# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=554 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 555 --- ## [Possibility to use single index template for all application indices](https://discuss.elastic.co/t/possibility-to-use-single-index-template-for-all-application-indices/285741)
**Author:** [@prat](https://discuss.elastic.co/u/prat)\ **Replies:** 14\ **Last updated:** [October 22, 2021, 5:19pm UTC](https://discuss.elastic.co/t/possibility-to-use-single-index-template-for-all-application-indices/285741 "2021-10-22T17:19:16Z")
Hi Team, I have multiple applications running and each has their application logs captured by filebeat and it sends to logstash. Below is the logstash configuration /etc/logstash/conf.d/logstash.conf file. ( showing o… --- ## [Elasticsearch cluster performance](https://discuss.elastic.co/t/elasticsearch-cluster-performance/287214)
**Author:** [@Phandora](https://discuss.elastic.co/u/Phandora)\ **Replies:** 3\ **Last updated:** [October 22, 2021, 5:13pm UTC](https://discuss.elastic.co/t/elasticsearch-cluster-performance/287214 "2021-10-22T17:13:36Z")
Hi everyone, I am using Elasticsearch 7.10.2 version on EKS and I have some questions about the Elasticsearch cluster performance. Assuming that the total amount of cluster resources is the same in both cases, which is… --- ## [Should I use Simple Query or Match Query?](https://discuss.elastic.co/t/should-i-use-simple-query-or-match-query/287438)
**Author:** [@Sandra\_Schlichting](https://discuss.elastic.co/u/Sandra_Schlichting)\ **Replies:** 7\ **Last updated:** [October 22, 2021, 4:48pm UTC](https://discuss.elastic.co/t/should-i-use-simple-query-or-match-query/287438 "2021-10-22T16:48:15Z")
Dear all =) If I want to search for the following host:"10.250.11.11" and custom4:"errors occurred" then match-query and simple-query-string both looks like possible candidates. I will end up creating Kibana Rules, a… --- ## [How get 1million documents from elasticsearch?](https://discuss.elastic.co/t/how-get-1million-documents-from-elasticsearch/287446)
**Author:** [@psyapathy](https://discuss.elastic.co/u/psyapathy)\ **Replies:** 1\ **Last updated:** [October 22, 2021, 3:54pm UTC](https://discuss.elastic.co/t/how-get-1million-documents-from-elasticsearch/287446 "2021-10-22T15:54:56Z")
Hi all! Help me please. I have index and i want by api get all documents (~1million) from index for my report. I've seen the scroll, but I don't understand how to apply it to my case... How i can do? Thank for advanc… --- ## [Cardinality, adding missing documents to a different bucket](https://discuss.elastic.co/t/cardinality-adding-missing-documents-to-a-different-bucket/287439)
**Author:** [@ibulut](https://discuss.elastic.co/u/ibulut)\ **Replies:** 0\ **Last updated:** [October 22, 2021, 12:41pm UTC](https://discuss.elastic.co/t/cardinality-adding-missing-documents-to-a-different-bucket/287439 "2021-10-22T12:41:18Z")
Hello everyone. I'm beginner with little experience and currently trying to gain experience with experiments. I have a problem with cardinality aggregation. When cardinality is used, it ignores docs with missing values … --- ## [How to find largest size document?](https://discuss.elastic.co/t/how-to-find-largest-size-document/287405)
**Author:** [@Busra\_Duygu](https://discuss.elastic.co/u/Busra_Duygu)\ **Replies:** 2\ **Last updated:** [October 22, 2021, 11:11am UTC](https://discuss.elastic.co/t/how-to-find-largest-size-document/287405 "2021-10-22T11:11:47Z")
Hello dear friends, you have helped me in many ways before, thank you very much for this. Again I am facing a problem. The problem is that I want to find the largest size document in my index. Is it possible for me to do… --- ## [How to perform math formula in Elasticsearch script score based on field value conditions?](https://discuss.elastic.co/t/how-to-perform-math-formula-in-elasticsearch-script-score-based-on-field-value-conditions/287034)
**Author:** [@Mariusz\_Liksza](https://discuss.elastic.co/u/Mariusz_Liksza)\ **Replies:** 6\ **Last updated:** [October 22, 2021, 12:10pm UTC](https://discuss.elastic.co/t/how-to-perform-math-formula-in-elasticsearch-script-score-based-on-field-value-conditions/287034 "2021-10-22T12:10:44Z")
I would like to apply a simple math formula to all documents in Elasticsearch DB. The tricky thing is that each variables consists of multiply values which are at the same time person attributes. { "\_id" : "1",… --- ## [Increasing the heap size](https://discuss.elastic.co/t/increasing-the-heap-size/287410)
**Author:** [@alicango](https://discuss.elastic.co/u/alicango)\ **Replies:** 1\ **Last updated:** [October 22, 2021, 11:50am UTC](https://discuss.elastic.co/t/increasing-the-heap-size/287410 "2021-10-22T11:50:22Z")
Hi, We are getting this error. \[2021-10-01 08:11:12\] local.ERROR: ReportDataProcess Job Exception: {“error”:{“root\_cause”:\[{“type”:“circuit\_breaking\_exception”,“reason”:“\[in\_flight\_requests\] Data too large, data for \[\ **Author:** [@nehaltrivedi96](https://discuss.elastic.co/u/nehaltrivedi96)\ **Replies:** 3\ **Last updated:** [October 22, 2021, 11:46am UTC](https://discuss.elastic.co/t/regex-kibana/287362 "2021-10-22T11:46:06Z") Hello, I am trying to create a regex query in kibana. I want to get a result which has sanitation followed by access meaning I am trying to find sanitation access\*. I am entering the following query but I am not getting… --- ## [Using wildcard and fuzziness in Elasticsearch](https://discuss.elastic.co/t/using-wildcard-and-fuzziness-in-elasticsearch/286822)
**Author:** [@jpllana](https://discuss.elastic.co/u/jpllana)\ **Replies:** 3\ **Last updated:** [October 22, 2021, 11:41am UTC](https://discuss.elastic.co/t/using-wildcard-and-fuzziness-in-elasticsearch/286822 "2021-10-22T11:41:42Z")
I have a query to search for an address where I am using also the wildcard. So if I am searching for Kennedy using the query below, I have these addresses: Query: GET my\_index/\_search { "query": { "query\_string":… --- ## [Elasticsearch tuning](https://discuss.elastic.co/t/elasticsearch-tuning/286623)
**Author:** [@Vishal\_Tomar](https://discuss.elastic.co/u/Vishal_Tomar)\ **Replies:** 2\ **Last updated:** [October 22, 2021, 11:28am UTC](https://discuss.elastic.co/t/elasticsearch-tuning/286623 "2021-10-22T11:28:55Z")
We are developing a platform where millions of records update or insert on a daily basis. For developing this platform we are working with MongoDB as primary database and Elasticsearch for secondary database(Only for se… --- ## [A question regarding querying only the index's latest documents](https://discuss.elastic.co/t/a-question-regarding-querying-only-the-indexs-latest-documents/286295)
**Author:** [@nivo](https://discuss.elastic.co/u/nivo)\ **Replies:** 7\ **Last updated:** [October 21, 2021, 10:35pm UTC](https://discuss.elastic.co/t/a-question-regarding-querying-only-the-indexs-latest-documents/286295 "2021-10-21T22:35:06Z")
Hi everyone, I'm doing a POC on a rolling indexes alternative approach in order to avoid deleting documents. I encounter some difficulties querying the data I need and I'm not sure if that's just me looking at the quer… --- ## [Highlight subset of characters](https://discuss.elastic.co/t/highlight-subset-of-characters/285370)
**Author:** [@itokai](https://discuss.elastic.co/u/itokai)\ **Replies:** 2\ **Last updated:** [October 18, 2021, 10:56am UTC](https://discuss.elastic.co/t/highlight-subset-of-characters/285370 "2021-10-18T10:56:26Z")
Hello, how to highlight subset of characters in word(s) within sentence? For sentence: It makes website content ingestion easier than ever, so you can add search to your websites and apps in record time. if chars arr… --- ## [How to learn index with most queries?](https://discuss.elastic.co/t/how-to-learn-index-with-most-queries/287407)
**Author:** [@Busra\_Duygu](https://discuss.elastic.co/u/Busra_Duygu)\ **Replies:** 2\ **Last updated:** [October 22, 2021, 7:27am UTC](https://discuss.elastic.co/t/how-to-learn-index-with-most-queries/287407 "2021-10-22T07:27:21Z")
Hello dear friends, I would like to ask you a question that has been on my mind before. This question is: I wonder if we can find which indexes get the most queries. So I have more than one index and these indexes are us… --- ## [Data path configuration in source code (7.15) running in local machine](https://discuss.elastic.co/t/data-path-configuration-in-source-code-7-15-running-in-local-machine/287397)
**Author:** [@vnaveed](https://discuss.elastic.co/u/vnaveed)\ **Replies:** 0\ **Last updated:** [October 22, 2021, 5:45am UTC](https://discuss.elastic.co/t/data-path-configuration-in-source-code-7-15-running-in-local-machine/287397 "2021-10-22T05:45:44Z")
Hi.. Am running the Elasticsearch source code (7.15) in my window machine, May I know in which file I have to change the path to store my data permanently Since each time I restart the machine build folder gets reset. I… --- ## [Clearing the concept of Translog](https://discuss.elastic.co/t/clearing-the-concept-of-translog/287374)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 4\ **Last updated:** [October 22, 2021, 5:32am UTC](https://discuss.elastic.co/t/clearing-the-concept-of-translog/287374 "2021-10-22T05:32:24Z")
In translog documentation it is said that All index and delete operations are written to the translog after being processed by the internal Lucene index but before they are acknowledged So i am not understanding what… --- ## [Conditional Sort Using Two Fields](https://discuss.elastic.co/t/conditional-sort-using-two-fields/287352)
**Author:** [@cruzmoan](https://discuss.elastic.co/u/cruzmoan)\ **Replies:** 0\ **Last updated:** [October 21, 2021, 6:40pm UTC](https://discuss.elastic.co/t/conditional-sort-using-two-fields/287352 "2021-10-21T18:40:11Z")
We have a document that has the following fields: field1 field2 valueType We want to include both fields in the sort. We do NOT want to sort field1, then field2. We want the sort to use both fields at the same sort… --- ## [Do I need to generate a cert?](https://discuss.elastic.co/t/do-i-need-to-generate-a-cert/286773)
**Author:** [@MKirby](https://discuss.elastic.co/u/MKirby)\ **Replies:** 8\ **Last updated:** [October 21, 2021, 7:23pm UTC](https://discuss.elastic.co/t/do-i-need-to-generate-a-cert/286773 "2021-10-21T19:23:03Z")
I have successfully configured minimal security in my environment and am now moving on to Basic, so that I can use fleet and SIEM. Version of Elastic I am using is 7.13.4, on a RHEL 8.0 server. I only have 1 Elasticsea… --- ## [Default username and password for Elasticsearch 7.15](https://discuss.elastic.co/t/default-username-and-password-for-elasticsearch-7-15/287235)
**Author:** [@harryco](https://discuss.elastic.co/u/harryco)\ **Replies:** 3\ **Last updated:** [October 21, 2021, 7:12pm UTC](https://discuss.elastic.co/t/default-username-and-password-for-elasticsearch-7-15/287235 "2021-10-21T19:12:44Z")
Hi, I just installed Elasticsearch 7.15.1 on macOS Catalina, and I set the following in Elasticsearch.yml in order to enable security: xpack.security.enabled: true Now, I'm prompted for a username and password, but I … --- ## [SQL indexes with dashes fail with high level java client (escaped with quotes)](https://discuss.elastic.co/t/sql-indexes-with-dashes-fail-with-high-level-java-client-escaped-with-quotes/287108)
**Author:** [@larryjag99](https://discuss.elastic.co/u/larryjag99)\ **Replies:** 2\ **Last updated:** [October 21, 2021, 6:21pm UTC](https://discuss.elastic.co/t/sql-indexes-with-dashes-fail-with-high-level-java-client-escaped-with-quotes/287108 "2021-10-21T18:21:29Z")
I am using the high-level java client to submit SQL requests to our elastic cluster. I'm seeing an issue where if the index name has a "dash" in it (while enclosed in quotes), the request cannot be parsed by the server.… --- ## [FSCrawler get a path error while running as a service](https://discuss.elastic.co/t/fscrawler-get-a-path-error-while-running-as-a-service/287320)
**Author:** [@Denn](https://discuss.elastic.co/u/Denn)\ **Replies:** 2\ **Last updated:** [October 21, 2021, 2:26pm UTC](https://discuss.elastic.co/t/fscrawler-get-a-path-error-while-running-as-a-service/287320 "2021-10-21T14:26:53Z")
I have a working implementation of fscrawler. However, it is running on command prompt. I have tried to implement it as a service but i keep getting an error. my url looks like this url: "\\\\\\\\data-backup\\\\2020" The er… --- ## [Elastalert change timezone](https://discuss.elastic.co/t/elastalert-change-timezone/287317)
**Author:** [@josh12](https://discuss.elastic.co/u/josh12)\ **Replies:** 5\ **Last updated:** [October 21, 2021, 2:07pm UTC](https://discuss.elastic.co/t/elastalert-change-timezone/287317 "2021-10-21T14:07:17Z")
Hi i running my el;asticsearch and elastalert in docker. Data pass from beat to Elasticsearch. In Elasticsearch the time is stored local time but in elastalert is in UTC time. so when i test rule, i am hitting 0 hit sicn… --- ## [Elasticsearch is not starting](https://discuss.elastic.co/t/elasticsearch-is-not-starting/287276)
**Author:** [@mangeshs](https://discuss.elastic.co/u/mangeshs)\ **Replies:** 5\ **Last updated:** [October 21, 2021, 1:42pm UTC](https://discuss.elastic.co/t/elasticsearch-is-not-starting/287276 "2021-10-21T13:42:32Z")
I want to start Elasticsearch on linux system and give command like below at bin path ./elasticsearch OpenJDK 64-Bit Server VM warning: Option UseConcMarkSweepGC was deprecated in version 9.0 and will likely be removed… --- ## [Return number of hits in field](https://discuss.elastic.co/t/return-number-of-hits-in-field/286101)
**Author:** [@LaySoft](https://discuss.elastic.co/u/LaySoft)\ **Replies:** 3\ **Last updated:** [October 21, 2021, 1:40pm UTC](https://discuss.elastic.co/t/return-number-of-hits-in-field/286101 "2021-10-21T13:40:28Z")
Hi! My mapping is: PUT /test { "mappings": { "properties": { "lufi": { "properties": { "duma": { "type": "keyword" … --- ## [Matching documents with empty symbol in the end using regexp](https://discuss.elastic.co/t/matching-documents-with-empty-symbol-in-the-end-using-regexp/287023)
**Author:** [@111343](https://discuss.elastic.co/u/111343)\ **Replies:** 3\ **Last updated:** [October 21, 2021, 12:11pm UTC](https://discuss.elastic.co/t/matching-documents-with-empty-symbol-in-the-end-using-regexp/287023 "2021-10-21T12:11:47Z")
Hi I have an Elasticsearch document that can have various forms of the string "creative=". Logs that have good format look like "creative=xxx", and logs that have bad format look like "creative=". Example of bad log: h… --- ## [Capturing maximum unique count per second for each day](https://discuss.elastic.co/t/capturing-maximum-unique-count-per-second-for-each-day/287314)
**Author:** [@jevans78](https://discuss.elastic.co/u/jevans78)\ **Replies:** 0\ **Last updated:** [October 21, 2021, 12:07pm UTC](https://discuss.elastic.co/t/capturing-maximum-unique-count-per-second-for-each-day/287314 "2021-10-21T12:07:21Z")
Hi, I'm trying to get a representation of the number of unique events per second over a 3 month period. Default configuration auto-scales this to No. of events per 12 hours. Is there an easy way that I can display the … --- ## [Why only one of these queries returns a record?](https://discuss.elastic.co/t/why-only-one-of-these-queries-returns-a-record/287311)
**Author:** [@stexxen](https://discuss.elastic.co/u/stexxen)\ **Replies:** 1\ **Last updated:** [October 21, 2021, 12:02pm UTC](https://discuss.elastic.co/t/why-only-one-of-these-queries-returns-a-record/287311 "2021-10-21T12:02:56Z")
Could someone explain why these queries are not returning the same response? This first query using script returns no records GET /ind1/\_search { "query": { "bool": { "must": \[ { "script":… --- ## [Painless iterate over Nested Array](https://discuss.elastic.co/t/painless-iterate-over-nested-array/287312)
**Author:** [@Mandark1990](https://discuss.elastic.co/u/Mandark1990)\ **Replies:** 0\ **Last updated:** [October 21, 2021, 11:54am UTC](https://discuss.elastic.co/t/painless-iterate-over-nested-array/287312 "2021-10-21T11:54:51Z")
Hello Everyone, Am trying to write an ingest pipeline which will help me normalize a nested array into individual fields for better visualization in Kibana. As my current event structure doesn't allow me to build the vi… --- ## [Reindex API changed \_version of docs](https://discuss.elastic.co/t/reindex-api-changed-version-of-docs/287305)
**Author:** [@d.silwon](https://discuss.elastic.co/u/d.silwon)\ **Replies:** 2\ **Last updated:** [October 21, 2021, 11:19am UTC](https://discuss.elastic.co/t/reindex-api-changed-version-of-docs/287305 "2021-10-21T11:19:17Z")
Dears, Why reindex API does not copy original doc \_version to new index? Is there any trick to force it? query: GET test/\_search?version=true { "query": { "match\_all": {} } } result: { "took" : 1, "timed\_ou… --- ## [Elasticsearch Bucket script aggregation is not working with filter aggregation](https://discuss.elastic.co/t/elasticsearch-bucket-script-aggregation-is-not-working-with-filter-aggregation/287273)
**Author:** [@r.ganeshbabu](https://discuss.elastic.co/u/r.ganeshbabu)\ **Replies:** 0\ **Last updated:** [October 21, 2021, 8:31am UTC](https://discuss.elastic.co/t/elasticsearch-bucket-script-aggregation-is-not-working-with-filter-aggregation/287273 "2021-10-21T08:31:17Z")
Hi All, I am trying to calculate the percentage in Elasticsearch using bucket script and below is the query I have tried it in kibana, { "size": 0, "aggs": { "Bits": { "filters": { "filters": { "ItemBi… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=553) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=555)