# Elasticsearch

**URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=549

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 550

---

## [Getting this exception : Caused by: org.elasticsearch.repositories.RepositoryException: \[index\_id\] Could not determine repository generation from root blobs when trying a non-root user in dockerfile for Elasticsearch image I am using Elasticsearch 7.10.0](https://discuss.elastic.co/t/getting-this-exception-caused-by-org-elasticsearch-repositories-repositoryexception-index-id-could-not-determine-repository-generation-from-root-blobs-when-trying-a-non-root-user-in-dockerfile-for-elasticsearch-image-i-am-using-elasticsearch-7-10-0/288042)

<div class="topic-metadata">

**Author:** [@Sagarika\_Mahalik](https://discuss.elastic.co/u/Sagarika_Mahalik)\
**Replies:** 0\
**Last updated:** [October 29, 2021, 10:30pm UTC](https://discuss.elastic.co/t/getting-this-exception-caused-by-org-elasticsearch-repositories-repositoryexception-index-id-could-not-determine-repository-generation-from-root-blobs-when-trying-a-non-root-user-in-dockerfile-for-elasticsearch-image-i-am-using-elasticsearch-7-10-0/288042 "2021-10-29T22:30:08Z")

</div>

Getting this exception : Caused by: org.Elasticsearch.repositories.RepositoryException: \[index\_id\] Could not determine repository generation from root blobs when trying a non-root user in dockerfile for Elasticsearch ima…

---

## [Troubles with active directory user authentication](https://discuss.elastic.co/t/troubles-with-active-directory-user-authentication/287755)

<div class="topic-metadata">

**Author:** [@auto\_reply\_007](https://discuss.elastic.co/u/auto_reply_007)\
**Replies:** 10\
**Last updated:** [November 1, 2021, 4:21am UTC](https://discuss.elastic.co/t/troubles-with-active-directory-user-authentication/287755 "2021-11-01T04:21:20Z")

</div>

I have trial license Elasticsearch node, and i want to integrate it to use Active directory authentication Here's snippet from my Elasticsearch.yml file xpack: security: enabled: true transport: ssl: …

---

## [Upgrade the cluster from 7.7 to 7.15 version guidance](https://discuss.elastic.co/t/upgrade-the-cluster-from-7-7-to-7-15-version-guidance/287950)

<div class="topic-metadata">

**Author:** [@tahseen\_fatima](https://discuss.elastic.co/u/tahseen_fatima)\
**Replies:** 3\
**Last updated:** [November 1, 2021, 4:19am UTC](https://discuss.elastic.co/t/upgrade-the-cluster-from-7-7-to-7-15-version-guidance/287950 "2021-11-01T04:19:09Z")

</div>

Hi Experts, I have an ELK setup of 7.7 version with 3 nodes of Elasticsearch, 2 kibana and 2 logstash on a windows server 64 bit. A. Below is the existing cluster information:- Configuration of Elasticsearch servers: …

---

## [Need help sending emails separately with only one watcher running (using forearch)](https://discuss.elastic.co/t/need-help-sending-emails-separately-with-only-one-watcher-running-using-forearch/288026)

<div class="topic-metadata">

**Author:** [@RaonyO](https://discuss.elastic.co/u/RaonyO)\
**Replies:** 0\
**Last updated:** [October 29, 2021, 5:13pm UTC](https://discuss.elastic.co/t/need-help-sending-emails-separately-with-only-one-watcher-running-using-forearch/288026 "2021-10-29T17:13:35Z")

</div>

Hello guys need help in the structure of my watcher, I'm trying to create an alert where a notification is sent by email, but the notifications are going in message form (in the same initial email) and when it reaches 10…

---

## [ILM rollover not working on max\_size?](https://discuss.elastic.co/t/ilm-rollover-not-working-on-max-size/287999)

<div class="topic-metadata">

**Author:** [@TimWardFS](https://discuss.elastic.co/u/TimWardFS)\
**Replies:** 3\
**Last updated:** [October 31, 2021, 3:14pm UTC](https://discuss.elastic.co/t/ilm-rollover-not-working-on-max-size/287999 "2021-10-31T15:14:31Z")

</div>

I have an ILM policy with both max\_age and max\_size specified. Rollover happens as expected about ten minutes after max\_age, but does not seem to happen on max\_size. With max\_size set to 10MB I've seen shard sizes up to …

---

## [Bulk IndexRequest Fails](https://discuss.elastic.co/t/bulk-indexrequest-fails/288074)

<div class="topic-metadata">

**Author:** [@madhurir](https://discuss.elastic.co/u/madhurir)\
**Replies:** 3\
**Last updated:** [October 31, 2021, 7:29am UTC](https://discuss.elastic.co/t/bulk-indexrequest-fails/288074 "2021-10-31T07:29:40Z")

</div>

I am using version 7.15 and trying to create bulk index request in my dev environment. Though the single indexing works, bulk indexing doesn't. I don't see any exception but I see the following in my IntelliJ logs \[ …

---

## [Disable dynamic mapping over all nodes](https://discuss.elastic.co/t/disable-dynamic-mapping-over-all-nodes/288062)

<div class="topic-metadata">

**Author:** [@lstoneir](https://discuss.elastic.co/u/lstoneir)\
**Replies:** 1\
**Last updated:** [October 30, 2021, 8:54pm UTC](https://discuss.elastic.co/t/disable-dynamic-mapping-over-all-nodes/288062 "2021-10-30T20:54:49Z")

</div>

I want to disable dynamic mappings for all indices over all nodes of cluster. how can i do this?

---

## [How to match spans near the beginning of a field](https://discuss.elastic.co/t/how-to-match-spans-near-the-beginning-of-a-field/288055)

<div class="topic-metadata">

**Author:** [@Kev86](https://discuss.elastic.co/u/Kev86)\
**Replies:** 0\
**Last updated:** [October 30, 2021, 6:55am UTC](https://discuss.elastic.co/t/how-to-match-spans-near-the-beginning-of-a-field/288055 "2021-10-30T06:55:47Z")

</div>

I have this query and want a span first in SearchField. So that ES shows the string that match closest to the beginning of the field first: { "query": { "bool": { "should": \[ { …

---

## [How to Improve Snapshot to S3 rate?](https://discuss.elastic.co/t/how-to-improve-snapshot-to-s3-rate/288048)

<div class="topic-metadata">

**Author:** [@iShiBin](https://discuss.elastic.co/u/iShiBin)\
**Replies:** 0\
**Last updated:** [October 30, 2021, 3:24am UTC](https://discuss.elastic.co/t/how-to-improve-snapshot-to-s3-rate/288048 "2021-10-30T03:24:11Z")

</div>

The archive rate is only around 60mb/s on a large cluster (72 warm nodes). How to improve the rate to around 100mb/s? What I have tried: Enable the S3-accelerate mode. However, ES doesn't support it per Enabling Tran…

---

## [Snapshot to S3 partially failed with error Unable to execute HTTP request: \<bucket\_name\>.s3.us-west-2.amazonaws.com](https://discuss.elastic.co/t/snapshot-to-s3-partially-failed-with-error-unable-to-execute-http-request-bucket-name-s3-us-west-2-amazonaws-com/287657)

<div class="topic-metadata">

**Author:** [@iShiBin](https://discuss.elastic.co/u/iShiBin)\
**Replies:** 7\
**Last updated:** [October 30, 2021, 3:14am UTC](https://discuss.elastic.co/t/snapshot-to-s3-partially-failed-with-error-unable-to-execute-http-request-bucket-name-s3-us-west-2-amazonaws-com/287657 "2021-10-30T03:14:32Z")

</div>

20 out of 90 shards failed to complete the snapshot with the following archive output. { "snapshot": { "snapshot": "exabeam-2021.08.10", "uuid": "fRjaWFFfQDK7bHbJRR0yHw", "version\_id": 608019…

---

## [Increase "ignore\_above" value for message.keyword](https://discuss.elastic.co/t/increase-ignore-above-value-for-message-keyword/287962)

<div class="topic-metadata">

**Author:** [@enryoku](https://discuss.elastic.co/u/enryoku)\
**Replies:** 1\
**Last updated:** [October 29, 2021, 10:04pm UTC](https://discuss.elastic.co/t/increase-ignore-above-value-for-message-keyword/287962 "2021-10-29T22:04:21Z")

</div>

Hello, I am trying to increase the default value for "ignore\_above" from 256 to 1024 for the message.keyword field by adding a component index template in Elasticsearch and apply it to the base index pattern. My index …

---

## [New Kibana reposting job goes in Pending state instead of Processing](https://discuss.elastic.co/t/new-kibana-reposting-job-goes-in-pending-state-instead-of-processing/288036)

<div class="topic-metadata">

**Author:** [@asim\_np](https://discuss.elastic.co/u/asim_np)\
**Replies:** 0\
**Last updated:** [October 29, 2021, 9:14pm UTC](https://discuss.elastic.co/t/new-kibana-reposting-job-goes-in-pending-state-instead-of-processing/288036 "2021-10-29T21:14:32Z")

</div>

Using ELK Stack 7.12.1, After deleting pending jobs from Kibana reposting using the below querry, POST /.reporting\*/\_delete\_by\_query { "query": { "bool": { "must\_not": { "exists":…

---

## [How can I use query\_string to match both nested and non-nested fields at the same time?](https://discuss.elastic.co/t/how-can-i-use-query-string-to-match-both-nested-and-non-nested-fields-at-the-same-time/288023)

<div class="topic-metadata">

**Author:** [@Max\_Carey](https://discuss.elastic.co/u/Max_Carey)\
**Replies:** 0\
**Last updated:** [October 29, 2021, 4:43pm UTC](https://discuss.elastic.co/t/how-can-i-use-query-string-to-match-both-nested-and-non-nested-fields-at-the-same-time/288023 "2021-10-29T16:43:43Z")

</div>

I have an index with a mapping something like this: "email" : { "type" : "nested", "properties" : { "from" : { "type" : "text", "analyzer" : "lowercase\_keyword", "fielddata" : true }, "…

---

## [Version of elastic db and elastic API are different](https://discuss.elastic.co/t/version-of-elastic-db-and-elastic-api-are-different/288020)

<div class="topic-metadata">

**Author:** [@kathirnk2](https://discuss.elastic.co/u/kathirnk2)\
**Replies:** 1\
**Last updated:** [October 29, 2021, 4:38pm UTC](https://discuss.elastic.co/t/version-of-elastic-db-and-elastic-api-are-different/288020 "2021-10-29T16:38:56Z")

</div>

We are using elastic db version 6.3.1. In our spring boot application also, we have put the elastic api version as 6.3.1 in our build.gradle file. We recently upgraded our spring boot version from 2.1 to 2.4 We remove…

---

## [Adding a synthetic field to documents generated by Transforms](https://discuss.elastic.co/t/adding-a-synthetic-field-to-documents-generated-by-transforms/288014)

<div class="topic-metadata">

**Author:** [@romainneutron](https://discuss.elastic.co/u/romainneutron)\
**Replies:** 0\
**Last updated:** [October 29, 2021, 3:29pm UTC](https://discuss.elastic.co/t/adding-a-synthetic-field-to-documents-generated-by-transforms/288014 "2021-10-29T15:29:36Z")

</div>

Hello, I'm playing with Elastic Transforms (Create transform API | Elasticsearch Guide \[7.15\] | Elastic) I have questions about those: I've created a transform like this: PUT \_transform/transform\_test\_2s { "source"…

---

## [Bug when aggregating histogram fields](https://discuss.elastic.co/t/bug-when-aggregating-histogram-fields/288013)

<div class="topic-metadata">

**Author:** [@romainneutron](https://discuss.elastic.co/u/romainneutron)\
**Replies:** 0\
**Last updated:** [October 29, 2021, 3:24pm UTC](https://discuss.elastic.co/t/bug-when-aggregating-histogram-fields/288013 "2021-10-29T15:24:43Z")

</div>

Hello, I encounter an issue with some particular values using histogram aggregations: Here's a reproducer: PUT test-index { "mappings" : { "properties" : { "my\_histogram" : { "type" : "histogram" …

---

## [Elastic Search Aggregations Slow](https://discuss.elastic.co/t/elastic-search-aggregations-slow/286701)

<div class="topic-metadata">

**Author:** [@Srini12](https://discuss.elastic.co/u/Srini12)\
**Replies:** 20\
**Last updated:** [October 29, 2021, 1:55pm UTC](https://discuss.elastic.co/t/elastic-search-aggregations-slow/286701 "2021-10-29T13:55:16Z")

</div>

Good day I have an Elasticsearch index with 50 million records in it. This is working as expected. If I add aggregations to my query it is taking quite a long time to get the results. Any advise ? Thanks in advance. K…

---

## [Transform API update documents already inserted](https://discuss.elastic.co/t/transform-api-update-documents-already-inserted/288006)

<div class="topic-metadata">

**Author:** [@marone](https://discuss.elastic.co/u/marone)\
**Replies:** 0\
**Last updated:** [October 29, 2021, 1:40pm UTC](https://discuss.elastic.co/t/transform-api-update-documents-already-inserted/288006 "2021-10-29T13:40:56Z")

</div>

Hey I am facing a big issue as we are going to production using Transform API. What we are facing is the aggregation calculated with a transform API are updated once a term aggregation already exist in the destination in…

---

## [How to boost results on the basis of fields values](https://discuss.elastic.co/t/how-to-boost-results-on-the-basis-of-fields-values/287826)

<div class="topic-metadata">

**Author:** [@Ashutosh\_Dwivedi](https://discuss.elastic.co/u/Ashutosh_Dwivedi)\
**Replies:** 7\
**Last updated:** [October 29, 2021, 1:10pm UTC](https://discuss.elastic.co/t/how-to-boost-results-on-the-basis-of-fields-values/287826 "2021-10-29T13:10:12Z")

</div>

Hi Everyone, I have stuck into creating query for a specific problem. Can anyone please help me ? I have these list of products \[ { "name":"pro", "clickCount":110, "bookingCount":57, "isPromoted":0 }, { "na…

---

## [Distance\_feature and optimal pagination?](https://discuss.elastic.co/t/distance-feature-and-optimal-pagination/287949)

<div class="topic-metadata">

**Author:** [@tamis-laan](https://discuss.elastic.co/u/tamis-laan)\
**Replies:** 0\
**Last updated:** [October 28, 2021, 5:44pm UTC](https://discuss.elastic.co/t/distance-feature-and-optimal-pagination/287949 "2021-10-28T17:44:52Z")

</div>

I want to implement pagination over a search query that uses the distance\_feature using location and time and implement pagination. Now because each request is unique in terms of it's location and time the sorting will …

---

## [Store time lapsed between two events](https://discuss.elastic.co/t/store-time-lapsed-between-two-events/287991)

<div class="topic-metadata">

**Author:** [@Frederick\_Faria](https://discuss.elastic.co/u/Frederick_Faria)\
**Replies:** 1\
**Last updated:** [October 29, 2021, 12:15pm UTC](https://discuss.elastic.co/t/store-time-lapsed-between-two-events/287991 "2021-10-29T12:15:24Z")

</div>

I need to store a time duration two events and have as in HH:mm:ss.SSS. I tried using Date type with basic\_time format but it do now allows me to save more than 23 hours. How would you recommend to proceed in this case? …

---

## [Multi\_match to return exact results for single word criteria](https://discuss.elastic.co/t/multi-match-to-return-exact-results-for-single-word-criteria/287995)

<div class="topic-metadata">

**Author:** [@itokai](https://discuss.elastic.co/u/itokai)\
**Replies:** 0\
**Last updated:** [October 29, 2021, 11:59am UTC](https://discuss.elastic.co/t/multi-match-to-return-exact-results-for-single-word-criteria/287995 "2021-10-29T11:59:36Z")

</div>

Hello, have simple use-case: find certain word in any field of a document (through whole index). However, getting back (many!) false positive documents, also? Documents don't contain the word submitted in multi\_match cr…

---

## [Bulk Upsert isn't Importing All Records](https://discuss.elastic.co/t/bulk-upsert-isnt-importing-all-records/287011)

<div class="topic-metadata">

**Author:** [@selectedpixel](https://discuss.elastic.co/u/selectedpixel)\
**Replies:** 3\
**Last updated:** [October 29, 2021, 11:44am UTC](https://discuss.elastic.co/t/bulk-upsert-isnt-importing-all-records/287011 "2021-10-29T11:44:17Z")

</div>

I'm doing a bulk upsert using the Elasticsearch NodeJS library Helper classes. const response = await ELSClient.helpers.bulk({ concurrency: 20, datasource: data, onDocument (doc) { return \[{ up…

---

## [Failed to initialize SSL TrustManager](https://discuss.elastic.co/t/failed-to-initialize-ssl-trustmanager/287667)

<div class="topic-metadata">

**Author:** [@porscheme](https://discuss.elastic.co/u/porscheme)\
**Replies:** 2\
**Last updated:** [October 29, 2021, 9:52am UTC](https://discuss.elastic.co/t/failed-to-initialize-ssl-trustmanager/287667 "2021-10-29T09:52:48Z")

</div>

ES Version 7.12 AKS: 1:20.7 Certificate passwords added elastic keystore and value verified xpack.security.transport.ssl.keystore.secure\_password xpack.security.transport.ssl.truststore.secure\_password xpack settings …

---

## [CircuitBreakingException (Heap size issue)](https://discuss.elastic.co/t/circuitbreakingexception-heap-size-issue/287985)

<div class="topic-metadata">

**Author:** [@Balaji\_Arun](https://discuss.elastic.co/u/Balaji_Arun)\
**Replies:** 0\
**Last updated:** [October 29, 2021, 9:43am UTC](https://discuss.elastic.co/t/circuitbreakingexception-heap-size-issue/287985 "2021-10-29T09:43:10Z")

</div>

Hi everyone, I'm facing a issue with heap size don't know how to increase it tried changing the env var in the kube config (using Kubernetes for deployment ) but it struck at applying changes phase thanks in advance …

---

## [How to scale up the cache file size when we scale up the disk size?](https://discuss.elastic.co/t/how-to-scale-up-the-cache-file-size-when-we-scale-up-the-disk-size/287747)

<div class="topic-metadata">

**Author:** [@gaobinlong](https://discuss.elastic.co/u/gaobinlong)\
**Replies:** 5\
**Last updated:** [October 29, 2021, 8:40am UTC](https://discuss.elastic.co/t/how-to-scale-up-the-cache-file-size-when-we-scale-up-the-disk-size/287747 "2021-10-29T08:40:09Z")

</div>

Our es clusters are deployed in cloud, and the cloud disk is very easy to scale up it's size. We found that the size of the local cache file shared\_snapshot\_cache on the dedicated frozen node didn't change when we scale…

---

## [Elasticsearch CPU utilization problem with Logstash](https://discuss.elastic.co/t/elasticsearch-cpu-utilization-problem-with-logstash/287903)

<div class="topic-metadata">

**Author:** [@Hur](https://discuss.elastic.co/u/Hur)\
**Replies:** 2\
**Last updated:** [October 29, 2021, 2:34am UTC](https://discuss.elastic.co/t/elasticsearch-cpu-utilization-problem-with-logstash/287903 "2021-10-29T02:34:19Z")

</div>

I have trouble with using Elasticsearch with Logstash. When inserting data to ES through Logstash (not using Filebeat. Elasticsearch & Logstash only), CPU utilization of ES is over 90%. Also, I expected if I use multip…

---

## [Geo Coordinate Mapping](https://discuss.elastic.co/t/geo-coordinate-mapping/287956)

<div class="topic-metadata">

**Author:** [@workenehg](https://discuss.elastic.co/u/workenehg)\
**Replies:** 1\
**Last updated:** [October 29, 2021, 1:02am UTC](https://discuss.elastic.co/t/geo-coordinate-mapping/287956 "2021-10-29T01:02:41Z")

</div>

Currently in the process of indexing data from Oracle and one of the properties is a "Coordinate" . we would like to be able to do a geo search on the field but since it is currently added as "long" as shown below , we …

---

## [Elasticsearch slowness and frequently nodes are restarting](https://discuss.elastic.co/t/elasticsearch-slowness-and-frequently-nodes-are-restarting/287909)

<div class="topic-metadata">

**Author:** [@muralikri](https://discuss.elastic.co/u/muralikri)\
**Replies:** 1\
**Last updated:** [October 29, 2021, 12:34am UTC](https://discuss.elastic.co/t/elasticsearch-slowness-and-frequently-nodes-are-restarting/287909 "2021-10-29T00:34:57Z")

</div>

Hi Team, We have recently upgraded Elasticsearch from 6.6.1 to 7.13.2 with platinum licence. After upgraded all looks fine and when 3-4 users try to search logs parallelly we getting 504 error and when i check cluster s…

---

## [Adding new documents to production cluster](https://discuss.elastic.co/t/adding-new-documents-to-production-cluster/287910)

<div class="topic-metadata">

**Author:** [@lacerated](https://discuss.elastic.co/u/lacerated)\
**Replies:** 1\
**Last updated:** [October 29, 2021, 12:34am UTC](https://discuss.elastic.co/t/adding-new-documents-to-production-cluster/287910 "2021-10-29T00:34:32Z")

</div>

I have constantly used Elasticsearch cluster with search queries. Once a week i get a batch of new documents i need to add to index. If i add them to index it will greatly slower search speeds while indexing and merging …

[Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=548)

[Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=550)
