# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=568 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 569 --- ## [Creating choropleth maps using only geo locations](https://discuss.elastic.co/t/creating-choropleth-maps-using-only-geo-locations/284995)
**Author:** [@Daniil\_Naumov](https://discuss.elastic.co/u/Daniil_Naumov)\ **Replies:** 4\ **Last updated:** [September 27, 2021, 4:29pm UTC](https://discuss.elastic.co/t/creating-choropleth-maps-using-only-geo-locations/284995 "2021-09-27T16:29:19Z")
How can I visualise requests on choropleth map if I have only location data in logs? --- ## [There is no match between one term and another in the result of a watcher](https://discuss.elastic.co/t/there-is-no-match-between-one-term-and-another-in-the-result-of-a-watcher/285254)
**Author:** [@Juan\_David\_Jaramillo](https://discuss.elastic.co/u/Juan_David_Jaramillo)\ **Replies:** 2\ **Last updated:** [September 27, 2021, 3:53pm UTC](https://discuss.elastic.co/t/there-is-no-match-between-one-term-and-another-in-the-result-of-a-watcher/285254 "2021-09-27T15:53:49Z")
very good day, I have a problem with an alert when I get a result of several terms, i.e. the first term does not match the second, for example. As you can see in the red circle the term "ADUANILLA DE PAIBA" has the … --- ## [Elastic Stack Mapping Error](https://discuss.elastic.co/t/elastic-stack-mapping-error/284871)
**Author:** [@dayajamal](https://discuss.elastic.co/u/dayajamal)\ **Replies:** 9\ **Last updated:** [September 27, 2021, 2:15pm UTC](https://discuss.elastic.co/t/elastic-stack-mapping-error/284871 "2021-09-27T14:15:13Z")
Hello, this my second time posting here with a hope to find a solution this time. I'm working on the Elastic Stack. I'm sending logs from Filebeat through Logstash to Elasticsearch. My logs get structured in Logstash, no… --- ## [Cannot restore snapshot to new single node cluster](https://discuss.elastic.co/t/cannot-restore-snapshot-to-new-single-node-cluster/285025)
**Author:** [@cdalexndr](https://discuss.elastic.co/u/cdalexndr)\ **Replies:** 3\ **Last updated:** [September 27, 2021, 1:14pm UTC](https://discuss.elastic.co/t/cannot-restore-snapshot-to-new-single-node-cluster/285025 "2021-09-27T13:14:58Z")
I've made a snapshot for a single node cluster using default settings: PUT /\_snapshot/backup/%3Csnapshot-%7Bnow%2Fd%7D%3E Created a new single node cluster, and tried to restore it: POST /\_snapshot/backup/snapshot-202… --- ## [Upgrade Elasticsearch from 7.8.1 to 7.14.2](https://discuss.elastic.co/t/upgrade-elasticsearch-from-7-8-1-to-7-14-2/285217)
**Author:** [@Pete\_Watcharawit](https://discuss.elastic.co/u/Pete_Watcharawit)\ **Replies:** 4\ **Last updated:** [September 27, 2021, 10:33am UTC](https://discuss.elastic.co/t/upgrade-elasticsearch-from-7-8-1-to-7-14-2/285217 "2021-09-27T10:33:23Z")
Hello, I am having two issues with the upgrade from 7.8.1 to 7.14.2 I downloaded the tar.gz file for 7.14.2 and launched the Elasticsearch instance by running /bin/Elasticsearch. The instance updates existing indices a… --- ## [Node Stats API in 7.15 broken?](https://discuss.elastic.co/t/node-stats-api-in-7-15-broken/285212)
**Author:** [@oliver](https://discuss.elastic.co/u/oliver)\ **Replies:** 2\ **Last updated:** [September 27, 2021, 10:12am UTC](https://discuss.elastic.co/t/node-stats-api-in-7-15-broken/285212 "2021-09-27T10:12:22Z")
Hello! In #75433 you added a shard count structure to the Node Stats API. That results in a new JSON key named shards. However, if you run the Node Stats API with level=shards, you already have a JSON key named shards. … --- ## [How to update values present in particular field for every docs in index using DSL query](https://discuss.elastic.co/t/how-to-update-values-present-in-particular-field-for-every-docs-in-index-using-dsl-query/284885)
**Author:** [@Divyank\_Mahalle](https://discuss.elastic.co/u/Divyank_Mahalle)\ **Replies:** 1\ **Last updated:** [September 27, 2021, 9:02am UTC](https://discuss.elastic.co/t/how-to-update-values-present-in-particular-field-for-every-docs-in-index-using-dsl-query/284885 "2021-09-27T09:02:57Z")
Hi, I want to update a particular field in the index. Index contains 100 docs. I want to update field "name" with "condition\_system" in every doc where "Condition System" is present. GET part\_ther/\_search { "\_… --- ## [Elasticsearch install on MacOS USB stick fails - java.nio.channels.OverlappingFileLockException](https://discuss.elastic.co/t/elasticsearch-install-on-macos-usb-stick-fails-java-nio-channels-overlappingfilelockexception/285215)
**Author:** [@John\_Lewis](https://discuss.elastic.co/u/John_Lewis)\ **Replies:** 0\ **Last updated:** [September 27, 2021, 9:55am UTC](https://discuss.elastic.co/t/elasticsearch-install-on-macos-usb-stick-fails-java-nio-channels-overlappingfilelockexception/285215 "2021-09-27T09:55:55Z")
Running bin/Elasticsearch on 'tar -xf Elasticsearch-7.15.0-darwin-x86\_64.tar' install fails to start (base) ➜ Samsung\_T5 cd elasticsearch-7.15.0 (base) ➜ elasticsearch-7.15.0 pwd /Volumes/Samsung\_T5/elasticsearch-7.15… --- ## [No shard exception after logstash tries to index large data](https://discuss.elastic.co/t/no-shard-exception-after-logstash-tries-to-index-large-data/285193)
**Author:** [@yash\_chaudhary](https://discuss.elastic.co/u/yash_chaudhary)\ **Replies:** 4\ **Last updated:** [September 27, 2021, 9:43am UTC](https://discuss.elastic.co/t/no-shard-exception-after-logstash-tries-to-index-large-data/285193 "2021-09-27T09:43:49Z")
My goal is to migrate data from psql db to Elasticsearch. I am using jdbc plugin to achieve it. Issue: ES instance is breaking for larger db ( 700k records ) NOTE: For small db ( say 500 records ), it works perfectly … --- ## [Recommanded shards size includes replicas or not?](https://discuss.elastic.co/t/recommanded-shards-size-includes-replicas-or-not/285203)
**Author:** [@Travis](https://discuss.elastic.co/u/Travis)\ **Replies:** 2\ **Last updated:** [September 27, 2021, 9:03am UTC](https://discuss.elastic.co/t/recommanded-shards-size-includes-replicas-or-not/285203 "2021-09-27T09:03:19Z")
Hello, Documentation says : Aim for shard sizes between 10GB and 50GB but does not specifiy if it concerns only primary or primary AND replicas I mean, I have an index of 200GB and wants 1 replica. So total index size… --- ## [Using Transforms and including values which only exist on some events in the source index](https://discuss.elastic.co/t/using-transforms-and-including-values-which-only-exist-on-some-events-in-the-source-index/285067)
**Author:** [@nsouth](https://discuss.elastic.co/u/nsouth)\ **Replies:** 1\ **Last updated:** [September 27, 2021, 8:48am UTC](https://discuss.elastic.co/t/using-transforms-and-including-values-which-only-exist-on-some-events-in-the-source-index/285067 "2021-09-27T08:48:59Z")
Hi, I am trying to use Transforms to create an entity-centric index of my command logs. I need help including data that only appears on some documents. Each "command" is represented by multiple events, correlated by a co… --- ## [Question about grouping to get the total number of filtered buckets in a bucket](https://discuss.elastic.co/t/question-about-grouping-to-get-the-total-number-of-filtered-buckets-in-a-bucket/285183)
**Author:** [@yanglingqiang](https://discuss.elastic.co/u/yanglingqiang)\ **Replies:** 0\ **Last updated:** [September 27, 2021, 3:04am UTC](https://discuss.elastic.co/t/question-about-grouping-to-get-the-total-number-of-filtered-buckets-in-a-bucket/285183 "2021-09-27T03:04:37Z")
this is my source data \[ { "buyer\_id\_std" : 35444337, "seller\_id\_std" : 3587575, "date" : "2021-02-24T00:00:00" }, { "buyer\_id\_std" : 35444337, "seller\_id\_std" : 75848633, "date… --- ## [How to parse a string json type field](https://discuss.elastic.co/t/how-to-parse-a-string-json-type-field/285162)
**Author:** [@Liangliang\_Qiu](https://discuss.elastic.co/u/Liangliang_Qiu)\ **Replies:** 2\ **Last updated:** [September 27, 2021, 2:39am UTC](https://discuss.elastic.co/t/how-to-parse-a-string-json-type-field/285162 "2021-09-27T02:39:01Z")
hi, i have a text type filed(index: false) -- detail , how to parse it into a geo\_shape field? { "took" : 23, "timed\_out" : false, "\_shards" : { "total" : 10, "successful" : 10, "skipped" : 0, "fai… --- ## [Elastic for Appointment Availability](https://discuss.elastic.co/t/elastic-for-appointment-availability/285176)
**Author:** [@updev](https://discuss.elastic.co/u/updev)\ **Replies:** 1\ **Last updated:** [September 27, 2021, 1:47am UTC](https://discuss.elastic.co/t/elastic-for-appointment-availability/285176 "2021-09-27T01:47:03Z")
Hi everyone, I'm in the process of evaluating the best technology stack for an appointment booking system, similar to that of Acuity and Calendly. Does anyone have any experience using ES for this sort of thing? Would… --- ## [Does a node can be at the same time cold\_tier and freeze tier?](https://discuss.elastic.co/t/does-a-node-can-be-at-the-same-time-cold-tier-and-freeze-tier/285097)
**Author:** [@Travis](https://discuss.elastic.co/u/Travis)\ **Replies:** 0\ **Last updated:** [September 24, 2021, 3:58pm UTC](https://discuss.elastic.co/t/does-a-node-can-be-at-the-same-time-cold-tier-and-freeze-tier/285097 "2021-09-24T15:58:16Z")
Hello, Until now (v 7.9.1), I use the following ilm policy : Day 1 = hot Day 30 = cold + freeze Day 60 = delete With the recent releases (v 7.14), I noticed the introduction of data tiers, and also a new phase : the… --- ## [It is a good idea to implement Ha Proxy in front of Elasticsearch 7?](https://discuss.elastic.co/t/it-is-a-good-idea-to-implement-ha-proxy-in-front-of-elasticsearch-7/285133)
**Author:** [@jeanpl](https://discuss.elastic.co/u/jeanpl)\ **Replies:** 1\ **Last updated:** [September 27, 2021, 12:03am UTC](https://discuss.elastic.co/t/it-is-a-good-idea-to-implement-ha-proxy-in-front-of-elasticsearch-7/285133 "2021-09-27T00:03:36Z")
From my understanding, adding HaProxy on top of Elasticsearch might bring some High Availability, and Load Balancing. Moreover, it is also possible to communicate a single entry point URL (the Ha Proxy host endpoint), fo… --- ## [Curl call for PUT and GET query on multi-node es cluster](https://discuss.elastic.co/t/curl-call-for-put-and-get-query-on-multi-node-es-cluster/284942)
**Author:** [@prat](https://discuss.elastic.co/u/prat)\ **Replies:** 7\ **Last updated:** [September 27, 2021, 12:01am UTC](https://discuss.elastic.co/t/curl-call-for-put-and-get-query-on-multi-node-es-cluster/284942 "2021-09-27T00:01:40Z")
Hi Team, I would like to know on a multi-node Elasticsearch cluster (3 nodes), to which node we can send PUT curl call (say for creating ILM policy) or to fetch some results (by running query)? In a single node cluste… --- ## [Weird rebalancing strategy](https://discuss.elastic.co/t/weird-rebalancing-strategy/285034)
**Author:** [@linkerc](https://discuss.elastic.co/u/linkerc)\ **Replies:** 3\ **Last updated:** [September 25, 2021, 9:25pm UTC](https://discuss.elastic.co/t/weird-rebalancing-strategy/285034 "2021-09-25T21:25:17Z")
I am seeing several active recovery tasks where 1 shard is moving from Node A -\> Node B, but at the same time for a different shard, it's moving from Node C to Node A. Wouldn't this cause rebalancing to never end? Why… --- ## [Elastic platinum + gold subscription](https://discuss.elastic.co/t/elastic-platinum-gold-subscription/285059)
**Author:** [@Faycal\_B](https://discuss.elastic.co/u/Faycal_B)\ **Replies:** 3\ **Last updated:** [September 26, 2021, 5:53pm UTC](https://discuss.elastic.co/t/elastic-platinum-gold-subscription/285059 "2021-09-26T17:53:15Z")
Hi, Is it possible to have multiple clusters, platinum license cluster, and free gold license clusters in the same solution destined to be used as a SaaS (commercial) ? with the recent license changes, I am not sure if… --- ## [Runtime Fields](https://discuss.elastic.co/t/runtime-fields/285142)
**Author:** [@Swapnadeep\_Mondal](https://discuss.elastic.co/u/Swapnadeep_Mondal)\ **Replies:** 4\ **Last updated:** [September 26, 2021, 4:27pm UTC](https://discuss.elastic.co/t/runtime-fields/285142 "2021-09-26T16:27:01Z")
According to documentation runtime fields are not indexed. Now if one field is not indexed then it will not searchable or queryable. but then I query on a runtime field it returned me results instead showing "Cannot sear… --- ## [Geoip error while deploying elasticsearch](https://discuss.elastic.co/t/geoip-error-while-deploying-elasticsearch/284080)
**Author:** [@ssen85](https://discuss.elastic.co/u/ssen85)\ **Replies:** 10\ **Last updated:** [September 26, 2021, 6:34am UTC](https://discuss.elastic.co/t/geoip-error-while-deploying-elasticsearch/284080 "2021-09-26T06:34:04Z")
Hi, I'm trying to start a single node elasticsearch cluster using Docker. I get the following error in the startup logs "type": "server", "timestamp": "2021-09-13T13:41:29,255Z", "level": "ERROR", "component": "o.e.i.… --- ## [GET \_doc request not working as expected with routing aliases](https://discuss.elastic.co/t/get-doc-request-not-working-as-expected-with-routing-aliases/285039)
**Author:** [@vineethsuhas](https://discuss.elastic.co/u/vineethsuhas)\ **Replies:** 3\ **Last updated:** [September 26, 2021, 3:55am UTC](https://discuss.elastic.co/t/get-doc-request-not-working-as-expected-with-routing-aliases/285039 "2021-09-26T03:55:28Z")
Hi, Here is the scenario: 1. We created an index (routing\_test) =\> (with 2 Shards) 2. We created a couple of aliases on that index (routing\_test\_100 and routing\_test\_200) using: PUT routing\_test/\_alias/routing\_test\_100… --- ## [Elasticsearch cluster architecture with 6 nodes](https://discuss.elastic.co/t/elasticsearch-cluster-architecture-with-6-nodes/285147)
**Author:** [@dooger21](https://discuss.elastic.co/u/dooger21)\ **Replies:** 1\ **Last updated:** [September 26, 2021, 3:43am UTC](https://discuss.elastic.co/t/elasticsearch-cluster-architecture-with-6-nodes/285147 "2021-09-26T03:43:58Z")
Hi everyone, Please I need your recommendations regarding the following architectures for a 6-node Elasticsearch cluster, based on the following characteristics: I have 2 zones (zn1, zn2) I have 3 nodes or servers in … --- ## [Obtaining each field score in the same document](https://discuss.elastic.co/t/obtaining-each-field-score-in-the-same-document/285132)
**Author:** [@ahmadnabil](https://discuss.elastic.co/u/ahmadnabil)\ **Replies:** 0\ **Last updated:** [September 25, 2021, 12:22pm UTC](https://discuss.elastic.co/t/obtaining-each-field-score-in-the-same-document/285132 "2021-09-25T12:22:22Z")
Assuming I have a document with three fields: name, company, email each one mapped with edge-ngram { "name": "John", "company": "John's company", "email": "johndoe@gmail.com" } When searching for "john" I want … --- ## [Terms query without sort](https://discuss.elastic.co/t/terms-query-without-sort/285126)
**Author:** [@sathiez](https://discuss.elastic.co/u/sathiez)\ **Replies:** 1\ **Last updated:** [September 25, 2021, 7:54am UTC](https://discuss.elastic.co/t/terms-query-without-sort/285126 "2021-09-25T07:54:52Z")
My document: { "\_index": "comb\_index", "\_type": "\_doc", "\_id": "i\_ZFO3sB\_48g2JrGjt9P", "\_version": 2, "\_seq\_no": 5057859, "\_primary\_term": 1, "found": true, "\_source": { "row": "54,9658", "value": 1481985587… --- ## [Error with elasricsearch](https://discuss.elastic.co/t/error-with-elasricsearch/285113)
**Author:** [@ahaashoor](https://discuss.elastic.co/u/ahaashoor)\ **Replies:** 1\ **Last updated:** [September 25, 2021, 6:16am UTC](https://discuss.elastic.co/t/error-with-elasricsearch/285113 "2021-09-25T06:16:42Z")
i run this line sudo -i service elasticsearch start i got this error Job for elasticsearch.service failed because a fatal signal was delivered to the control process. See "systemctl status elasticsearch.service" and "… --- ## [(Watcher) send emails separately via a single alert](https://discuss.elastic.co/t/watcher-send-emails-separately-via-a-single-alert/284113)
**Author:** [@Dovan](https://discuss.elastic.co/u/Dovan)\ **Replies:** 3\ **Last updated:** [September 24, 2021, 8:44pm UTC](https://discuss.elastic.co/t/watcher-send-emails-separately-via-a-single-alert/284113 "2021-09-24T20:44:32Z")
is there any way the emails are sent separately for each alert notification in the watcher? as we received several alerts on our team, we preferred that they come separately. --- ## [Match\_bool\_prefix query acts different than Prefix query when searching on a single token](https://discuss.elastic.co/t/match-bool-prefix-query-acts-different-than-prefix-query-when-searching-on-a-single-token/285105)
**Author:** [@Mike\_M1](https://discuss.elastic.co/u/Mike_M1)\ **Replies:** 0\ **Last updated:** [September 24, 2021, 5:45pm UTC](https://discuss.elastic.co/t/match-bool-prefix-query-acts-different-than-prefix-query-when-searching-on-a-single-token/285105 "2021-09-24T17:45:31Z")
Having an issue with match\_bool\_prefix behaving weirdly when having an ampersand at the end of a one token query. According to docs, it should build out a term query with a prefix at the end. However, it does that fine e… --- ## [ELK sentiment classification](https://discuss.elastic.co/t/elk-sentiment-classification/285099)
**Author:** [@byul](https://discuss.elastic.co/u/byul)\ **Replies:** 0\ **Last updated:** [September 24, 2021, 4:15pm UTC](https://discuss.elastic.co/t/elk-sentiment-classification/285099 "2021-09-24T16:15:54Z")
Hello everybody, I got this technical test from an employer, it is about using ELK an integrate a sentiment classification service in it. Here are the questions: install ELK (I have already done it in a virtual machine… --- ## [FSCrawler - Best approach to load massive amount of document](https://discuss.elastic.co/t/fscrawler-best-approach-to-load-massive-amount-of-document/284900)
**Author:** [@classless\_oak](https://discuss.elastic.co/u/classless_oak)\ **Replies:** 2\ **Last updated:** [September 24, 2021, 2:25pm UTC](https://discuss.elastic.co/t/fscrawler-best-approach-to-load-massive-amount-of-document/284900 "2021-09-24T14:25:57Z")
Hello, I am trying to come up with a solution to load massive amount of documents (xlx, xlsx, doc, xml, txt, pdf, etd.) 30+ terabytes into Elastic. I have spun up the stack with the FSCrawler and have been adding docume… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=567) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=569)