# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=569 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 570 --- ## [\_search field added to mappings long before installing plugins](https://discuss.elastic.co/t/search-field-added-to-mappings-long-before-installing-plugins/284867)
**Author:** [@BogdanD](https://discuss.elastic.co/u/BogdanD)\ **Replies:** 2\ **Last updated:** [September 24, 2021, 2:25pm UTC](https://discuss.elastic.co/t/search-field-added-to-mappings-long-before-installing-plugins/284867 "2021-09-24T14:25:45Z")
Hi all, I'm having an issue with setting up the mapper-size plugin, specifically: I have an ES instance that I've been upgrading since 6.x, now at 7.14. My mappings for my indices have always included: "\_size": { "en… --- ## [What is the best way to classify data?](https://discuss.elastic.co/t/what-is-the-best-way-to-classify-data/285076)
**Author:** [@wifi](https://discuss.elastic.co/u/wifi)\ **Replies:** 0\ **Last updated:** [September 24, 2021, 11:44am UTC](https://discuss.elastic.co/t/what-is-the-best-way-to-classify-data/285076 "2021-09-24T11:44:25Z")
I have data that originates from three sources and thus saved in a separate index each. metricbeat manual data: manually ingested data app data: data ingested by an app The documents in each index have different field… --- ## [Getting Error while installing checkstyle on IntelliJ](https://discuss.elastic.co/t/getting-error-while-installing-checkstyle-on-intellij/285074)
**Author:** [@Ankur\_Jain](https://discuss.elastic.co/u/Ankur_Jain)\ **Replies:** 0\ **Last updated:** [September 24, 2021, 11:16am UTC](https://discuss.elastic.co/t/getting-error-while-installing-checkstyle-on-intellij/285074 "2021-09-24T11:16:49Z")
Hi Team, I have cloned elasticsearch project on my local and getting below error while installing checkstyle. Could not determine the dependencies of task ':buildDependencyArtifacts'. Task with path ':plugins:reposit… --- ## [My bucket-script-based Transform is not showing the aggregation fields in the destination index](https://discuss.elastic.co/t/my-bucket-script-based-transform-is-not-showing-the-aggregation-fields-in-the-destination-index/284992)
**Author:** [@nsouth](https://discuss.elastic.co/u/nsouth)\ **Replies:** 2\ **Last updated:** [September 24, 2021, 10:33am UTC](https://discuss.elastic.co/t/my-bucket-script-based-transform-is-not-showing-the-aggregation-fields-in-the-destination-index/284992 "2021-09-24T10:33:12Z")
Hi, I'm trying to make my first transform and I'm not getting the results I expect. My source has multiple events correlated by a command\_unique\_id and I want to find the duration of these events by getting the timestam… --- ## [Elastic search 7.13 found vulnerable in Twistlock report](https://discuss.elastic.co/t/elastic-search-7-13-found-vulnerable-in-twistlock-report/285050)
**Author:** [@Shraddha2](https://discuss.elastic.co/u/Shraddha2)\ **Replies:** 3\ **Last updated:** [September 24, 2021, 10:14am UTC](https://discuss.elastic.co/t/elastic-search-7-13-found-vulnerable-in-twistlock-report/285050 "2021-09-24T10:14:51Z")
We are using Elastic search 7.13 version and in recent twist lock vulnerability scan this jar reported for 2 High vulnerabilities. CVE-2020-25649 CVE-2020-28491 com.fasterxml.jackson.core\_jackson-databind - 2.10.4 A … --- ## [How to run elasticsearch when installed from source?](https://discuss.elastic.co/t/how-to-run-elasticsearch-when-installed-from-source/285047)
**Author:** [@Rahmat\_Agung\_W](https://discuss.elastic.co/u/Rahmat_Agung_W)\ **Replies:** 3\ **Last updated:** [September 24, 2021, 7:19am UTC](https://discuss.elastic.co/t/how-to-run-elasticsearch-when-installed-from-source/285047 "2021-09-24T07:19:04Z")
Hi, so I want to install Elasticsearch from archieve (Install Elasticsearch from archive on Linux or MacOS | Elasticsearch Guide \[7.15\] | Elastic). Why? Because I need to install them on custom path (by default Elasticse… --- ## [Unable to retrieve more 10k records from elastic search using rest api](https://discuss.elastic.co/t/unable-to-retrieve-more-10k-records-from-elastic-search-using-rest-api/285051)
**Author:** [@Magesh\_02](https://discuss.elastic.co/u/Magesh_02)\ **Replies:** 3\ **Last updated:** [September 24, 2021, 7:11am UTC](https://discuss.elastic.co/t/unable-to-retrieve-more-10k-records-from-elastic-search-using-rest-api/285051 "2021-09-24T07:11:50Z")
I'm trying to get more than 10k records from an Elasticsearch using the Rest api (http://localhost:9200/json-metrics/\_search), but all I have is the rest api link, which is the input to my BI tool. I need those records i… --- ## [Slow response times query first couple of times](https://discuss.elastic.co/t/slow-response-times-query-first-couple-of-times/285018)
**Author:** [@Mark\_Schenk](https://discuss.elastic.co/u/Mark_Schenk)\ **Replies:** 2\ **Last updated:** [September 24, 2021, 4:37am UTC](https://discuss.elastic.co/t/slow-response-times-query-first-couple-of-times/285018 "2021-09-24T04:37:59Z")
We have a service which is using ES sporadically, (once every few hours). We noted that the first couple of times we query ES takes a lot longer than subsequent calls. For example if we perform the following query: { … --- ## [How to get ctx.payload from Visualize Data Table ( nested aggregations )](https://discuss.elastic.co/t/how-to-get-ctx-payload-from-visualize-data-table-nested-aggregations/283836)
**Author:** [@hanase](https://discuss.elastic.co/u/hanase)\ **Replies:** 5\ **Last updated:** [September 24, 2021, 3:41am UTC](https://discuss.elastic.co/t/how-to-get-ctx-payload-from-visualize-data-table-nested-aggregations/283836 "2021-09-24T03:41:36Z")
Hi elastic community, I create a Visualize Data Table to filter some data, and got response what I expect. then I try to use watcher send alert message when buckets doc\_count greater then a value. what is the correc… --- ## [No processor type exists with name \[attachment\]](https://discuss.elastic.co/t/no-processor-type-exists-with-name-attachment/285013)
**Author:** [@Jihad\_Abdulrazaq](https://discuss.elastic.co/u/Jihad_Abdulrazaq)\ **Replies:** 9\ **Last updated:** [September 24, 2021, 1:45am UTC](https://discuss.elastic.co/t/no-processor-type-exists-with-name-attachment/285013 "2021-09-24T01:45:31Z")
Hello Dears, I am getting below error, while trying to ingest pdf file: “No processor type exists with name \[attachment\]" $params = \[ 'id' =\> 'attachment', 'body' =\> \[ … --- ## [Completion suggester index - What's loaded in heap?](https://discuss.elastic.co/t/completion-suggester-index-whats-loaded-in-heap/285041)
**Author:** [@mattkallo](https://discuss.elastic.co/u/mattkallo)\ **Replies:** 0\ **Last updated:** [September 24, 2021, 12:52am UTC](https://discuss.elastic.co/t/completion-suggester-index-whats-loaded-in-heap/285041 "2021-09-24T00:52:39Z")
I have an index with 20+ fields and the same index has one suggester/completion field. As I understand, completion suggester is loaded into heap for faster response times. My question is - does all the fields in the in… --- ## [What does this exception mean?](https://discuss.elastic.co/t/what-does-this-exception-mean/285024)
**Author:** [@linkerc](https://discuss.elastic.co/u/linkerc)\ **Replies:** 1\ **Last updated:** [September 23, 2021, 9:16pm UTC](https://discuss.elastic.co/t/what-does-this-exception-mean/285024 "2021-09-23T21:16:35Z")
at java.lang.Thread.run(Thread.java:835) ~\[?:?\] at org.elasticsearch.transport.InboundHandler$1.doRun(InboundHandler.java:224) ~\[elasticsearch-7.3.1.jar:7.3.1\] at org.elasticsearch.common.util.concurrent… --- ## [Disallow memory-mapping](https://discuss.elastic.co/t/disallow-memory-mapping/284770)
**Author:** [@Gotze\_des\_Pobels](https://discuss.elastic.co/u/Gotze_des_Pobels)\ **Replies:** 1\ **Last updated:** [September 23, 2021, 9:00pm UTC](https://discuss.elastic.co/t/disallow-memory-mapping/284770 "2021-09-23T21:00:16Z")
Are there any disadvantages of setting node.store.allow\_mmap=false ? I'm trying to run 3 nodes via docker-compose on a openVZ machine and cant increase max\_map\_count from 65536 to 262144. What is the worst that could… --- ## [ES 7.8 often giving errors "Data too large for http\_request", but some evidence makes no sense](https://discuss.elastic.co/t/es-7-8-often-giving-errors-data-too-large-for-http-request-but-some-evidence-makes-no-sense/285016)
**Author:** [@spdoes](https://discuss.elastic.co/u/spdoes)\ **Replies:** 8\ **Last updated:** [September 23, 2021, 8:51pm UTC](https://discuss.elastic.co/t/es-7-8-often-giving-errors-data-too-large-for-http-request-but-some-evidence-makes-no-sense/285016 "2021-09-23T20:51:53Z")
summary of error message: \[parent\] Data too large, data for \[\\] would be \[31095660714/28.9gb\], which is larger than the limit of \[30601641984/28.5gb\], real usage: \[31095659536/28.9gb\], new bytes reserved: … --- ## [Sharing index templates](https://discuss.elastic.co/t/sharing-index-templates/285023)
**Author:** [@Elitlogik](https://discuss.elastic.co/u/Elitlogik)\ **Replies:** 2\ **Last updated:** [September 23, 2021, 8:49pm UTC](https://discuss.elastic.co/t/sharing-index-templates/285023 "2021-09-23T20:49:59Z")
I have set up Index Templates and Kibana objects that I think many people out there would like to copy. Sharing Saved Objects as exported ndjson files is easy. How can I share Index Templates configuration for other to… --- ## [Search docs using month and day in birthday filed using elasticsearch SQL](https://discuss.elastic.co/t/search-docs-using-month-and-day-in-birthday-filed-using-elasticsearch-sql/284844)
**Author:** [@RAHUL\_PATEL](https://discuss.elastic.co/u/RAHUL_PATEL)\ **Replies:** 1\ **Last updated:** [September 23, 2021, 1:56pm UTC](https://discuss.elastic.co/t/search-docs-using-month-and-day-in-birthday-filed-using-elasticsearch-sql/284844 "2021-09-23T13:56:47Z")
i have a filed name birthday. which has date of birth in Date format. now using Elasticsearch SQL query, I want get "list all people who have birthdays in January" how to get all people using whose birthday is in Janu… --- ## [Calculate time difference between two timestamps and filter on a field](https://discuss.elastic.co/t/calculate-time-difference-between-two-timestamps-and-filter-on-a-field/285003)
**Author:** [@marone](https://discuss.elastic.co/u/marone)\ **Replies:** 0\ **Last updated:** [September 23, 2021, 12:25pm UTC](https://discuss.elastic.co/t/calculate-time-difference-between-two-timestamps-and-filter-on-a-field/285003 "2021-09-23T12:25:29Z")
Hey I am trying to implement a query to calculate a difference between two timestamps but filter on a field. The solution Getting duration by using bucket script works well but my use case is the following: I have, let'… --- ## [Shard Awareness Question](https://discuss.elastic.co/t/shard-awareness-question/284941)
**Author:** [@Dauni](https://discuss.elastic.co/u/Dauni)\ **Replies:** 3\ **Last updated:** [September 23, 2021, 12:11pm UTC](https://discuss.elastic.co/t/shard-awareness-question/284941 "2021-09-23T12:11:49Z")
Hello, We are running an ES 5.16 cluster in 3 DC's (total of 15 hosts, each host is 8 cpu / 32 GB ram and we have heap set to 16GB). DC1 = zone1 (1 master node, 6 data nodes) DC2 = zone2 (1 master node, 6 data nodes) … --- ## [Multiple Terms filters not working](https://discuss.elastic.co/t/multiple-terms-filters-not-working/284077)
**Author:** [@Jay2](https://discuss.elastic.co/u/Jay2)\ **Replies:** 9\ **Last updated:** [September 23, 2021, 11:48am UTC](https://discuss.elastic.co/t/multiple-terms-filters-not-working/284077 "2021-09-23T11:48:53Z")
Hi, I am new to the DSL and im using the below DSL query: {"from":0,"min\_score":0.5,"query":{"bool":{"filter":\[{"terms":{"extension":\["bmp","jpg","tif","img","png","gif","jpeg"\]}},{"terms":{"userContentType":\["webpage"\]… --- ## [Configure filebeat such that a log with variable length records can be uploaded to an index](https://discuss.elastic.co/t/configure-filebeat-such-that-a-log-with-variable-length-records-can-be-uploaded-to-an-index/284997)
**Author:** [@shi](https://discuss.elastic.co/u/shi)\ **Replies:** 0\ **Last updated:** [September 23, 2021, 11:31am UTC](https://discuss.elastic.co/t/configure-filebeat-such-that-a-log-with-variable-length-records-can-be-uploaded-to-an-index/284997 "2021-09-23T11:31:08Z")
configure filebeat such that a log with variable length records can be uploaded to an index. The index is created by the upload a file feature provided by kibana regards shini --- ## [Repurposing master node as data node](https://discuss.elastic.co/t/repurposing-master-node-as-data-node/284993)
**Author:** [@elastic-learner](https://discuss.elastic.co/u/elastic-learner)\ **Replies:** 0\ **Last updated:** [September 23, 2021, 10:58am UTC](https://discuss.elastic.co/t/repurposing-master-node-as-data-node/284993 "2021-09-23T10:58:54Z")
I have a 3 node es cluster with all nodes having all roles. I want to convert these nodes to dedicated master nodes and add extra dedicated data nodes. For this the best approach is to evacuate all the shards from the no… --- ## [Migrate from standalone to cluster instances](https://discuss.elastic.co/t/migrate-from-standalone-to-cluster-instances/284991)
**Author:** [@supportth](https://discuss.elastic.co/u/supportth)\ **Replies:** 0\ **Last updated:** [September 23, 2021, 10:48am UTC](https://discuss.elastic.co/t/migrate-from-standalone-to-cluster-instances/284991 "2021-09-23T10:48:59Z")
I have one node cluster of Elasticsearch With installed Elasticsearch, kibana, apm-server I have about 5 TB of indices my elk version is { "name" : "elk-old", "cluster\_name" : "elasticsearch", "cluster\_uuid" : … --- ## [Upgrade from 7.9.2 to 7.13](https://discuss.elastic.co/t/upgrade-from-7-9-2-to-7-13/284976)
**Author:** [@mruthyu](https://discuss.elastic.co/u/mruthyu)\ **Replies:** 0\ **Last updated:** [September 23, 2021, 9:22am UTC](https://discuss.elastic.co/t/upgrade-from-7-9-2-to-7-13/284976 "2021-09-23T09:22:55Z")
Is there anything we need to be aware of while upgrading from Elasticsearch 7.9.2 to 7.13? I do understand that minor version releases will not be having the breaking changes, and includes patches and bugfixes. --- ## [CentOS 7: Metadata file does not match checksum during yum update](https://discuss.elastic.co/t/centos-7-metadata-file-does-not-match-checksum-during-yum-update/284913)
**Author:** [@Daniel\_S](https://discuss.elastic.co/u/Daniel_S)\ **Replies:** 21\ **Last updated:** [September 23, 2021, 9:10am UTC](https://discuss.elastic.co/t/centos-7-metadata-file-does-not-match-checksum-during-yum-update/284913 "2021-09-23T09:10:27Z")
Hi, I am getting an error message: elasticsearch-7.x/primary FAILED https://artifacts.elastic.co/packages/7.x/yum/repodata/primary.xml.gz: \[Errno -1\] Metadata file does no… --- ## [Save discover search results, view deleted documents](https://discuss.elastic.co/t/save-discover-search-results-view-deleted-documents/284973)
**Author:** [@Tadija](https://discuss.elastic.co/u/Tadija)\ **Replies:** 0\ **Last updated:** [September 23, 2021, 8:41am UTC](https://discuss.elastic.co/t/save-discover-search-results-view-deleted-documents/284973 "2021-09-23T08:41:56Z")
We have setup ILM for our test environments so logs are deleted after 2 days. Our QA workflow includes testing stuff on test branches and creating tickets for issues they encounter. They sometime put a link to Kibana wh… --- ## [Sudden spike in CPU](https://discuss.elastic.co/t/sudden-spike-in-cpu/284972)
**Author:** [@kehers](https://discuss.elastic.co/u/kehers)\ **Replies:** 0\ **Last updated:** [September 23, 2021, 8:41am UTC](https://discuss.elastic.co/t/sudden-spike-in-cpu/284972 "2021-09-23T08:41:24Z")
I noticed a sudden spike in CPU (then response times) in our Elasticsearch instance this morning. Surprisingly, the health was green through this. Is there a way to properly investigate what could be the cause? --- ## [Update Field Type](https://discuss.elastic.co/t/update-field-type/284875)
**Author:** [@Brintha](https://discuss.elastic.co/u/Brintha)\ **Replies:** 4\ **Last updated:** [September 23, 2021, 6:26am UTC](https://discuss.elastic.co/t/update-field-type/284875 "2021-09-23T06:26:49Z")
Hello , Can anyone please help me ,how to update field type in existing index .I have no option to reindex .i want to convert long to keyword --- ## [Is there a way to force a replica to become primary?](https://discuss.elastic.co/t/is-there-a-way-to-force-a-replica-to-become-primary/284958)
**Author:** [@linkerc](https://discuss.elastic.co/u/linkerc)\ **Replies:** 0\ **Last updated:** [September 23, 2021, 5:25am UTC](https://discuss.elastic.co/t/is-there-a-way-to-force-a-replica-to-become-primary/284958 "2021-09-23T05:25:15Z")
Like my title suggested. Is it possible? My cluster has a rebalancing error where 1 primary shard is stuck in relocating state and I can't recover it. I'm hoping to force the replica to become the primary and configur… --- ## [Enrich processor high cpu load](https://discuss.elastic.co/t/enrich-processor-high-cpu-load/284778)
**Author:** [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Replies:** 7\ **Last updated:** [September 23, 2021, 1:11am UTC](https://discuss.elastic.co/t/enrich-processor-high-cpu-load/284778 "2021-09-23T01:11:57Z")
Hello, I have a couple of filebeats shipping data directly to elasticsearch, when this data hits elasticsearch two ingest pipelines are executed, one from the module, and another one using the final\_pipeline setting, I'… --- ## [Unindexed geo\_point field. What am I missing?](https://discuss.elastic.co/t/unindexed-geo-point-field-what-am-i-missing/284482)
**Author:** [@blueren](https://discuss.elastic.co/u/blueren)\ **Replies:** 3\ **Last updated:** [September 23, 2021, 12:13am UTC](https://discuss.elastic.co/t/unindexed-geo-point-field-what-am-i-missing/284482 "2021-09-23T00:13:48Z")
I have an elastic db which takes in netflow data and enriches them. I have two fields that are defined as below, in the template. (can verify that the template exists from Kibana \> index management \> mappings) "dstGeoLo… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=568) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=570)