# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=581 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 582 --- ## [Highlighting of exact search with simple\_query\_string](https://discuss.elastic.co/t/highlighting-of-exact-search-with-simple-query-string/283292)
**Author:** [@Wonder\_Garance](https://discuss.elastic.co/u/Wonder_Garance)\ **Replies:** 1\ **Last updated:** [September 5, 2021, 12:53pm UTC](https://discuss.elastic.co/t/highlighting-of-exact-search-with-simple-query-string/283292 "2021-09-05T12:53:23Z")
I use Elasticsearch 7.9 and I want to highlight an exact search filed with simple query string query, for a document. The following query doesn't highlight words in the document, although these words are in the document… --- ## [Influxdb and elasticsearch benchmarking for timeseries data](https://discuss.elastic.co/t/influxdb-and-elasticsearch-benchmarking-for-timeseries-data/283371)
**Author:** [@mruthyu](https://discuss.elastic.co/u/mruthyu)\ **Replies:** 0\ **Last updated:** [September 5, 2021, 11:48am UTC](https://discuss.elastic.co/t/influxdb-and-elasticsearch-benchmarking-for-timeseries-data/283371 "2021-09-05T11:48:48Z")
Do we have the benchmarking stats for Elasticsearch and Influxdb considering the time series data (Metrics) Looking into the performance aspects as recent releases of elasticsearch have the additional optimization strat… --- ## [Virustotal Module MISP attributes don't store in ELK](https://discuss.elastic.co/t/virustotal-module-misp-attributes-dont-store-in-elk/282834)
**Author:** [@Abanob\_Medhat](https://discuss.elastic.co/u/Abanob_Medhat)\ **Replies:** 3\ **Last updated:** [September 5, 2021, 11:20am UTC](https://discuss.elastic.co/t/virustotal-module-misp-attributes-dont-store-in-elk/282834 "2021-09-05T11:20:55Z")
hello, I integrated Virustotal with MISP and run virustotal on events and all virustotal attributes are saved in MISP. also , I integrated MISP with Elastic using Filebeats. the events are stored in Elastic and I can … --- ## [Elasticsearch is displaying correct result only after a space](https://discuss.elastic.co/t/elasticsearch-is-displaying-correct-result-only-after-a-space/283009)
**Author:** [@Drsaud](https://discuss.elastic.co/u/Drsaud)\ **Replies:** 9\ **Last updated:** [September 5, 2021, 10:43am UTC](https://discuss.elastic.co/t/elasticsearch-is-displaying-correct-result-only-after-a-space/283009 "2021-09-05T10:43:22Z")
I build react app the has search bar using elasticsearch, but the problem is when I search in my search bar earthier I have to write the word not complete or I write as complete word but after I click space. for example… --- ## [Many deleted indices, no recovery of disk space?](https://discuss.elastic.co/t/many-deleted-indices-no-recovery-of-disk-space/283328)
**Author:** [@NetwarSystem](https://discuss.elastic.co/u/NetwarSystem)\ **Replies:** 3\ **Last updated:** [September 5, 2021, 3:51am UTC](https://discuss.elastic.co/t/many-deleted-indices-no-recovery-of-disk-space/283328 "2021-09-05T03:51:21Z")
I have a 1.2TB backup of Elasticsearch data that I have restored to a standalone machine running 7.14.0. The restore worked fine and I began grooming the data - about half of the indices in the snapshot are not needed fo… --- ## [Apply aggregation result to values in the document \[Elasticsearch\]](https://discuss.elastic.co/t/apply-aggregation-result-to-values-in-the-document-elasticsearch/283350)
**Author:** [@me.mohammed](https://discuss.elastic.co/u/me.mohammed)\ **Replies:** 0\ **Last updated:** [September 4, 2021, 6:59pm UTC](https://discuss.elastic.co/t/apply-aggregation-result-to-values-in-the-document-elasticsearch/283350 "2021-09-04T18:59:58Z")
so what I'm trying to do is change the actual values in the document depending on the aggregation result, I'm not sure if this is possible or not but here are some examples to what I'm trying to do { "deals": \[ { … --- ## [Disk.size is 10 times more than disk.indices](https://discuss.elastic.co/t/disk-size-is-10-times-more-than-disk-indices/283280)
**Author:** [@mrudrego](https://discuss.elastic.co/u/mrudrego)\ **Replies:** 4\ **Last updated:** [September 4, 2021, 11:47am UTC](https://discuss.elastic.co/t/disk-size-is-10-times-more-than-disk-indices/283280 "2021-09-04T11:47:56Z")
We are facing shard allocation issues because of disk watermark and when checked allocation API, strangely disk.size is 5-6 times more than disk.indices \[root@bcmt-ovs-control-0 ~\]# curl -s elasticsearch.cgnat.svc.clust… --- ## [Should we adopt elasticsearch on top of postgres to handle our search/filtering?](https://discuss.elastic.co/t/should-we-adopt-elasticsearch-on-top-of-postgres-to-handle-our-search-filtering/283324)
**Author:** [@elastic\_yogi](https://discuss.elastic.co/u/elastic_yogi)\ **Replies:** 1\ **Last updated:** [September 4, 2021, 7:29am UTC](https://discuss.elastic.co/t/should-we-adopt-elasticsearch-on-top-of-postgres-to-handle-our-search-filtering/283324 "2021-09-04T07:29:02Z")
We have a web service that allows a ~10 customers to look at their data. Each customer has about 1M - 10M records. Our total datastore size will target the 10's of gigabytes. We currently store this data in postgres norm… --- ## [What does this error mean - Data too large, data for \[\\]](https://discuss.elastic.co/t/what-does-this-error-mean-data-too-large-data-for-transport-request/209345)
**Author:** [@Dmitry1](https://discuss.elastic.co/u/Dmitry1)\ **Replies:** 7\ **Last updated:** [September 4, 2021, 3:38am UTC](https://discuss.elastic.co/t/what-does-this-error-mean-data-too-large-data-for-transport-request/209345 "2021-09-04T03:38:37Z")
Hello, please explain me what this error mean ? And what I need to do to get rid of it : \[2019-11-25T00:20:58,521\]\[WARN \]\[o.e.x.m.e.l.LocalExporter\] \[host\] unexpected error while indexing monitoring document org.elastic… --- ## [How to create a new search template through node js client](https://discuss.elastic.co/t/how-to-create-a-new-search-template-through-node-js-client/283216)
**Author:** [@Gustavo\_Leite\_Silvan](https://discuss.elastic.co/u/Gustavo_Leite_Silvan)\ **Replies:** 2\ **Last updated:** [September 3, 2021, 8:08pm UTC](https://discuss.elastic.co/t/how-to-create-a-new-search-template-through-node-js-client/283216 "2021-09-03T20:08:47Z")
I'm using Javascript client. Trying to create search templates through it, but didn't found the method to do it. --- ## [ElasticSearch aggregation shows unexpected result for SUM](https://discuss.elastic.co/t/elasticsearch-aggregation-shows-unexpected-result-for-sum/283286)
**Author:** [@VaZa](https://discuss.elastic.co/u/VaZa)\ **Replies:** 4\ **Last updated:** [September 3, 2021, 4:39pm UTC](https://discuss.elastic.co/t/elasticsearch-aggregation-shows-unexpected-result-for-sum/283286 "2021-09-03T16:39:11Z")
Trying to apply sum aggregation and get unexpected result 1. prepare dataset $cat products.json {"index":{"\_id":"1"}} {"productId": 10,"shopId": 45,"prices": {"retailPrice": 525000000.02,"sumRetailPrice": 5250000000.2}… --- ## [Point in Time with Search After missing a few logs](https://discuss.elastic.co/t/point-in-time-with-search-after-missing-a-few-logs/283296)
**Author:** [@woal\_idal](https://discuss.elastic.co/u/woal_idal)\ **Replies:** 0\ **Last updated:** [September 3, 2021, 3:01pm UTC](https://discuss.elastic.co/t/point-in-time-with-search-after-missing-a-few-logs/283296 "2021-09-03T15:01:36Z")
When I run a regular query search in elasticsearch, I will get all the values. Now, when I implement the point in time api and search after because using the regular search api can handle up to 10K hits/results the query… --- ## [Best way to create a list of all \_ids in an index (Up to date version)](https://discuss.elastic.co/t/best-way-to-create-a-list-of-all-ids-in-an-index-up-to-date-version/283195)
**Author:** [@steveh](https://discuss.elastic.co/u/steveh)\ **Replies:** 1\ **Last updated:** [September 3, 2021, 3:16pm UTC](https://discuss.elastic.co/t/best-way-to-create-a-list-of-all-ids-in-an-index-up-to-date-version/283195 "2021-09-03T15:16:08Z")
So what's the current best way to query (and therefore dump to say a file) all the document \_ids in an index? I have a 218,000 doc database with about 8000 documents missing (according to the document counts). To inves… --- ## [Meta fields in a query](https://discuss.elastic.co/t/meta-fields-in-a-query/283217)
**Author:** [@rgopalan](https://discuss.elastic.co/u/rgopalan)\ **Replies:** 1\ **Last updated:** [September 3, 2021, 3:13pm UTC](https://discuss.elastic.co/t/meta-fields-in-a-query/283217 "2021-09-03T15:13:41Z")
Hi, I am trying to isolate application flows that cause slow queries that are being logged in the slow log. Many of our search requests are very similar and it is hard to figure out which user was performing what actio… --- ## [How to ignore malformed query for IP property](https://discuss.elastic.co/t/how-to-ignore-malformed-query-for-ip-property/283221)
**Author:** [@hZhYNXaCbgkgjyFBJ](https://discuss.elastic.co/u/hZhYNXaCbgkgjyFBJ)\ **Replies:** 1\ **Last updated:** [September 3, 2021, 3:12pm UTC](https://discuss.elastic.co/t/how-to-ignore-malformed-query-for-ip-property/283221 "2021-09-03T15:12:52Z")
Hi there, I have an Elasticsearch index whose mapping has two properties - one is of type keyword and the other is of type ip: "mappings": { "properties": { "user\_id": { "… --- ## [Merging search results across multiple related indexes](https://discuss.elastic.co/t/merging-search-results-across-multiple-related-indexes/282100)
**Author:** [@someguy](https://discuss.elastic.co/u/someguy)\ **Replies:** 8\ **Last updated:** [September 3, 2021, 3:01pm UTC](https://discuss.elastic.co/t/merging-search-results-across-multiple-related-indexes/282100 "2021-09-03T15:01:45Z")
Working on a project where we have a core document (one index) and each document can have multiple related files that we want searchable (a couple other indexes for different types of files). We want to implement a sear… --- ## [JAVA API not found for top\_metric aggregation](https://discuss.elastic.co/t/java-api-not-found-for-top-metric-aggregation/282880)
**Author:** [@crchaulagain](https://discuss.elastic.co/u/crchaulagain)\ **Replies:** 4\ **Last updated:** [September 3, 2021, 2:57pm UTC](https://discuss.elastic.co/t/java-api-not-found-for-top-metric-aggregation/282880 "2021-09-03T14:57:47Z")
I am using Elasticsearch 7.11.1 and going to use top\_metric aggregation to get the top records under the terms aggregation bucket. And my query is something like the following: { "size": 0, "query": { "bool": { "mu… --- ## [Deserialize different typed field to other typed property in Nest](https://discuss.elastic.co/t/deserialize-different-typed-field-to-other-typed-property-in-nest/283159)
**Author:** [@Martin\_Leonard\_Sart1](https://discuss.elastic.co/u/Martin_Leonard_Sart1)\ **Replies:** 1\ **Last updated:** [September 3, 2021, 2:56pm UTC](https://discuss.elastic.co/t/deserialize-different-typed-field-to-other-typed-property-in-nest/283159 "2021-09-03T14:56:21Z")
Hi, We just recently upgraded from 6.3 to 7.7 version of Elasticsearch. Upon migration, we got an error something like this: "{"expected:'Number Token', actual:'"10"' at offset:458"}" Based on a blog I've read, bluew… --- ## [Watcher Timestamp showing in EPOCH](https://discuss.elastic.co/t/watcher-timestamp-showing-in-epoch/283075)
**Author:** [@arunhk3](https://discuss.elastic.co/u/arunhk3)\ **Replies:** 3\ **Last updated:** [September 3, 2021, 2:51pm UTC](https://discuss.elastic.co/t/watcher-timestamp-showing-in-epoch/283075 "2021-09-03T14:51:28Z")
Hi All, I was creating a watch in watcher which looks as below { "trigger" : { "schedule" : { "interval" : "3h" } } }, "input": { "search": { "request": { "search\_type": "query\_the… --- ## [Aggregation for Individual Query in should Array](https://discuss.elastic.co/t/aggregation-for-individual-query-in-should-array/283251)
**Author:** [@Manisekhar\_techo](https://discuss.elastic.co/u/Manisekhar_techo)\ **Replies:** 3\ **Last updated:** [September 3, 2021, 2:05pm UTC](https://discuss.elastic.co/t/aggregation-for-individual-query-in-should-array/283251 "2021-09-03T14:05:40Z")
Hi All, is there a way for me to perform the aggregation for all the Matching documents inside the bool should array individually. { "query": { "bool": { "should": \[ { … --- ## [Not able to see the reply](https://discuss.elastic.co/t/not-able-to-see-the-reply/283279)
**Author:** [@subhp](https://discuss.elastic.co/u/subhp)\ **Replies:** 1\ **Last updated:** [September 3, 2021, 1:12pm UTC](https://discuss.elastic.co/t/not-able-to-see-the-reply/283279 "2021-09-03T13:12:33Z")
Continuing the discussion from Elaticsearch multiMatchQuery with wildcard: I am looking for similar search for all the fields. I am not able see the reply. If there is any solution please update --- ## [Elasticsearch Pods are not coming up - free(): invalid pointer](https://discuss.elastic.co/t/elasticsearch-pods-are-not-coming-up-free-invalid-pointer/283271)
**Author:** [@NK2812](https://discuss.elastic.co/u/NK2812)\ **Replies:** 0\ **Last updated:** [September 3, 2021, 11:51am UTC](https://discuss.elastic.co/t/elasticsearch-pods-are-not-coming-up-free-invalid-pointer/283271 "2021-09-03T11:51:39Z")
Hi Team, We are facing an issue while creating the Elasticsearch cluster, pods are not coming up and when I see the logs below is the error. warning: ignoring JAVA\_OPTS= -XX:MaxRAMPercentage=70.0; pass JVM parameters v… --- ## [Pod state 0/1 Running after set up elasticseatch on k8s cluster using helm chart](https://discuss.elastic.co/t/pod-state-0-1-running-after-set-up-elasticseatch-on-k8s-cluster-using-helm-chart/283268)
**Author:** [@cezzarez](https://discuss.elastic.co/u/cezzarez)\ **Replies:** 0\ **Last updated:** [September 3, 2021, 10:15am UTC](https://discuss.elastic.co/t/pod-state-0-1-running-after-set-up-elasticseatch-on-k8s-cluster-using-helm-chart/283268 "2021-09-03T10:15:57Z")
Hey! As I already mentioned here: Database file changed error - #7 by cezzarez I have a problem with elasticsearch on my k8s cluster. Looks like everything works as expected, but my pods are stucks with state 0/1. In m… --- ## [Warning: Journal has been rotated since unit was started](https://discuss.elastic.co/t/warning-journal-has-been-rotated-since-unit-was-started/283131)
**Author:** [@alipujaistopo](https://discuss.elastic.co/u/alipujaistopo)\ **Replies:** 4\ **Last updated:** [September 3, 2021, 9:56am UTC](https://discuss.elastic.co/t/warning-journal-has-been-rotated-since-unit-was-started/283131 "2021-09-03T09:56:02Z")
hi everyone, i need help. i have a warning at my kibana "elastic did not load properly..." after that i check mu elasticsearch's server. i check the status. it's running so well but there's a warning "journal has been … --- ## [Synonym\_graph + match\_phrase: Unexpected high score due to the sum up of IDF of all matched synonym words](https://discuss.elastic.co/t/synonym-graph-match-phrase-unexpected-high-score-due-to-the-sum-up-of-idf-of-all-matched-synonym-words/283260)
**Author:** [@Patrick\_N](https://discuss.elastic.co/u/Patrick_N)\ **Replies:** 0\ **Last updated:** [September 3, 2021, 9:28am UTC](https://discuss.elastic.co/t/synonym-graph-match-phrase-unexpected-high-score-due-to-the-sum-up-of-idf-of-all-matched-synonym-words/283260 "2021-09-03T09:28:35Z")
(ES 7.10) I use synonym\_graph (usa, united states north america) for the search\_analyzer of a field. When I perform a match\_phrase which contains usa, the score of any matching doc which contains the term usa will be su… --- ## [Using rollover indexes to reduce shard size?](https://discuss.elastic.co/t/using-rollover-indexes-to-reduce-shard-size/283196)
**Author:** [@riahc3](https://discuss.elastic.co/u/riahc3)\ **Replies:** 4\ **Last updated:** [September 3, 2021, 8:19am UTC](https://discuss.elastic.co/t/using-rollover-indexes-to-reduce-shard-size/283196 "2021-09-03T08:19:27Z")
Hello Ive been reading up on how to reduce my shard size as it seems my stack has that issue and Ive been reading about rollover indexes but I dont understand them too well.... I have one node. Im gonna use some real … --- ## [Restore elasticsearch cluster onto another cluster](https://discuss.elastic.co/t/restore-elasticsearch-cluster-onto-another-cluster/283238)
**Author:** [@auto\_reply\_007](https://discuss.elastic.co/u/auto_reply_007)\ **Replies:** 3\ **Last updated:** [September 3, 2021, 6:09am UTC](https://discuss.elastic.co/t/restore-elasticsearch-cluster-onto-another-cluster/283238 "2021-09-03T06:09:30Z")
Hello i have 3 node elasticsearch cluster ( source ) and i have snapshot called snapshot-1 which taken from source cluster and i have another 6 node elasticsearch cluster ( destination ) cluster and when i restore my de… --- ## [Adding a node from a single node cluster to a different cluster](https://discuss.elastic.co/t/adding-a-node-from-a-single-node-cluster-to-a-different-cluster/282627)
**Author:** [@prithvirajsivarajan](https://discuss.elastic.co/u/prithvirajsivarajan)\ **Replies:** 11\ **Last updated:** [September 3, 2021, 6:26am UTC](https://discuss.elastic.co/t/adding-a-node-from-a-single-node-cluster-to-a-different-cluster/282627 "2021-09-03T06:26:47Z")
I'm using a multi node cluster with 2 master eligible nodes. I want to add a master eligible voting only node to the cluster. This node was was previously part of a single node cluster. I had setup SSH with different pas… --- ## [How to (re)include a (new) node in a cluster without impact performances?](https://discuss.elastic.co/t/how-to-re-include-a-new-node-in-a-cluster-without-impact-performances/283145)
**Author:** [@sebastienf](https://discuss.elastic.co/u/sebastienf)\ **Replies:** 3\ **Last updated:** [September 3, 2021, 6:09am UTC](https://discuss.elastic.co/t/how-to-re-include-a-new-node-in-a-cluster-without-impact-performances/283145 "2021-09-03T06:09:17Z")
Hello, Still in 5.6 ES version... I am wondering, when a node is included into a cluster, how to avoid that this one gets all new index / shards, regarding the fact that he is empty or unbalanced versus other nodes : i… --- ## [Elasticsearch - recency boost error: 'Unknown key for a START\_OBJECT in \[boosts\].'](https://discuss.elastic.co/t/elasticsearch-recency-boost-error-unknown-key-for-a-start-object-in-boosts/283194)
**Author:** [@brutal\_logic](https://discuss.elastic.co/u/brutal_logic)\ **Replies:** 3\ **Last updated:** [September 3, 2021, 5:37am UTC](https://discuss.elastic.co/t/elasticsearch-recency-boost-error-unknown-key-for-a-start-object-in-boosts/283194 "2021-09-03T05:37:43Z")
I'm using the python elasticsearch api to hit a elasticsearch on some data that has the following fields: "id", "dateCreated", "title", "text\_body" The "dateCreated" is of the form '2021-09-01T23:09:54.79362+00:00' I'… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=580) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=582)