [November 3, 2021, 3:08pm UTC](https://discuss.elastic.co/t/logstash-getting-429-error-and-data-processing-getting-delayed/288325 "2021-11-03T15:08:52Z")
We are using Elasticsearch 6.8.2 version. We are manging Elasticsearch cluster through kubernetes. We have 3 master nodes and 25 data nodes. Kubernetes cluster is being setup in bare metal AWS EC2 instance. r4.4xlarge(16… --- ## [How does can\_match functionality work](https://discuss.elastic.co/t/how-does-can-match-functionality-work/288164)
**Author:** [@seanziee](https://discuss.elastic.co/u/seanziee)\ **Replies:** 7\ **Last updated:** [November 3, 2021, 2:21pm UTC](https://discuss.elastic.co/t/how-does-can-match-functionality-work/288164 "2021-11-03T14:21:36Z")
Just finished watching the video(@ruflin ):Deep dive into the new Elastic Indexing Strategy - YouTube and it's mentioned that because of the can\_match functionality, indices that don't have relevant documents won't be qu… --- ## [High Load ELK on docker](https://discuss.elastic.co/t/high-load-elk-on-docker/288262)
**Author:** [@Juan\_Fernandez\_Bernt](https://discuss.elastic.co/u/Juan_Fernandez_Bernt)\ **Replies:** 2\ **Last updated:** [November 3, 2021, 1:03pm UTC](https://discuss.elastic.co/t/high-load-elk-on-docker/288262 "2021-11-03T13:03:56Z")
I've been having issues with my ELK deployment. Its on docker and the CPU/Load usage is always high for some reason I still cannot find. Each ES node has 4GB memory assigned, total memory on the machine is 32GB. I'v… --- ## [Terms query slowing down at specific size](https://discuss.elastic.co/t/terms-query-slowing-down-at-specific-size/288005)
**Author:** [@PatrickB](https://discuss.elastic.co/u/PatrickB)\ **Replies:** 6\ **Last updated:** [November 3, 2021, 2:08pm UTC](https://discuss.elastic.co/t/terms-query-slowing-down-at-specific-size/288005 "2021-11-03T14:08:28Z")
Hi, we were noticing some odd query runtime behaviour, while investigating ways to improve our ES queries. We would like to ask you about some insights about that. Given the following mapping: { "settings": { ... … --- ## [Use of length function in split processor](https://discuss.elastic.co/t/use-of-length-function-in-split-processor/287972)
**Author:** [@varunbsgaur](https://discuss.elastic.co/u/varunbsgaur)\ **Replies:** 5\ **Last updated:** [November 3, 2021, 11:05am UTC](https://discuss.elastic.co/t/use-of-length-function-in-split-processor/287972 "2021-11-03T11:05:38Z")
How can we use "length" to only extract last two values of the string in the given script:- POST \_ingest/pipeline/\_simulate { "pipeline" : { "description": "description", "processors": \[ { "split": { "field": "f… --- ## [Documents \_version changes](https://discuss.elastic.co/t/documents-version-changes/287684)
**Author:** [@d.silwon](https://discuss.elastic.co/u/d.silwon)\ **Replies:** 13\ **Last updated:** [November 3, 2021, 9:45am UTC](https://discuss.elastic.co/t/documents-version-changes/287684 "2021-11-03T09:45:51Z")
Dears, Does the system problems like missing space on disks or exceeded heap space or network problems can have influence on change documents \_version? What is your experience with that? Why I'm asking about it? Becaus… --- ## [How to provide time +5.30(Time zone value in date format)](https://discuss.elastic.co/t/how-to-provide-time-5-30-time-zone-value-in-date-format/288304)
**Author:** [@gokulnath112](https://discuss.elastic.co/u/gokulnath112)\ **Replies:** 0\ **Last updated:** [November 3, 2021, 9:15am UTC](https://discuss.elastic.co/t/how-to-provide-time-5-30-time-zone-value-in-date-format/288304 "2021-11-03T09:15:58Z")
Hi everyone, I need to provide the date format for the below type of data."2021-10-28 21:16:41.504 +05:30". Kindly help me with that format. Thanks in advance. --- ## [ElasticSearch Error](https://discuss.elastic.co/t/elasticsearch-error/288186)
**Author:** [@Mudit\_Tripathi](https://discuss.elastic.co/u/Mudit_Tripathi)\ **Replies:** 4\ **Last updated:** [November 3, 2021, 8:23am UTC](https://discuss.elastic.co/t/elasticsearch-error/288186 "2021-11-03T08:23:41Z")
Hi All, I was able to start Elasticsearch on my local machine at port 9200 till 2 days back. Now when I am going to the path and executing ./Elasticsearch - It gives me an error: PP-C02Z66G1LVCG:bin mudit.tripathi$ ./E… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=546) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=548)