# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=562 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 563 --- ## [Add a node to elastic running on docker from another server](https://discuss.elastic.co/t/add-a-node-to-elastic-running-on-docker-from-another-server/285156)
**Author:** [@kakigadol](https://discuss.elastic.co/u/kakigadol)\ **Replies:** 9\ **Last updated:** [October 10, 2021, 11:38am UTC](https://discuss.elastic.co/t/add-a-node-to-elastic-running-on-docker-from-another-server/285156 "2021-10-10T11:38:48Z")
I have an Elasticsearch 6.6 cluster with two nodes running on the first server using docker-compose I want to add another node running on a separate server to get more physical resources. I configured everything the sa… --- ## [Get a count of buckets from a terms agg, but not the buckets themselves](https://discuss.elastic.co/t/get-a-count-of-buckets-from-a-terms-agg-but-not-the-buckets-themselves/286259)
**Author:** [@annmarie-switzer](https://discuss.elastic.co/u/annmarie-switzer)\ **Replies:** 1\ **Last updated:** [October 10, 2021, 7:58am UTC](https://discuss.elastic.co/t/get-a-count-of-buckets-from-a-terms-agg-but-not-the-buckets-themselves/286259 "2021-10-10T07:58:40Z")
Is there any way to get the bucket count from a terms agg, but just the count, not the buckets themselves? I have a scenario where I want to display a table (with pagination) of all the non-unique values (buckets) for … --- ## [Error: Unknown key for a VALUE\_STRING in \[analyzer\]](https://discuss.elastic.co/t/error-unknown-key-for-a-value-string-in-analyzer/286105)
**Author:** [@Drsaud](https://discuss.elastic.co/u/Drsaud)\ **Replies:** 10\ **Last updated:** [October 10, 2021, 7:37am UTC](https://discuss.elastic.co/t/error-unknown-key-for-a-value-string-in-analyzer/286105 "2021-10-10T07:37:23Z")
Hi, I'm having this error in postman Unknown key for a VALUE\_STRING in \[analyzer\]. when I search like this: (note I get this after I add the analyzer) { "query": { "terms": { "username": … --- ## [Can Painless script to execute search](https://discuss.elastic.co/t/can-painless-script-to-execute-search/286305)
**Author:** [@Param](https://discuss.elastic.co/u/Param)\ **Replies:** 0\ **Last updated:** [October 9, 2021, 7:29pm UTC](https://discuss.elastic.co/t/can-painless-script-to-execute-search/286305 "2021-10-09T19:29:30Z")
Hi I am using scripted grouping of a index . if any bucket's document count is greater than 0, i want to select description filed from index with all of grouping field using as filter for that query. "query": { … --- ## [Custom Plugin add filter to search query by external access policies](https://discuss.elastic.co/t/custom-plugin-add-filter-to-search-query-by-external-access-policies/285723)
**Author:** [@David\_Sheard](https://discuss.elastic.co/u/David_Sheard)\ **Replies:** 5\ **Last updated:** [October 9, 2021, 12:24am UTC](https://discuss.elastic.co/t/custom-plugin-add-filter-to-search-query-by-external-access-policies/285723 "2021-10-09T00:24:46Z")
Hi, I'm wanting to create a custom plugin. The purpose is to make a rest call to an external service to apply access control polices to search requests. Is there any sample code or an article that would assist? Appreci… --- ## [Searching through every document in ES?](https://discuss.elastic.co/t/searching-through-every-document-in-es/286281)
**Author:** [@bensalerno](https://discuss.elastic.co/u/bensalerno)\ **Replies:** 7\ **Last updated:** [October 8, 2021, 11:13pm UTC](https://discuss.elastic.co/t/searching-through-every-document-in-es/286281 "2021-10-08T23:13:56Z")
My cluster has roughly 300,000 documents in it. Right now, I'm only able to query 10,000 at a time. Is there a way to query through all documents? Or is this bad practice? Many of search queries are returning 0 results … --- ## [Frozen Indices Deprecation](https://discuss.elastic.co/t/frozen-indices-deprecation/286288)
**Author:** [@vthacker](https://discuss.elastic.co/u/vthacker)\ **Replies:** 1\ **Last updated:** [October 9, 2021, 12:06am UTC](https://discuss.elastic.co/t/frozen-indices-deprecation/286288 "2021-10-09T00:06:50Z")
Watching this recent talk frozen indices sounds like a feature recommended to users However when I look at the doc here the feature is deprecated. I'm not sure which one to read into - Is the feature going to exist goi… --- ## [Issue with FSCrawler (fscrawler-es7-2.7) . Refusing to upload new files . Warning: set filename as stored field!](https://discuss.elastic.co/t/issue-with-fscrawler-fscrawler-es7-2-7-refusing-to-upload-new-files-warning-set-filename-as-stored-field/286272)
**Author:** [@Francois\_Saab](https://discuss.elastic.co/u/Francois_Saab)\ **Replies:** 1\ **Last updated:** [October 8, 2021, 11:15pm UTC](https://discuss.elastic.co/t/issue-with-fscrawler-fscrawler-es7-2-7-refusing-to-upload-new-files-warning-set-filename-as-stored-field/286272 "2021-10-08T23:15:06Z")
We are facing an issue with FSCrawler (fscrawler-es7-2.7). FSCrawler is refusing to upload new files and raises the below error: 08:37:04,730 WARN \[f.p.e.c.f.FsParserAbstract\] Error while crawling \\SearchEngineFiles\\D… --- ## [Issue with escaping pipe "|" in Ingest Pipeline](https://discuss.elastic.co/t/issue-with-escaping-pipe-in-ingest-pipeline/286279)
**Author:** [@Thanura\_Kannangara](https://discuss.elastic.co/u/Thanura_Kannangara)\ **Replies:** 7\ **Last updated:** [October 8, 2021, 9:20pm UTC](https://discuss.elastic.co/t/issue-with-escaping-pipe-in-ingest-pipeline/286279 "2021-10-08T21:20:37Z")
Hi Guys, I have a log patern that look like this (windows event log) Dummy request has been approved.|Node=blah-blah.example.net\_iam|BatchSig=jhsdjahsdgsjahdg|Requester=john.test|Recipient=ex0000123456 below grok pat… --- ## [Fleet agent failed to connect to fleet server after assigning new agent policy](https://discuss.elastic.co/t/fleet-agent-failed-to-connect-to-fleet-server-after-assigning-new-agent-policy/286263)
**Author:** [@pingz](https://discuss.elastic.co/u/pingz)\ **Replies:** 0\ **Last updated:** [October 8, 2021, 4:04pm UTC](https://discuss.elastic.co/t/fleet-agent-failed-to-connect-to-fleet-server-after-assigning-new-agent-policy/286263 "2021-10-08T16:04:54Z")
Hi there: I have fleet agent and fleet server (7.15.0) both running as pods in Kubernetes. After applying new agent policy, fleet agent became offline. I can see the error in fleet agent log |2021-10-08T15:56:56.120Z… --- ## [Dissect Logs](https://discuss.elastic.co/t/dissect-logs/286048)
**Author:** [@maltewhiite](https://discuss.elastic.co/u/maltewhiite)\ **Replies:** 7\ **Last updated:** [October 8, 2021, 2:41pm UTC](https://discuss.elastic.co/t/dissect-logs/286048 "2021-10-08T14:41:53Z")
I simply want to turn key:value data from a message string into fields in Elastic, so I can analyze the logs with Kibana. I'd like to use Dissect to do the following: Dissecting this log: conn=10 op=221996 RESULT err=… --- ## [Elasticsearch installation](https://discuss.elastic.co/t/elasticsearch-installation/285415)
**Author:** [@eugestel](https://discuss.elastic.co/u/eugestel)\ **Replies:** 45\ **Last updated:** [October 8, 2021, 2:08pm UTC](https://discuss.elastic.co/t/elasticsearch-installation/285415 "2021-10-08T14:08:19Z")
Requesting for help with Elasticsearch. I installed Elasticsearch in my ubuntu server 20.04 but unable to get it to work. The command : systemctl status Elasticsearch.service yielded the following: $ systemctl status… --- ## [Paginating through results in a query that doesnt use sort](https://discuss.elastic.co/t/paginating-through-results-in-a-query-that-doesnt-use-sort/286160)
**Author:** [@John\_Mackey](https://discuss.elastic.co/u/John_Mackey)\ **Replies:** 3\ **Last updated:** [October 8, 2021, 1:46pm UTC](https://discuss.elastic.co/t/paginating-through-results-in-a-query-that-doesnt-use-sort/286160 "2021-10-08T13:46:51Z")
We have the below query that returns 15K results. How do we paginate through all the results From the examples for search\_after , it can be used only if we are sorting by a unique field in the query . We do not intend … --- ## [When does minimum\_should\_match change default value?](https://discuss.elastic.co/t/when-does-minimum-should-match-change-default-value/286234)
**Author:** [@dinamic](https://discuss.elastic.co/u/dinamic)\ **Replies:** 0\ **Last updated:** [October 8, 2021, 12:10pm UTC](https://discuss.elastic.co/t/when-does-minimum-should-match-change-default-value/286234 "2021-10-08T12:10:50Z")
Hey guys :wave: We've upgraded from 6.8 to 7.10 recently and are still finding out issues. It seems like minimum\_should\_match behaviour has been silently updated. Consider the following repeatable example: PUT /test-b… --- ## [Snapshot in s3 bucket not seen by other cluster](https://discuss.elastic.co/t/snapshot-in-s3-bucket-not-seen-by-other-cluster/286006)
**Author:** [@raphaelSeguin](https://discuss.elastic.co/u/raphaelSeguin)\ **Replies:** 3\ **Last updated:** [October 8, 2021, 11:22am UTC](https://discuss.elastic.co/t/snapshot-in-s3-bucket-not-seen-by-other-cluster/286006 "2021-10-08T11:22:02Z")
Hi, I'm using an s3 repository to snapshot a cluster. I was hoping to restore the snapshot on a remote cluster by registering a repository pointing to the same bucket. But the snapshot I took from he first cluster remai… --- ## [Nested query builder inside must\_not clause does not build inner hits](https://discuss.elastic.co/t/nested-query-builder-inside-must-not-clause-does-not-build-inner-hits/286210)
**Author:** [@cip999](https://discuss.elastic.co/u/cip999)\ **Replies:** 0\ **Last updated:** [October 8, 2021, 9:07am UTC](https://discuss.elastic.co/t/nested-query-builder-inside-must-not-clause-does-not-build-inner-hits/286210 "2021-10-08T09:07:25Z")
I encountered an unexpected behavior of ES when combining must\_not and nested. Let's say I have an index my\_index with the following schema: { "mappings": { "properties": { "normal\_field": { "type":… --- ## [Maximum number of shards reached on a single node cluster](https://discuss.elastic.co/t/maximum-number-of-shards-reached-on-a-single-node-cluster/286204)
**Author:** [@NoemieB](https://discuss.elastic.co/u/NoemieB)\ **Replies:** 2\ **Last updated:** [October 8, 2021, 8:40am UTC](https://discuss.elastic.co/t/maximum-number-of-shards-reached-on-a-single-node-cluster/286204 "2021-10-08T08:40:52Z")
Hello, When creating an Index, I get the following error : "this action would add \[2\] total shards, but this cluster currently has \[1000\]/\[1000\] maximum shards open;" I found out a few posts about this issue and checke… --- ## [New master is not getting selected](https://discuss.elastic.co/t/new-master-is-not-getting-selected/286194)
**Author:** [@NutaN\_Shrivastava](https://discuss.elastic.co/u/NutaN_Shrivastava)\ **Replies:** 3\ **Last updated:** [October 8, 2021, 8:40am UTC](https://discuss.elastic.co/t/new-master-is-not-getting-selected/286194 "2021-10-08T08:40:25Z")
I have created a cluster of 3 nodes, out of which 2 are data and master and 1 is only data node. Recently due to some technical glitch one of the master nodes was down, but through out we kept getting a log msg elastic… --- ## [Datastream index template not working](https://discuss.elastic.co/t/datastream-index-template-not-working/286201)
**Author:** [@Santhosh\_CT](https://discuss.elastic.co/u/Santhosh_CT)\ **Replies:** 0\ **Last updated:** [October 8, 2021, 8:12am UTC](https://discuss.elastic.co/t/datastream-index-template-not-working/286201 "2021-10-08T08:12:34Z")
I am trying to onboard datastream into my es cluster. I have created the ilm with necessary phases, created the index template and then creating the datastream. But I am stuck at one point and not able to go forward. I … --- ## [Highlight same field twice with different settings](https://discuss.elastic.co/t/highlight-same-field-twice-with-different-settings/286184)
**Author:** [@Sam\_Gaunt](https://discuss.elastic.co/u/Sam_Gaunt)\ **Replies:** 0\ **Last updated:** [October 8, 2021, 6:44am UTC](https://discuss.elastic.co/t/highlight-same-field-twice-with-different-settings/286184 "2021-10-08T06:44:06Z")
I would like to return multiple highlights of the same field but with different fragment sizes. One would have a smaller fragment size and be used as a preview for the user before they open the document to see the full r… --- ## [Can I limit displayed search results to applicable sentences or paragraphs rather than entire document?](https://discuss.elastic.co/t/can-i-limit-displayed-search-results-to-applicable-sentences-or-paragraphs-rather-than-entire-document/286166)
**Author:** [@neergttocsdivad](https://discuss.elastic.co/u/neergttocsdivad)\ **Replies:** 1\ **Last updated:** [October 8, 2021, 5:05am UTC](https://discuss.elastic.co/t/can-i-limit-displayed-search-results-to-applicable-sentences-or-paragraphs-rather-than-entire-document/286166 "2021-10-08T05:05:09Z")
I have indexed 24 Jack Reacher books. Any successful search displays at least one book in its entirety. e.g.: } GET books4/\_search { "query": { "match\_phrase":{ "content": "deerfield nodded" } } } Is … --- ## [Is it possible to turn off "Elasticsearch built-in security features are not enabled" notifications?](https://discuss.elastic.co/t/is-it-possible-to-turn-off-elasticsearch-built-in-security-features-are-not-enabled-notifications/286167)
**Author:** [@neergttocsdivad](https://discuss.elastic.co/u/neergttocsdivad)\ **Replies:** 2\ **Last updated:** [October 8, 2021, 4:20am UTC](https://discuss.elastic.co/t/is-it-possible-to-turn-off-elasticsearch-built-in-security-features-are-not-enabled-notifications/286167 "2021-10-08T04:20:26Z")
I'm using ES on a stand-alone computer, without a wired or wireless network or internet connections. --- ## [ElasticSearch freezes suddenly and unable to respond](https://discuss.elastic.co/t/elasticsearch-freezes-suddenly-and-unable-to-respond/284256)
**Author:** [@Vishal\_Goel](https://discuss.elastic.co/u/Vishal_Goel)\ **Replies:** 11\ **Last updated:** [October 8, 2021, 3:52am UTC](https://discuss.elastic.co/t/elasticsearch-freezes-suddenly-and-unable-to-respond/284256 "2021-10-08T03:52:12Z")
Hi, We have ES OSS 7.0 running for more than couple of months. In last 15 days, ES froze and became very slow. It is almost unable to process any request. Setup: Single Node, Windows VM, 16 cores, 32GB RAM, ES Xmx 4G, … --- ## [Question: Are we going to run into problems using (abusing?) nested at scale](https://discuss.elastic.co/t/question-are-we-going-to-run-into-problems-using-abusing-nested-at-scale/285122)
**Author:** [@huggsboson](https://discuss.elastic.co/u/huggsboson)\ **Replies:** 4\ **Last updated:** [October 7, 2021, 10:31pm UTC](https://discuss.elastic.co/t/question-are-we-going-to-run-into-problems-using-abusing-nested-at-scale/285122 "2021-10-07T22:31:40Z")
We're looking for guidance on any pitfalls in terms of scale / performance we may run into when using the nested field type in Elasticsearch. We have a use-case where we have a 100k+ different customer schemas that we ar… --- ## [Is there a soon update for transforms API](https://discuss.elastic.co/t/is-there-a-soon-update-for-transforms-api/285685)
**Author:** [@marone](https://discuss.elastic.co/u/marone)\ **Replies:** 5\ **Last updated:** [October 7, 2021, 3:03pm UTC](https://discuss.elastic.co/t/is-there-a-soon-update-for-transforms-api/285685 "2021-10-07T15:03:32Z")
I'm using transforms API for a use-case, where I have to run it continuously, the limitation described here list that the max frequency I can set is every 1h. But I'm planning to run it at night for documents indexed las… --- ## [Field definition in logstash and elastic search](https://discuss.elastic.co/t/field-definition-in-logstash-and-elastic-search/286144)
**Author:** [@mangeshs](https://discuss.elastic.co/u/mangeshs)\ **Replies:** 1\ **Last updated:** [October 7, 2021, 2:32pm UTC](https://discuss.elastic.co/t/field-definition-in-logstash-and-elastic-search/286144 "2021-10-07T14:32:59Z")
I have created three fields one index-number according to path and two static as mentioned in config file grok { match =\> {"path" =\> "indexer-(?\\[0-9\]\*)"} } mutate{ convert =\> {"index-number" =\> "int… --- ## [Multiple query with nested](https://discuss.elastic.co/t/multiple-query-with-nested/286020)
**Author:** [@elastic\_dev](https://discuss.elastic.co/u/elastic_dev)\ **Replies:** 5\ **Last updated:** [October 7, 2021, 2:24pm UTC](https://discuss.elastic.co/t/multiple-query-with-nested/286020 "2021-10-07T14:24:26Z")
Hi Below is my data. { "took" : 5, "timed\_out" : false, "\_shards" : { "total" : 1, "successful" : 1, "skipped" : 0, "failed" : 0 }, "hits" : { "total" : { "value" : 2, "relation… --- ## [Elasticsearch Angular](https://discuss.elastic.co/t/elasticsearch-angular/286042)
**Author:** [@Lyes\_Ouchene](https://discuss.elastic.co/u/Lyes_Ouchene)\ **Replies:** 4\ **Last updated:** [October 7, 2021, 2:15pm UTC](https://discuss.elastic.co/t/elasticsearch-angular/286042 "2021-10-07T14:15:21Z")
Hello everyone, i am new to Elasticsearch and want to create an angular search application. do you have any links for me ! --- ## [Not possible to emit List for keyword runtime field](https://discuss.elastic.co/t/not-possible-to-emit-list-for-keyword-runtime-field/285397)
**Author:** [@tomhe](https://discuss.elastic.co/u/tomhe)\ **Replies:** 1\ **Last updated:** [October 7, 2021, 1:53pm UTC](https://discuss.elastic.co/t/not-possible-to-emit-list-for-keyword-runtime-field/285397 "2021-10-07T13:53:37Z")
In Elasticsearch 7.15.0, I am unable to emit a list of strings for a keyword runtime field: PUT warning PUT warning/\_mapping { "dynamic": false, "runtime": { "Warning": { "type": "keyword", "script"… --- ## [Upgrade Ubuntu 18.04 to 20.04](https://discuss.elastic.co/t/upgrade-ubuntu-18-04-to-20-04/286134)
**Author:** [@franco\_peppino](https://discuss.elastic.co/u/franco_peppino)\ **Replies:** 0\ **Last updated:** [October 7, 2021, 1:00pm UTC](https://discuss.elastic.co/t/upgrade-ubuntu-18-04-to-20-04/286134 "2021-10-07T13:00:11Z")
Hello guys, I have one question. I have a 3 node Elasticsearch cluster running on Ubuntu Server 18.04, and I want to upgrade to Ubuntu 20.04. Should I take care of something related to elastic or a do-release-upgrade sh… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=561) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=563)