# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=567 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 568 --- ## [ELK security 401](https://discuss.elastic.co/t/elk-security-401/285424)
**Author:** [@gmhafiz](https://discuss.elastic.co/u/gmhafiz)\ **Replies:** 2\ **Last updated:** [September 29, 2021, 6:04am UTC](https://discuss.elastic.co/t/elk-security-401/285424 "2021-09-29T06:04:36Z")
I wanted to try out Alerting in Kibana so security needs to be enabled. However, both logstash and kibana isn't able to log into Elasticsearch ELK version: 7.10.1 docker-compose.log.yml version: '3.4' services: el… --- ## [Installing elasticsearch 7.12 , facing java.security.cert.CertificateException error while setting password/installation](https://discuss.elastic.co/t/installing-elasticsearch-7-12-facing-java-security-cert-certificateexception-error-while-setting-password-installation/285062)
**Author:** [@Neha\_goswami](https://discuss.elastic.co/u/Neha_goswami)\ **Replies:** 1\ **Last updated:** [September 29, 2021, 1:24am UTC](https://discuss.elastic.co/t/installing-elasticsearch-7-12-facing-java-security-cert-certificateexception-error-while-setting-password-installation/285062 "2021-09-29T01:24:00Z")
I am setting Elasticsearch 7.12 cluster for the first time and i see below errors: There seems to be some xpack setup issue: \`$ bin/Elasticsearch-setup-passwords interactive warning: usage of JAVA\_HOME is deprecated, … --- ## [How can I disable authentication in Elasticsearch](https://discuss.elastic.co/t/how-can-i-disable-authentication-in-elasticsearch/285418)
**Author:** [@zhaoyi0113](https://discuss.elastic.co/u/zhaoyi0113)\ **Replies:** 2\ **Last updated:** [September 28, 2021, 11:04pm UTC](https://discuss.elastic.co/t/how-can-i-disable-authentication-in-elasticsearch/285418 "2021-09-28T23:04:50Z")
I am running Elasticsearch 7.14.0 and want to disable authentication completely. I set this settings: xpack.security.http.ssl.enabled: false xpack.security.transport.ssl.enabled: false xpack.security.enabled… --- ## [Use multiple analyzers by field on query](https://discuss.elastic.co/t/use-multiple-analyzers-by-field-on-query/285396)
**Author:** [@oskrdt](https://discuss.elastic.co/u/oskrdt)\ **Replies:** 5\ **Last updated:** [September 28, 2021, 10:48pm UTC](https://discuss.elastic.co/t/use-multiple-analyzers-by-field-on-query/285396 "2021-09-28T22:48:16Z")
I want to do a multi\_match query for 3 different fields, but I want 2 of those fields (indexed as text using standard analyzer) to use the english language analyzer and the 3rd one to use the standard analyzer. I want to… --- ## [Shard Relocation||ES expansion](https://discuss.elastic.co/t/shard-relocation-es-expansion/285336)
**Author:** [@Murali\_Thumalapalli](https://discuss.elastic.co/u/Murali_Thumalapalli)\ **Replies:** 3\ **Last updated:** [September 28, 2021, 10:23pm UTC](https://discuss.elastic.co/t/shard-relocation-es-expansion/285336 "2021-09-28T22:23:39Z")
Hi Team, Can someone guide us on this. How to find out the default retention for ES cluster for indices. also how to check the default on what basis the shards relocation happens. is it like cluster tries to bring the… --- ## [How to proper use wildcard certs ELK Stack?](https://discuss.elastic.co/t/how-to-proper-use-wildcard-certs-elk-stack/285401)
**Author:** [@francescouk](https://discuss.elastic.co/u/francescouk)\ **Replies:** 0\ **Last updated:** [September 28, 2021, 6:58pm UTC](https://discuss.elastic.co/t/how-to-proper-use-wildcard-certs-elk-stack/285401 "2021-09-28T18:58:41Z")
Hi there, I got this \*.domain wildcard and I wanted to use on the elk servers but I could not find a proper way to configure. Which certs do I need??? .pem ??? .pfx???? Can anyone help me on that? Really appreciate fo… --- ## [Order by length of array properties](https://discuss.elastic.co/t/order-by-length-of-array-properties/285393)
**Author:** [@juancruzdev](https://discuss.elastic.co/u/juancruzdev)\ **Replies:** 0\ **Last updated:** [September 28, 2021, 4:52pm UTC](https://discuss.elastic.co/t/order-by-length-of-array-properties/285393 "2021-09-28T16:52:43Z")
i have an index with objects and an array called "reviews" that inside has properties called positive\_comment, negative\_comment, reviewer\_name and more. There are some reviews that have the field positive\_comment empty … --- ## [Elasticsearch don't remove old shards](https://discuss.elastic.co/t/elasticsearch-dont-remove-old-shards/284272)
**Author:** [@09a9373743777d8430c4](https://discuss.elastic.co/u/09a9373743777d8430c4)\ **Replies:** 8\ **Last updated:** [September 28, 2021, 3:20pm UTC](https://discuss.elastic.co/t/elasticsearch-dont-remove-old-shards/284272 "2021-09-28T15:20:56Z")
Hi. This week after \_forcemerge?only\_expunge\_deletes=true I saw an increase in disk space usage (# 1 in the picture), after that I tried to reduce the number of replicas from 2 to 1 (# 2 in the picture), and also notice… --- ## [How can I define a runtime field which shows the time elapsed since the value of a date field](https://discuss.elastic.co/t/how-can-i-define-a-runtime-field-which-shows-the-time-elapsed-since-the-value-of-a-date-field/285339)
**Author:** [@nsouth](https://discuss.elastic.co/u/nsouth)\ **Replies:** 2\ **Last updated:** [September 28, 2021, 2:35pm UTC](https://discuss.elastic.co/t/how-can-i-define-a-runtime-field-which-shows-the-time-elapsed-since-the-value-of-a-date-field/285339 "2021-09-28T14:35:59Z")
I have an index and I want a field called durationv2. If the field command\_details.endTime exists, I want durationv2 to be the difference between command\_details.startTime and command\_details.endTime. Otherwise, I want i… --- ## [ILM - Alias inheritance](https://discuss.elastic.co/t/ilm-alias-inheritance/285058)
**Author:** [@ORich](https://discuss.elastic.co/u/ORich)\ **Replies:** 2\ **Last updated:** [September 28, 2021, 2:19pm UTC](https://discuss.elastic.co/t/ilm-alias-inheritance/285058 "2021-09-28T14:19:21Z")
Dear experts, here is my ILM managed mongodb index in hot lifecycle phase { "fbeat-7.10.2-mongodb-2021.08.23-000009" : { "aliases" : { "fbeat-7.10.2-mongodb" : { "is\_write\_index" : true }, … --- ## [Shrink ES Cluster size from 3 to 1 in ES 7.62](https://discuss.elastic.co/t/shrink-es-cluster-size-from-3-to-1-in-es-7-62/285369)
**Author:** [@hello5346](https://discuss.elastic.co/u/hello5346)\ **Replies:** 0\ **Last updated:** [September 28, 2021, 2:03pm UTC](https://discuss.elastic.co/t/shrink-es-cluster-size-from-3-to-1-in-es-7-62/285369 "2021-09-28T14:03:33Z")
We are Running an Elasticsearch cluster with 3 nodes and we want to downsize the current cluster to run with only 1 node. my cluster configs look like this. node.master and node.data is true on all 3 nodes and cluster… --- ## [Get an CORS error When requested elastic search rest API](https://discuss.elastic.co/t/get-an-cors-error-when-requested-elastic-search-rest-api/285331)
**Author:** [@MB\_KING](https://discuss.elastic.co/u/MB_KING)\ **Replies:** 2\ **Last updated:** [September 28, 2021, 1:11pm UTC](https://discuss.elastic.co/t/get-an-cors-error-when-requested-elastic-search-rest-api/285331 "2021-09-28T13:11:37Z")
hi Im working on React Project and using Axios package for requested Elasticsearch rest API . after call I receive CORS error how can fix this error and get data ? error : Access to XMLHttpRequest at '\ **Author:** [@yukai](https://discuss.elastic.co/u/yukai)\ **Replies:** 3\ **Last updated:** [September 28, 2021, 12:18pm UTC](https://discuss.elastic.co/t/node-query-cache-with-keyword/285314 "2021-09-28T12:18:23Z") For search performance, changing field type of integer/long to keywords for term querys might increase search speed. However, I recently found that doing this change would no longer getting benefit from node query cach… --- ## [Creating an ILM policy using python](https://discuss.elastic.co/t/creating-an-ilm-policy-using-python/285340)
**Author:** [@saurab](https://discuss.elastic.co/u/saurab)\ **Replies:** 2\ **Last updated:** [September 28, 2021, 11:53am UTC](https://discuss.elastic.co/t/creating-an-ilm-policy-using-python/285340 "2021-09-28T11:53:03Z")
I have been trying to create an ILM policy using the python client. But I get an error when running the python script. This is my code: from datetime import datetime from elasticsearch import Elasticsearch from elastic… --- ## [Kuromoji analyzer filters out text in Arabic](https://discuss.elastic.co/t/kuromoji-analyzer-filters-out-text-in-arabic/285350)
**Author:** [@anatoly21](https://discuss.elastic.co/u/anatoly21)\ **Replies:** 0\ **Last updated:** [September 28, 2021, 11:51am UTC](https://discuss.elastic.co/t/kuromoji-analyzer-filters-out-text-in-arabic/285350 "2021-09-28T11:51:34Z")
We have faced the issue with indexing and searching multilanguage Japanese/Arabic documents using kuromoji analyzer. The problem is that the analyzer filters out all tokens in Arabic, while tokens in other scripts are p… --- ## [Can Transforms output to a log index such that events can be streamed?](https://discuss.elastic.co/t/can-transforms-output-to-a-log-index-such-that-events-can-be-streamed/285337)
**Author:** [@nsouth](https://discuss.elastic.co/u/nsouth)\ **Replies:** 1\ **Last updated:** [September 28, 2021, 11:40am UTC](https://discuss.elastic.co/t/can-transforms-output-to-a-log-index-such-that-events-can-be-streamed/285337 "2021-09-28T11:40:59Z")
I recently wrote a Transform to aggregate my log events (see previous post if curious). I would like to be able to stream the results of this transform using the Observability \> Logs \> Stream feature. However, if I try t… --- ## [Configure Elasticsearch to use SSO by OIDC - Groups claim is not mapped correctly](https://discuss.elastic.co/t/configure-elasticsearch-to-use-sso-by-oidc-groups-claim-is-not-mapped-correctly/285134)
**Author:** [@Ismaeel\_Enjreny](https://discuss.elastic.co/u/Ismaeel_Enjreny)\ **Replies:** 2\ **Last updated:** [September 28, 2021, 10:51am UTC](https://discuss.elastic.co/t/configure-elasticsearch-to-use-sso-by-oidc-groups-claim-is-not-mapped-correctly/285134 "2021-09-28T10:51:49Z")
We are trying to configure Elasticsearch so uses can login using SSO feature based on oidc protocol, everything is working fine till we tried to map claims.groups. The Identity Provider send groups as JSON array but it … --- ## [What's the difference between terms and term(with bool should)?](https://discuss.elastic.co/t/whats-the-difference-between-terms-and-term-with-bool-should/285186)
**Author:** [@yeziblo](https://discuss.elastic.co/u/yeziblo)\ **Replies:** 4\ **Last updated:** [September 28, 2021, 8:50am UTC](https://discuss.elastic.co/t/whats-the-difference-between-terms-and-term-with-bool-should/285186 "2021-09-28T08:50:24Z")
I've always wondered, for example, about the following statements. A: { "bool": { "should": \[ { "term": { "userType": { "value": 0 } } }, { "term": { "userType": { "value": 1 } } }, { "term": { "use… --- ## [How to delete logs from elasticsearch automatically](https://discuss.elastic.co/t/how-to-delete-logs-from-elasticsearch-automatically/284078)
**Author:** [@SRIGURU\_VEL](https://discuss.elastic.co/u/SRIGURU_VEL)\ **Replies:** 4\ **Last updated:** [September 28, 2021, 6:58am UTC](https://discuss.elastic.co/t/how-to-delete-logs-from-elasticsearch-automatically/284078 "2021-09-28T06:58:45Z")
HI Experts, We are using Elasticsearch 7.9 . We need to purge automatically the logs that we persist in Elasticsearch index based on a frequency/date I need a proper guide for that. thanks, Sriguruvel. --- ## [Async delete by query in elastic search spawns never ending tasks](https://discuss.elastic.co/t/async-delete-by-query-in-elastic-search-spawns-never-ending-tasks/285226)
**Author:** [@ThijsBM](https://discuss.elastic.co/u/ThijsBM)\ **Replies:** 4\ **Last updated:** [September 28, 2021, 7:09am UTC](https://discuss.elastic.co/t/async-delete-by-query-in-elastic-search-spawns-never-ending-tasks/285226 "2021-09-28T07:09:11Z")
We have a lot of data in our index that is tagged by an ownerId which resembles a customer. Every customer has the ability to define its own retention period. After the retention period is passed all the documents that a… --- ## [Why the thread\_pool.bulk.size must be \<= 17](https://discuss.elastic.co/t/why-the-thread-pool-bulk-size-must-be-17/285315)
**Author:** [@dzw-tw](https://discuss.elastic.co/u/dzw-tw)\ **Replies:** 1\ **Last updated:** [September 28, 2021, 7:05am UTC](https://discuss.elastic.co/t/why-the-thread-pool-bulk-size-must-be-17/285315 "2021-09-28T07:05:58Z")
--- ## [Loop through "source": "\['message': ctx.payload.hits.hits.0.\_source \]",](https://discuss.elastic.co/t/loop-through-source-message-ctx-payload-hits-hits-0-source/285317)
**Author:** [@dilshanviso](https://discuss.elastic.co/u/dilshanviso)\ **Replies:** 0\ **Last updated:** [September 28, 2021, 7:02am UTC](https://discuss.elastic.co/t/loop-through-source-message-ctx-payload-hits-hits-0-source/285317 "2021-09-28T07:02:00Z")
Hi, Attached herewith is my watcher script to ingest all hits into an index and email action every hit. Currently I am able to do that to only for the first result/first hit using the following piece of code ""transfo… --- ## [Timestamp is wrong](https://discuss.elastic.co/t/timestamp-is-wrong/285310)
**Author:** [@cjw0202](https://discuss.elastic.co/u/cjw0202)\ **Replies:** 1\ **Last updated:** [September 28, 2021, 6:52am UTC](https://discuss.elastic.co/t/timestamp-is-wrong/285310 "2021-09-28T06:52:59Z")
ES 7.4 i use my custom timestamp, but the response timestamp is started at 1970 mapping: { "properties": { "hostName": { "type": "text", "fields": { "keyword": { "ignore\_above": … --- ## [Help sending emails separately with only one watcher running (using forearch)](https://discuss.elastic.co/t/help-sending-emails-separately-with-only-one-watcher-running-using-forearch/285296)
**Author:** [@RaonyO](https://discuss.elastic.co/u/RaonyO)\ **Replies:** 0\ **Last updated:** [September 28, 2021, 2:01am UTC](https://discuss.elastic.co/t/help-sending-emails-separately-with-only-one-watcher-running-using-forearch/285296 "2021-09-28T02:01:49Z")
I need help in the structure of my watcher, I'm trying to create an alert where a notification is sent by email, but the notifications are going in message form (in the same initial email) and when it reaches 100, it's c… --- ## [Decommissioning a node using cluster.routing.allocation.exclude.\_name](https://discuss.elastic.co/t/decommissioning-a-node-using-cluster-routing-allocation-exclude-name/284946)
**Author:** [@linkerc](https://discuss.elastic.co/u/linkerc)\ **Replies:** 2\ **Last updated:** [September 28, 2021, 12:16am UTC](https://discuss.elastic.co/t/decommissioning-a-node-using-cluster-routing-allocation-exclude-name/284946 "2021-09-28T00:16:27Z")
Why doesn't the primary shard switched away from the node being decommissioned? When I use cluster.routing.allocation.exclude.\_name to exclude a node from participating the cluster (and be removed eventually), I noticed… --- ## [SLM not starting](https://discuss.elastic.co/t/slm-not-starting/285231)
**Author:** [@dazevedo](https://discuss.elastic.co/u/dazevedo)\ **Replies:** 9\ **Last updated:** [September 27, 2021, 9:13pm UTC](https://discuss.elastic.co/t/slm-not-starting/285231 "2021-09-27T21:13:16Z")
good morning, I'm trying to configure my slm policies to automatically snapshot in my nfs repository of a NetApp storage, but I'm not able to activate the policy because it says that my \_slm index was not started... Any… --- ## [Kibana scripted field: doc\['some\_field'\] doesnt work when the field has a lot of data](https://discuss.elastic.co/t/kibana-scripted-field-doc-some-field-doesnt-work-when-the-field-has-a-lot-of-data/285106)
**Author:** [@Felipsz](https://discuss.elastic.co/u/Felipsz)\ **Replies:** 3\ **Last updated:** [September 27, 2021, 5:31pm UTC](https://discuss.elastic.co/t/kibana-scripted-field-doc-some-field-doesnt-work-when-the-field-has-a-lot-of-data/285106 "2021-09-27T17:31:06Z")
Hi everyone, Im creating some scripted fields to improve the visualization of the data that comes into Kibana 7.5. I have a big field that its a JSON, and it has a lot of data, and i want to separate this data in multi… --- ## [Enable xpack on a running Elastic cluster](https://discuss.elastic.co/t/enable-xpack-on-a-running-elastic-cluster/284671)
**Author:** [@ls4074](https://discuss.elastic.co/u/ls4074)\ **Replies:** 9\ **Last updated:** [September 27, 2021, 5:28pm UTC](https://discuss.elastic.co/t/enable-xpack-on-a-running-elastic-cluster/284671 "2021-09-27T17:28:59Z")
I deployed Elastic using helm chart (7.13) without xpack enabled. The ES and Kibana pods are running fine. I logged in to one of the master pods and ran the command "Elasticsearch-certutil" to generate the certs and the… --- ## [ElasticSearch crashing - Magento 2.4.3](https://discuss.elastic.co/t/elasticsearch-crashing-magento-2-4-3/284228)
**Author:** [@pmono](https://discuss.elastic.co/u/pmono)\ **Replies:** 24\ **Last updated:** [September 27, 2021, 4:42pm UTC](https://discuss.elastic.co/t/elasticsearch-crashing-magento-2-4-3/284228 "2021-09-27T16:42:39Z")
We're having issues with Elasticsearch crashing from time to time. It also sometimes spikes up RAM + CPU and server becomes unresponsive. We have left most of the settings as is, but had to add more RAM to JVM heap (48G… --- ## [How to migrate data from db oracle to ES use Logstash?](https://discuss.elastic.co/t/how-to-migrate-data-from-db-oracle-to-es-use-logstash/285248)
**Author:** [@NinhNM](https://discuss.elastic.co/u/NinhNM)\ **Replies:** 1\ **Last updated:** [September 27, 2021, 4:37pm UTC](https://discuss.elastic.co/t/how-to-migrate-data-from-db-oracle-to-es-use-logstash/285248 "2021-09-27T16:37:28Z")
I have around 1 millions record in db oracle and I want migrate to ES. Logstash: input { jdbc { jdbc\_driver\_library =\> "/Users/ninhnguyen/Desktop/ojdbc7.jar" jdbc\_driver\_class =\> "Java::oracle.jdbc.driver.Ora… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=566) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=568)