# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=592 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 593 --- ## [Suggestions to use UltraWarm for the below scenario](https://discuss.elastic.co/t/suggestions-to-use-ultrawarm-for-the-below-scenario/281298)
**Author:** [@Kareemulla\_Dudekula](https://discuss.elastic.co/u/Kareemulla_Dudekula)\ **Replies:** 4\ **Last updated:** [August 16, 2021, 4:05am UTC](https://discuss.elastic.co/t/suggestions-to-use-ultrawarm-for-the-below-scenario/281298 "2021-08-16T04:05:16Z")
I have a scenario like, I want to move some ES index data to UltraWarm which we update/modify very rarely. So, when ever I want to update the particular ES UltraWarm index data through the app, I want to move that parti… --- ## [Elastic search configuration with kibana and nodes](https://discuss.elastic.co/t/elastic-search-configuration-with-kibana-and-nodes/281431)
**Author:** [@Dilnawaz\_Khan](https://discuss.elastic.co/u/Dilnawaz_Khan)\ **Replies:** 1\ **Last updated:** [August 16, 2021, 2:51am UTC](https://discuss.elastic.co/t/elastic-search-configuration-with-kibana-and-nodes/281431 "2021-08-16T02:51:33Z")
I have 2 master node of elasticsearch 7.5.2 and 3 data nodes & 1 seperate node for kibana following is the config files. Elasticsearch master1 & master2 ( elasticssearch.yml ) cluster.name: Es\_Cluster node.name: ES\_ma… --- ## [Not getting the data](https://discuss.elastic.co/t/not-getting-the-data/281478)
**Author:** [@xubisid](https://discuss.elastic.co/u/xubisid)\ **Replies:** 1\ **Last updated:** [August 15, 2021, 10:53pm UTC](https://discuss.elastic.co/t/not-getting-the-data/281478 "2021-08-15T22:53:37Z")
Hi, Whenever I try to GET / POST through the following URL in Postman. I am able to successfully perform the operation XXXX.ent.eastus2.azure.elastic-cloud.com when try to make the similar call through the code, I am … --- ## [Matching Logstash and Elasticsearch data stream configuration](https://discuss.elastic.co/t/matching-logstash-and-elasticsearch-data-stream-configuration/281323)
**Author:** [@jze1](https://discuss.elastic.co/u/jze1)\ **Replies:** 2\ **Last updated:** [August 15, 2021, 10:44pm UTC](https://discuss.elastic.co/t/matching-logstash-and-elasticsearch-data-stream-configuration/281323 "2021-08-15T22:44:40Z")
Hello, can someone shed some light into configuration of logstash/data streams? I have a bunch of apps (kubernetes pods) and I need to store logs of some for one year and the rest just for one week. I found out that by… --- ## [Cold data node is not starting after restart the ES service 7.7.0](https://discuss.elastic.co/t/cold-data-node-is-not-starting-after-restart-the-es-service-7-7-0/281474)
**Author:** [@alicango](https://discuss.elastic.co/u/alicango)\ **Replies:** 2\ **Last updated:** [August 15, 2021, 10:29am UTC](https://discuss.elastic.co/t/cold-data-node-is-not-starting-after-restart-the-es-service-7-7-0/281474 "2021-08-15T10:29:51Z")
Hi, I am getting below exception after restart the ES service; journalctl -xe systemd-entrypoint\[4842\]: Exception in thread "main" org.apache.lucene.index.CorruptIndexException: codec header mismatch: actual header=10… --- ## [Scripting - custom script to generate span query?](https://discuss.elastic.co/t/scripting-custom-script-to-generate-span-query/281470)
**Author:** [@byteandbit](https://discuss.elastic.co/u/byteandbit)\ **Replies:** 0\ **Last updated:** [August 15, 2021, 5:08am UTC](https://discuss.elastic.co/t/scripting-custom-script-to-generate-span-query/281470 "2021-08-15T05:08:23Z")
Our search use case uses Span Queries. Due to the nature of our data and Span Queries the "query" definition has to be always dynamic as we have to analyse the search text, eg: "quick brown fox" -\> { "query": { "s… --- ## [What Elasticsearch GUI admin and monitoring tools have you found that are awesome?](https://discuss.elastic.co/t/what-elasticsearch-gui-admin-and-monitoring-tools-have-you-found-that-are-awesome/281449)
**Author:** [@Jason\_Baumgartner](https://discuss.elastic.co/u/Jason_Baumgartner)\ **Replies:** 0\ **Last updated:** [August 14, 2021, 4:09pm UTC](https://discuss.elastic.co/t/what-elasticsearch-gui-admin-and-monitoring-tools-have-you-found-that-are-awesome/281449 "2021-08-14T16:09:44Z")
We all know that Kibana is an amazing product, but I'm curious what tools the rest of the ES community is using to monitor the health of their cluster and tools that help simplify administration of an Elasticsearch clust… --- ## [Order of CTX operators?](https://discuss.elastic.co/t/order-of-ctx-operators/281442)
**Author:** [@Jason\_Baumgartner](https://discuss.elastic.co/u/Jason_Baumgartner)\ **Replies:** 0\ **Last updated:** [August 14, 2021, 2:36pm UTC](https://discuss.elastic.co/t/order-of-ctx-operators/281442 "2021-08-14T14:36:22Z")
I am trying to make an update script condition that specifies only updating a document if the retrieved\_utc is newer than the existing one and then after that, examine several other conditions. When I try to use parenthe… --- ## [Most efficient mapping for a chat search engine](https://discuss.elastic.co/t/most-efficient-mapping-for-a-chat-search-engine/281434)
**Author:** [@Baygon](https://discuss.elastic.co/u/Baygon)\ **Replies:** 0\ **Last updated:** [August 14, 2021, 10:36am UTC](https://discuss.elastic.co/t/most-efficient-mapping-for-a-chat-search-engine/281434 "2021-08-14T10:36:49Z")
Hi, I'm building a new cluster to allow search on our internal chat system. Given the volume of data to index, and the budget for it, storage efficiency is a key here. Message structure: channel\_id: integer user\_id: i… --- ## [Elasticsearch start failed after the reboot the server](https://discuss.elastic.co/t/elasticsearch-start-failed-after-the-reboot-the-server/281416)
**Author:** [@alicango](https://discuss.elastic.co/u/alicango)\ **Replies:** 2\ **Last updated:** [August 14, 2021, 7:23am UTC](https://discuss.elastic.co/t/elasticsearch-start-failed-after-the-reboot-the-server/281416 "2021-08-14T07:23:52Z")
Hi, I couldn't start the elasticsearch service after reboot the server. How can i fix it? I have 3 Mater, 2 Hot, 2 Warm, 2 Cold nodes (Totaly 9 nodes) Elasticsearch version: 7.7.0 OS: CentOS Linux release 8.1.1911 (C… --- ## [How to use @elastic/ecs-winston-format with winston-elasticsearch](https://discuss.elastic.co/t/how-to-use-elastic-ecs-winston-format-with-winston-elasticsearch/281418)
**Author:** [@kkireyev](https://discuss.elastic.co/u/kkireyev)\ **Replies:** 0\ **Last updated:** [August 14, 2021, 2:03am UTC](https://discuss.elastic.co/t/how-to-use-elastic-ecs-winston-format-with-winston-elasticsearch/281418 "2021-08-14T02:03:52Z")
Hi! I'm trying to long events from Javascript (especially from express application) to ELK. I can write to console just fine: const ecsFormat = require('@elastic/ecs-winston-format'); const myLogger = winston.createLogg… --- ## [Add term filter query](https://discuss.elastic.co/t/add-term-filter-query/281012)
**Author:** [@Jose\_Manuel\_Tirado](https://discuss.elastic.co/u/Jose_Manuel_Tirado)\ **Replies:** 0\ **Last updated:** [August 11, 2021, 8:17am UTC](https://discuss.elastic.co/t/add-term-filter-query/281012 "2021-08-11T08:17:07Z")
HI: I am using this query to fetch elastic data through python connector: { "query": {"range": {"nuanceTimestamp": {"gte": f"{date1}T{str(hour\_in).zfill(2)}:00:00Z", … --- ## [Significant Terms with multi word results](https://discuss.elastic.co/t/significant-terms-with-multi-word-results/281394)
**Author:** [@Barrett\_Jones](https://discuss.elastic.co/u/Barrett_Jones)\ **Replies:** 1\ **Last updated:** [August 13, 2021, 10:07pm UTC](https://discuss.elastic.co/t/significant-terms-with-multi-word-results/281394 "2021-08-13T22:07:02Z")
I have an ElasticSearch index that includes a "text" field that I would like to do ElasticSearch significant\_terms aggregation on to determine meaningful terms and phrases from the "text" field. The problem I am facing, … --- ## [Issue with 7.14 ES query failed: java.io.IOException: ElasticsearchException\[Invalid or missing build flavor \[oss\]\]](https://discuss.elastic.co/t/issue-with-7-14-es-query-failed-java-io-ioexception-elasticsearchexception-invalid-or-missing-build-flavor-oss/281396)
**Author:** [@elastic-sss](https://discuss.elastic.co/u/elastic-sss)\ **Replies:** 3\ **Last updated:** [August 13, 2021, 10:01pm UTC](https://discuss.elastic.co/t/issue-with-7-14-es-query-failed-java-io-ioexception-elasticsearchexception-invalid-or-missing-build-flavor-oss/281396 "2021-08-13T22:01:03Z")
Hi, My queries are working fine with ES 7.13.4 but when I upgraded to 7.14.0 I get this error ""class java.lang.IllegalStateException:ES query failed: java.io.IOException: ElasticsearchException\[Invalid or missing build… --- ## ["Could not index event" due to "field already exists"](https://discuss.elastic.co/t/could-not-index-event-due-to-field-already-exists/281229)
**Author:** [@looknleap](https://discuss.elastic.co/u/looknleap)\ **Replies:** 8\ **Last updated:** [August 13, 2021, 9:24pm UTC](https://discuss.elastic.co/t/could-not-index-event-due-to-field-already-exists/281229 "2021-08-13T21:24:22Z")
Data path: Windows Sysmon --\> Winlogbeat --\> Logstash --\> Elasticsearch Problem: Certain new events are unable to be indexed: "status"=\>400, "error"=\>{"type"=\>"illegal\_argument\_exception", "reason"=\>"field \[process.pe.… --- ## [Like to apply sorting on given search query param](https://discuss.elastic.co/t/like-to-apply-sorting-on-given-search-query-param/277669)
**Author:** [@hariskhalique](https://discuss.elastic.co/u/hariskhalique)\ **Replies:** 6\ **Last updated:** [August 13, 2021, 7:24pm UTC](https://discuss.elastic.co/t/like-to-apply-sorting-on-given-search-query-param/277669 "2021-08-13T19:24:52Z")
I have product id list in terms query. I like to get result in same order as provide ids in terms query. Below is my query. { "size": 24, "from": 0, "sort": \[\], "query": { "bool": { … --- ## [How to pass date in Elastic co billing API](https://discuss.elastic.co/t/how-to-pass-date-in-elastic-co-billing-api/281376)
**Author:** [@Divyank\_Mahalle](https://discuss.elastic.co/u/Divyank_Mahalle)\ **Replies:** 1\ **Last updated:** [August 13, 2021, 3:23pm UTC](https://discuss.elastic.co/t/how-to-pass-date-in-elastic-co-billing-api/281376 "2021-08-13T15:23:00Z")
Hi, I have generate API key and I am getting data for current month by default using the curl command. I am checking for some format how to add dates in api to retrieve data for last 3 months. I checked documentation … --- ## [Elastic.co account and billing summary dashboard](https://discuss.elastic.co/t/elastic-co-account-and-billing-summary-dashboard/280275)
**Author:** [@Divyank\_Mahalle](https://discuss.elastic.co/u/Divyank_Mahalle)\ **Replies:** 15\ **Last updated:** [August 11, 2021, 12:41pm UTC](https://discuss.elastic.co/t/elastic-co-account-and-billing-summary-dashboard/280275 "2021-08-11T12:41:05Z")
Hi All, I am using elastic. co to check account and billing information. Can I make a dashboard in kibana from elastic.co data present in account and billing info. Please let me know if there is a way around to extrac… --- ## [Elasticsearch query and aggregation](https://discuss.elastic.co/t/elasticsearch-query-and-aggregation/281356)
**Author:** [@masakazu.ohtsuka](https://discuss.elastic.co/u/masakazu.ohtsuka)\ **Replies:** 0\ **Last updated:** [August 13, 2021, 12:55pm UTC](https://discuss.elastic.co/t/elasticsearch-query-and-aggregation/281356 "2021-08-13T12:55:01Z")
Elasticsearch responds with buckets that should be filtered out by the query. What's wrong? The request is: curl -kv --max-time 60 -H "Content-Type: application/json" "http://elasticsearch.example.com/jp-2021.0\*/\_searc… --- ## [ERROR - Kibana Canvas email Reporting via Watcher](https://discuss.elastic.co/t/error-kibana-canvas-email-reporting-via-watcher/281234)
**Author:** [@keshara](https://discuss.elastic.co/u/keshara)\ **Replies:** 0\ **Last updated:** [August 12, 2021, 5:18pm UTC](https://discuss.elastic.co/t/error-kibana-canvas-email-reporting-via-watcher/281234 "2021-08-12T17:18:30Z")
Hi, My use case is to automate email report via Watcher from a kibana Canvas report. ELK Stack =\> 7.14.0 I have already build a Canvas report. And from this same Canvas report I copied automatically generated Watcher … --- ## [Plugin error (tanium)](https://discuss.elastic.co/t/plugin-error-tanium/281300)
**Author:** [@travlest](https://discuss.elastic.co/u/travlest)\ **Replies:** 2\ **Last updated:** [August 13, 2021, 9:14am UTC](https://discuss.elastic.co/t/plugin-error-tanium/281300 "2021-08-13T09:14:51Z")
Hi, before this, I have a problem with connecting ELK stack to Tanium. But it has already been solving with an index pattern on kibana. the server that I've tried is a dummy server with little data. now, I am trying t… --- ## [Partial bulk insert into elasticsearch using rest API](https://discuss.elastic.co/t/partial-bulk-insert-into-elasticsearch-using-rest-api/281295)
**Author:** [@santosh\_varma](https://discuss.elastic.co/u/santosh_varma)\ **Replies:** 6\ **Last updated:** [August 13, 2021, 9:38am UTC](https://discuss.elastic.co/t/partial-bulk-insert-into-elasticsearch-using-rest-api/281295 "2021-08-13T09:38:32Z")
Hi All, I am trying to bulk insert data into elastic search batch wise(say 10 records at once). Out of these I am having one record which is invalid. The rest client is rolling back all the 10 records. I want to save th… --- ## [How to ingest complex JSON objects with tables in ES?](https://discuss.elastic.co/t/how-to-ingest-complex-json-objects-with-tables-in-es/281327)
**Author:** [@AbelAlejandro](https://discuss.elastic.co/u/AbelAlejandro)\ **Replies:** 0\ **Last updated:** [August 13, 2021, 9:24am UTC](https://discuss.elastic.co/t/how-to-ingest-complex-json-objects-with-tables-in-es/281327 "2021-08-13T09:24:13Z")
I'm trying to define a format for my logs and these must include lists of objects. When I upload my log file to ElasticSearch, it doesn't know how to parse the lists and I don't see how to configure this. Example NDJSON… --- ## [Elastic search commands](https://discuss.elastic.co/t/elastic-search-commands/281139)
**Author:** [@chris.aw](https://discuss.elastic.co/u/chris.aw)\ **Replies:** 5\ **Last updated:** [August 13, 2021, 8:18am UTC](https://discuss.elastic.co/t/elastic-search-commands/281139 "2021-08-13T08:18:56Z")
Hi, is there a way to allow search commands like: "/help, /categories" etc etc? Thank you for the help in advance --- ## [Pushing Logs form Azure Storage to Elastic via Logstash](https://discuss.elastic.co/t/pushing-logs-form-azure-storage-to-elastic-via-logstash/281312)
**Author:** [@Kosodrom](https://discuss.elastic.co/u/Kosodrom)\ **Replies:** 0\ **Last updated:** [August 13, 2021, 7:55am UTC](https://discuss.elastic.co/t/pushing-logs-form-azure-storage-to-elastic-via-logstash/281312 "2021-08-13T07:55:51Z")
Hi there, currently I am evaluating the possibility to collect logs, which reside in azure blob storage to Logstash. I came across this plug-in here: azure-diagnostics-tools/Logstash/logstash-input-azureblob at master … --- ## [Unpredictable work of terminate\_after](https://discuss.elastic.co/t/unpredictable-work-of-terminate-after/281306)
**Author:** [@romanenkoss](https://discuss.elastic.co/u/romanenkoss)\ **Replies:** 0\ **Last updated:** [August 13, 2021, 7:20am UTC](https://discuss.elastic.co/t/unpredictable-work-of-terminate-after/281306 "2021-08-13T07:20:28Z")
Hi team, I have an index with 4 billion docs, 200 shards, I want to use terminate\_after=500000 if I correctly understood request must terminate after 100kk docs, when the count of docs is more than 100kk it's working fi… --- ## [More than 1 shard not getting assigned to a node](https://discuss.elastic.co/t/more-than-1-shard-not-getting-assigned-to-a-node/279797)
**Author:** [@srivatsa](https://discuss.elastic.co/u/srivatsa)\ **Replies:** 2\ **Last updated:** [August 13, 2021, 7:11am UTC](https://discuss.elastic.co/t/more-than-1-shard-not-getting-assigned-to-a-node/279797 "2021-08-13T07:11:36Z")
ES version - 6.8 Setup - 3 nodes with default rack\_id I am trying to logically separate out clusters inside the single cluster by using the rack\_id awareness attribute, the problem I am facing is that only one shard is… --- ## [Update documents and field mapping](https://discuss.elastic.co/t/update-documents-and-field-mapping/280277)
**Author:** [@Dheeraj\_Gupta](https://discuss.elastic.co/u/Dheeraj_Gupta)\ **Replies:** 3\ **Last updated:** [August 3, 2021, 10:11am UTC](https://discuss.elastic.co/t/update-documents-and-field-mapping/280277 "2021-08-03T10:11:26Z")
I am using elasticsearch for some batch processing. The general gist of steps involved are: 1 Fetche each document from index A 2 Search index B by filtering data using attributes of document returned in step 1. 3. P… --- ## [Attribute Based Security](https://discuss.elastic.co/t/attribute-based-security/280592)
**Author:** [@workenehg](https://discuss.elastic.co/u/workenehg)\ **Replies:** 4\ **Last updated:** [August 13, 2021, 1:46am UTC](https://discuss.elastic.co/t/attribute-based-security/280592 "2021-08-13T01:46:42Z")
I have a use case where I need to restrict access to documents in an Elasticsearch index based on the user executing the query ACL and the security attributes on the document. i was told to use Attribute based Security … --- ## [Mapping Tenable (Nessus) scan reportitems to ECS vulnerability field set](https://discuss.elastic.co/t/mapping-tenable-nessus-scan-reportitems-to-ecs-vulnerability-field-set/280543)
**Author:** [@Gerry7](https://discuss.elastic.co/u/Gerry7)\ **Replies:** 3\ **Last updated:** [August 12, 2021, 9:54pm UTC](https://discuss.elastic.co/t/mapping-tenable-nessus-scan-reportitems-to-ecs-vulnerability-field-set/280543 "2021-08-12T21:54:41Z")
We are attempting to map Tenable (Nessus) scan report items to the ECS vulnerability field set. The Tenable scan report may include multiple vulnerability identifiers related to the detected vulnerability where each vuln… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=591) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=593)