# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=565 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 566 --- ## [Elasticsearch Index Split](https://discuss.elastic.co/t/elasticsearch-index-split/285649)
**Author:** [@tusharnemade](https://discuss.elastic.co/u/tusharnemade)\ **Replies:** 4\ **Last updated:** [October 4, 2021, 6:33am UTC](https://discuss.elastic.co/t/elasticsearch-index-split/285649 "2021-10-04T06:33:28Z")
Hello Team I am using Elasticsearch version 7.8.0 I used API "SPLIT" to break my big index into multiple shards. After split was concluded successfully.... I found that my new SPLITTED Index \[ myindex-000797-sp \] is … --- ## [Elasticsearch curator restoring ".security" index during restore action](https://discuss.elastic.co/t/elasticsearch-curator-restoring-security-index-during-restore-action/285648)
**Author:** [@163satish](https://discuss.elastic.co/u/163satish)\ **Replies:** 8\ **Last updated:** [October 4, 2021, 5:45am UTC](https://discuss.elastic.co/t/elasticsearch-curator-restoring-security-index-during-restore-action/285648 "2021-10-04T05:45:41Z")
I am using Elasticsearch curator 5.8 to take snapshot on region1 and restore on region2. Recently, cluster was upgraded to 7.14, and I needed to upgrade curator to 5.8 (min 5.7 is needed). Now, when I am restoring a sna… --- ## [Why Elasticsearch delete repository API only removes reference](https://discuss.elastic.co/t/why-elasticsearch-delete-repository-api-only-removes-reference/285660)
**Author:** [@Deepika\_Dhiman](https://discuss.elastic.co/u/Deepika_Dhiman)\ **Replies:** 6\ **Last updated:** [October 4, 2021, 4:43am UTC](https://discuss.elastic.co/t/why-elasticsearch-delete-repository-api-only-removes-reference/285660 "2021-10-04T04:43:05Z")
I am using Elasticsearch API to delete the Elasticsearch repository and Elasticsearch locations. But in both cases, Physical folders remain intact in the file system. I read in the documentation that delete API only rem… --- ## [Translog is corrupted](https://discuss.elastic.co/t/translog-is-corrupted/285208)
**Author:** [@fetch](https://discuss.elastic.co/u/fetch)\ **Replies:** 2\ **Last updated:** [October 4, 2021, 4:24am UTC](https://discuss.elastic.co/t/translog-is-corrupted/285208 "2021-10-04T04:24:02Z")
Hello, I have a cluster of 3 ES nodes that uses 7.10.1 version. One node had an HDD failure last night. We have bring it up and almost all indices have recovered successfully. However, there are 4 indices that fails to… --- ## [Elasticsearch stopped with Cassandra](https://discuss.elastic.co/t/elasticsearch-stopped-with-cassandra/285284)
**Author:** [@Klaus\_Salazar](https://discuss.elastic.co/u/Klaus_Salazar)\ **Replies:** 3\ **Last updated:** [October 3, 2021, 11:56pm UTC](https://discuss.elastic.co/t/elasticsearch-stopped-with-cassandra/285284 "2021-10-03T23:56:41Z")
Hi, i have a big problem with Elasticsearch and this is that when i install Cassandra database automaticly Elastic is stopped, then i see that Cassandra is running but Elastic not and later if i stop cassandra my Elastic… --- ## [Search template - how to pass array of values as parameter](https://discuss.elastic.co/t/search-template-how-to-pass-array-of-values-as-parameter/285756)
**Author:** [@askids](https://discuss.elastic.co/u/askids)\ **Replies:** 0\ **Last updated:** [October 2, 2021, 8:16pm UTC](https://discuss.elastic.co/t/search-template-how-to-pass-array-of-values-as-parameter/285756 "2021-10-02T20:16:03Z")
hi, I am trying to convert an existing query using term\_set to a search template. But I am unable to find any documentation that shows how to pass array value as parameter input. There is sample for passing json array t… --- ## [How to get license key to use ML feature?](https://discuss.elastic.co/t/how-to-get-license-key-to-use-ml-feature/285749)
**Author:** [@quyennguyen](https://discuss.elastic.co/u/quyennguyen)\ **Replies:** 2\ **Last updated:** [October 2, 2021, 6:59pm UTC](https://discuss.elastic.co/t/how-to-get-license-key-to-use-ml-feature/285749 "2021-10-02T18:59:47Z")
I install Elasticsearch, Kibana and Logstash in Ubuntu 18.04. I already used a 30-day free trial and everything went well. Now I need the license key to continue using the ML feature in the future. But don't know to get… --- ## [Low writing speed on SSD, identify bottleneck](https://discuss.elastic.co/t/low-writing-speed-on-ssd-identify-bottleneck/285726)
**Author:** [@sdwerwed](https://discuss.elastic.co/u/sdwerwed)\ **Replies:** 5\ **Last updated:** [October 2, 2021, 3:35pm UTC](https://discuss.elastic.co/t/low-writing-speed-on-ssd-identify-bottleneck/285726 "2021-10-02T15:35:19Z")
Hello Elasticseach community! :slight\_smile: Writing speed on SSD is low and I am not sure where the bottleneck is. I use Elasticsearch 7.14.0 in Kubernetes 4 data nodes 3 masters 8G RAM 4g heap 1 CPU each 512 Standa… --- ## [Curl -XGET 'http://127.0.0.1:9200'](https://discuss.elastic.co/t/curl-xget-http-127-0-0-1-9200/285645)
**Author:** [@sandy12](https://discuss.elastic.co/u/sandy12)\ **Replies:** 3\ **Last updated:** [October 2, 2021, 12:27pm UTC](https://discuss.elastic.co/t/curl-xget-http-127-0-0-1-9200/285645 "2021-10-02T12:27:40Z")
When I am running this command curl -XGET 'http://127.0.0.1:9200' getting below error Request on loopback from external IP Request on loopback from external IP Description: Your request is prohibited because the reque… --- ## [Index template with date attached to end](https://discuss.elastic.co/t/index-template-with-date-attached-to-end/285708)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 1\ **Last updated:** [October 1, 2021, 7:07pm UTC](https://discuss.elastic.co/t/index-template-with-date-attached-to-end/285708 "2021-10-01T19:07:08Z")
I am trying to put template which can be use to rotate index. these are the steps but not working PUT \_index\_template/system-fs { "template": { "settings": { "index": { "lifecycle": { "name… --- ## [Stream data from elasticsearch](https://discuss.elastic.co/t/stream-data-from-elasticsearch/285710)
**Author:** [@Aswin\_Jose](https://discuss.elastic.co/u/Aswin_Jose)\ **Replies:** 0\ **Last updated:** [October 1, 2021, 7:03pm UTC](https://discuss.elastic.co/t/stream-data-from-elasticsearch/285710 "2021-10-01T19:03:47Z")
How to stream records one by one from Elasticsearch? --- ## [Syntax error in painless script in watcher](https://discuss.elastic.co/t/syntax-error-in-painless-script-in-watcher/284438)
**Author:** [@bcaillat](https://discuss.elastic.co/u/bcaillat)\ **Replies:** 3\ **Last updated:** [October 1, 2021, 6:53pm UTC](https://discuss.elastic.co/t/syntax-error-in-painless-script-in-watcher/284438 "2021-10-01T18:53:33Z")
Hello! I'm trying to create a watcher with a condition that uses a Map and keep getting a syntax error. For example the following code does not compile: "condition": { "script": { "source": """ Map… --- ## [SLM Policy Not Being Followed?](https://discuss.elastic.co/t/slm-policy-not-being-followed/285700)
**Author:** [@BenB196](https://discuss.elastic.co/u/BenB196)\ **Replies:** 2\ **Last updated:** [October 1, 2021, 6:46pm UTC](https://discuss.elastic.co/t/slm-policy-not-being-followed/285700 "2021-10-01T18:46:57Z")
Hi All, I'm attempting to debug an issue, and while attempting to debug said issue, I noticed potentially another issue where SLM isn't properly cleaning up snapshots. Has anyone seen this issue before or know why it's… --- ## [Elasticsearch seems to redact/obfuscate IP addresses in index names](https://discuss.elastic.co/t/elasticsearch-seems-to-redact-obfuscate-ip-addresses-in-index-names/285704)
**Author:** [@romull](https://discuss.elastic.co/u/romull)\ **Replies:** 0\ **Last updated:** [October 1, 2021, 6:10pm UTC](https://discuss.elastic.co/t/elasticsearch-seems-to-redact-obfuscate-ip-addresses-in-index-names/285704 "2021-10-01T18:10:49Z")
Hi there! I am creating dynamic index names with logstash. The name contains dynamic content such as the date and IP address of the hosts monitored. Everything works. The indices are created with the proper name as I ex… --- ## [How to get related field from highlighting with nested fields in the document](https://discuss.elastic.co/t/how-to-get-related-field-from-highlighting-with-nested-fields-in-the-document/285696)
**Author:** [@muns](https://discuss.elastic.co/u/muns)\ **Replies:** 0\ **Last updated:** [October 1, 2021, 4:57pm UTC](https://discuss.elastic.co/t/how-to-get-related-field-from-highlighting-with-nested-fields-in-the-document/285696 "2021-10-01T16:57:16Z")
I search for the contents of a book, which is in an array of books and the array is part of a bookstore. I have the highlighting working, however it does not tell me which book was hit. How do I get the book id? index: … --- ## [200 primary shards 200 unassigned](https://discuss.elastic.co/t/200-primary-shards-200-unassigned/285688)
**Author:** [@sebux](https://discuss.elastic.co/u/sebux)\ **Replies:** 1\ **Last updated:** [October 1, 2021, 3:00pm UTC](https://discuss.elastic.co/t/200-primary-shards-200-unassigned/285688 "2021-10-01T15:00:12Z")
Hello I'm new to ES. I'm trying to understand what does this mean . When I curl the cluster health status I'm seing 200 primary shards and 200 unassigned shards. Does this have an impact on my cluster? Sebux --- ## [Does ES support array of dense vectors?](https://discuss.elastic.co/t/does-es-support-array-of-dense-vectors/285687)
**Author:** [@Fred\_Kufner](https://discuss.elastic.co/u/Fred_Kufner)\ **Replies:** 0\ **Last updated:** [October 1, 2021, 2:46pm UTC](https://discuss.elastic.co/t/does-es-support-array-of-dense-vectors/285687 "2021-10-01T14:46:45Z")
I am having problems updating a document with an array of dense vectors. According to the documentation (and empirically by my code in other areas) , In Elasticsearch, there is no dedicated array data type. Any field can… --- ## [Curator stopped working after 7.14.0 upgrade (KeyError: indices)](https://discuss.elastic.co/t/curator-stopped-working-after-7-14-0-upgrade-keyerror-indices/285578)
**Author:** [@hunsw](https://discuss.elastic.co/u/hunsw)\ **Replies:** 5\ **Last updated:** [October 1, 2021, 2:02pm UTC](https://discuss.elastic.co/t/curator-stopped-working-after-7-14-0-upgrade-keyerror-indices/285578 "2021-10-01T14:02:06Z")
After upgrading Elasticsearch from 7.10 to 7.14, Curator 5.4.8 has stopped working: simple delete jobs, create alias jobs, etc. that previously worked fine are now throwing this error: 2021-09-29 15:12:25,343 DEBUG … --- ## [Elasticsearch and logstash problem](https://discuss.elastic.co/t/elasticsearch-and-logstash-problem/285540)
**Author:** [@Busra\_Duygu](https://discuss.elastic.co/u/Busra_Duygu)\ **Replies:** 2\ **Last updated:** [October 1, 2021, 11:12am UTC](https://discuss.elastic.co/t/elasticsearch-and-logstash-problem/285540 "2021-10-01T11:12:22Z")
Hello everyone. I have a problem with logstash and Elasticsearch. I would like to explain my problem with an example. I have two conf files, first example\_A.conf and second example\_B.conf. I am loading data from example\_… --- ## [Can both allocate this shard and improve the cluster balance](https://discuss.elastic.co/t/can-both-allocate-this-shard-and-improve-the-cluster-balance/285579)
**Author:** [@Mike\_Williams](https://discuss.elastic.co/u/Mike_Williams)\ **Replies:** 5\ **Last updated:** [October 1, 2021, 10:20am UTC](https://discuss.elastic.co/t/can-both-allocate-this-shard-and-improve-the-cluster-balance/285579 "2021-10-01T10:20:35Z")
Hi everyone, I've recently been setting up a new ELK stack, and am naturally trying to use all the cool tools and features possible. In times past we've used regular indices and curator to move their shards about based… --- ## [Fetch data from a middle of a big stack using searchAfter( jump to a specific page)](https://discuss.elastic.co/t/fetch-data-from-a-middle-of-a-big-stack-using-searchafter-jump-to-a-specific-page/285256)
**Author:** [@Fat](https://discuss.elastic.co/u/Fat)\ **Replies:** 4\ **Last updated:** [October 1, 2021, 8:18am UTC](https://discuss.elastic.co/t/fetch-data-from-a-middle-of-a-big-stack-using-searchafter-jump-to-a-specific-page/285256 "2021-10-01T08:18:13Z")
Hi All I have a large data set around 25million records I am using searchAfter with PointInTime to walk through the data My question is there a way where I can skip records over the limit of 10000 index.max\_result\_w… --- ## [Terms aggregation on multiple indexes, ignore text fields](https://discuss.elastic.co/t/terms-aggregation-on-multiple-indexes-ignore-text-fields/285654)
**Author:** [@Emil](https://discuss.elastic.co/u/Emil)\ **Replies:** 1\ **Last updated:** [October 1, 2021, 7:41am UTC](https://discuss.elastic.co/t/terms-aggregation-on-multiple-indexes-ignore-text-fields/285654 "2021-10-01T07:41:27Z")
I have multiple indexes, that I'd like to query at the same time, and find out which values are present in some field, with a terms aggregation. The problem is, this field is sometimes mapped as a keyword, and sometimes… --- ## [Upgrade data node to data + master node in production](https://discuss.elastic.co/t/upgrade-data-node-to-data-master-node-in-production/285633)
**Author:** [@bhargava\_kovi](https://discuss.elastic.co/u/bhargava_kovi)\ **Replies:** 2\ **Last updated:** [October 1, 2021, 7:24am UTC](https://discuss.elastic.co/t/upgrade-data-node-to-data-master-node-in-production/285633 "2021-10-01T07:24:48Z")
I am running a production cluster with below configuration No of nodes:6 memory size of each node=64GB No of documents=1Billion No of shards=5 No of replicas=1 All the 6 nodes are master + data nodes and there is n… --- ## [Bootstrapped index is set as the write index but logs are getting written to old index](https://discuss.elastic.co/t/bootstrapped-index-is-set-as-the-write-index-but-logs-are-getting-written-to-old-index/285589)
**Author:** [@mitesh.gangaramani](https://discuss.elastic.co/u/mitesh.gangaramani)\ **Replies:** 4\ **Last updated:** [October 1, 2021, 5:50am UTC](https://discuss.elastic.co/t/bootstrapped-index-is-set-as-the-write-index-but-logs-are-getting-written-to-old-index/285589 "2021-10-01T05:50:14Z")
Hello Experts, We are running Elastic + Fluentbit + Kibana stack on kubernetes for container logs and it was working correctly with daily rollover based on date(new-YYYY-MM-DD) but on high volume it caused over shard s… --- ## [I could not see the real Time data on Kibana](https://discuss.elastic.co/t/i-could-not-see-the-real-time-data-on-kibana/285590)
**Author:** [@Mamta\_Yadav](https://discuss.elastic.co/u/Mamta_Yadav)\ **Replies:** 2\ **Last updated:** [October 1, 2021, 5:40am UTC](https://discuss.elastic.co/t/i-could-not-see-the-real-time-data-on-kibana/285590 "2021-10-01T05:40:54Z")
I am very new to this ELK , I have few questions , 1) I am trying to visualize below log line kibana for that I used 4 components filebeat which is reading the log file from server and send data to logstash logstash filt… --- ## [ES 7.14 does create index from template but ignore mappings and replicas](https://discuss.elastic.co/t/es-7-14-does-create-index-from-template-but-ignore-mappings-and-replicas/283352)
**Author:** [@luigius](https://discuss.elastic.co/u/luigius)\ **Replies:** 2\ **Last updated:** [October 1, 2021, 3:46am UTC](https://discuss.elastic.co/t/es-7-14-does-create-index-from-template-but-ignore-mappings-and-replicas/283352 "2021-10-01T03:46:57Z")
Hi, I create a template: PUT \_template/logstash { "index\_patterns" : \[ "logstash-\*" \], "settings" : { "index" : { "lifecycle" : { "name" : "filebeat", "rollover\_alia… --- ## [How to aggregate consecutive "same" logs in Elasticsearch/Kibana?](https://discuss.elastic.co/t/how-to-aggregate-consecutive-same-logs-in-elasticsearch-kibana/285181)
**Author:** [@piglovesyou1](https://discuss.elastic.co/u/piglovesyou1)\ **Replies:** 4\ **Last updated:** [October 1, 2021, 2:40am UTC](https://discuss.elastic.co/t/how-to-aggregate-consecutive-same-logs-in-elasticsearch-kibana/285181 "2021-10-01T02:40:59Z")
Hi. I currently have data looking like these. // Input { user: "A", status: "away", timestamp: 1 } { user: "A", status: "away", timestamp: 2 } { user: "B", status: "active", timestamp: 3 } { user: "A", status: "away", t… --- ## [Filter field by percentage](https://discuss.elastic.co/t/filter-field-by-percentage/285628)
**Author:** [@Felipe\_Fuller](https://discuss.elastic.co/u/Felipe_Fuller)\ **Replies:** 1\ **Last updated:** [September 30, 2021, 11:35pm UTC](https://discuss.elastic.co/t/filter-field-by-percentage/285628 "2021-09-30T23:35:28Z")
Hello Community! I am having a problem formulating a query in Elasticseach. In this query, I have to group the IPs by the field called ip\_address defined as IP type, and return the ones that have an occurrence greater t… --- ## [Kibana and UiPath Orchestrator ( Cloud)](https://discuss.elastic.co/t/kibana-and-uipath-orchestrator-cloud/285548)
**Author:** [@Varun\_Dharni](https://discuss.elastic.co/u/Varun_Dharni)\ **Replies:** 1\ **Last updated:** [September 30, 2021, 10:49pm UTC](https://discuss.elastic.co/t/kibana-and-uipath-orchestrator-cloud/285548 "2021-09-30T22:49:00Z")
How can I connect Kibana with UiPath Orchestrator . I want to visualize logs created in UiPath Orchestrator in Kibana. I am using Uipath Orchestrator CE edition which is on cloud and have installed kibana on my local m… --- ## [Grafana colored logs and elasticsearch lucene query](https://discuss.elastic.co/t/grafana-colored-logs-and-elasticsearch-lucene-query/285541)
**Author:** [@AlexG](https://discuss.elastic.co/u/AlexG)\ **Replies:** 1\ **Last updated:** [September 30, 2021, 9:49pm UTC](https://discuss.elastic.co/t/grafana-colored-logs-and-elasticsearch-lucene-query/285541 "2021-09-30T21:49:16Z")
I have colored logs (Ansible logs) in Elasticsearch. Logs are displayed normally (colored) in Grafana. If I execute a lucence query using a Number field, the logs will be displayed in color: But if I execute lucen… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=564) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=566)