# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=595 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 596 --- ## [Openshift metrics to ELK](https://discuss.elastic.co/t/openshift-metrics-to-elk/280879)
**Author:** [@inhinyera16](https://discuss.elastic.co/u/inhinyera16)\ **Replies:** 2\ **Last updated:** [August 10, 2021, 6:16am UTC](https://discuss.elastic.co/t/openshift-metrics-to-elk/280879 "2021-08-10T06:16:43Z")
Hi, I watched this webinar and we're planning to implement the same. But i noticed this implementation requires an elastic cloud? Is it possible to send the data to our on prem setup? Thank you in advance. --- ## [Group by, having sql ..How to Convert](https://discuss.elastic.co/t/group-by-having-sql-how-to-convert/280029)
**Author:** [@HYOJIN\_LEE](https://discuss.elastic.co/u/HYOJIN_LEE)\ **Replies:** 2\ **Last updated:** [August 10, 2021, 5:31am UTC](https://discuss.elastic.co/t/group-by-having-sql-how-to-convert/280029 "2021-08-10T05:31:26Z")
hello. I want to achieve some functionality which is available in SQL data stores. I have tried a lot but having a hard time achieving that functionality with elasticsearch. SQL SELECT CD\_HASH, COUNT(\*) FROM GRW\_MAIL… --- ## [Elasticsearch update by query using C#](https://discuss.elastic.co/t/elasticsearch-update-by-query-using-c/280874)
**Author:** [@HYOJIN\_LEE](https://discuss.elastic.co/u/HYOJIN_LEE)\ **Replies:** 0\ **Last updated:** [August 10, 2021, 5:26am UTC](https://discuss.elastic.co/t/elasticsearch-update-by-query-using-c/280874 "2021-08-10T05:26:17Z")
hi, I have a problem. I want to update only one data in sub\_info. example.. yn\_complete to "N" in cd\_emp = "2021019" But, Currently I get all the sub\_info sets, change only the part you want, and update the whole… --- ## [Elasticsearch Mappings from version 5 to version 7](https://discuss.elastic.co/t/elasticsearch-mappings-from-version-5-to-version-7/280802)
**Author:** [@tusharnemade](https://discuss.elastic.co/u/tusharnemade)\ **Replies:** 9\ **Last updated:** [August 10, 2021, 4:12am UTC](https://discuss.elastic.co/t/elasticsearch-mappings-from-version-5-to-version-7/280802 "2021-08-10T04:12:18Z")
Hello Team I am using Elasticsearch version 5.6.3 , cluster (A). I am planning to move to Elasticsearch version 7.8.0 using separate cluster (B) for it. I am using \_reindex api to move my index data from A to B clust… --- ## [Dynamic index mappings and autogenerated searches](https://discuss.elastic.co/t/dynamic-index-mappings-and-autogenerated-searches/280767)
**Author:** [@MattG1](https://discuss.elastic.co/u/MattG1)\ **Replies:** 1\ **Last updated:** [August 10, 2021, 3:45am UTC](https://discuss.elastic.co/t/dynamic-index-mappings-and-autogenerated-searches/280767 "2021-08-10T03:45:15Z")
Hey, I hope this is the correct category (please point me in the correct direction if it is not). I want to give my users the ability to add custom data into an ES index and then search based on that custom data. I wil… --- ## [Have been using ES OSS, now require FIPS and x-pack. Do I need to switch and purchase license?](https://discuss.elastic.co/t/have-been-using-es-oss-now-require-fips-and-x-pack-do-i-need-to-switch-and-purchase-license/280861)
**Author:** [@Zoheb\_Khan](https://discuss.elastic.co/u/Zoheb_Khan)\ **Replies:** 1\ **Last updated:** [August 10, 2021, 3:34am UTC](https://discuss.elastic.co/t/have-been-using-es-oss-now-require-fips-and-x-pack-do-i-need-to-switch-and-purchase-license/280861 "2021-08-10T03:34:41Z")
Hi Team, Pardon me if the question sounds pretty obvious but I wanted to make sure before I proceed - I have a requirement to enable FIPS for search feature on a existing application (monolithic) that uses ES as single… --- ## [Load balancer for elasticsearch cluster](https://discuss.elastic.co/t/load-balancer-for-elasticsearch-cluster/280589)
**Author:** [@markrity](https://discuss.elastic.co/u/markrity)\ **Replies:** 3\ **Last updated:** [August 9, 2021, 10:11pm UTC](https://discuss.elastic.co/t/load-balancer-for-elasticsearch-cluster/280589 "2021-08-09T22:11:02Z")
Elasticsearch version - 5.1.2 16GB of max heap configured Installed and used enterprise modules, if any - No JVM version and operating system version - openjdk version "1.8.0\_292" , CentOS Other installed Elasticsearch … --- ## [Upgrade Elastic 7.9 from helm 2 to helm 3 in 1.16](https://discuss.elastic.co/t/upgrade-elastic-7-9-from-helm-2-to-helm-3-in-1-16/280851)
**Author:** [@maheshe](https://discuss.elastic.co/u/maheshe)\ **Replies:** 0\ **Last updated:** [August 9, 2021, 9:06pm UTC](https://discuss.elastic.co/t/upgrade-elastic-7-9-from-helm-2-to-helm-3-in-1-16/280851 "2021-08-09T21:06:18Z")
Is there a recommended way to migrate from helm2 to helm3 for Elastic helm charts. Since helm2 and helm3 are quite different how to retain the Elasticsearch/Kibana indexes etc.. when I upgrade to an entirely new chart --- ## [Custom analyzer doesn't work in mapping but is fine through index/\_analyze endpoint, ES v6.8.10](https://discuss.elastic.co/t/custom-analyzer-doesnt-work-in-mapping-but-is-fine-through-index-analyze-endpoint-es-v6-8-10/280665)
**Author:** [@tehowe](https://discuss.elastic.co/u/tehowe)\ **Replies:** 1\ **Last updated:** [August 9, 2021, 8:49pm UTC](https://discuss.elastic.co/t/custom-analyzer-doesnt-work-in-mapping-but-is-fine-through-index-analyze-endpoint-es-v6-8-10/280665 "2021-08-09T20:49:26Z")
Why, if I've written an analyzer for Elasticsearch which works when I use the analysis API endpoint, does it not get picked up and used when I set the mapping for a field to that analyzer? This works: GET cobalt\_strike… --- ## [Elasticsearch help understanding Update by query version conflicts](https://discuss.elastic.co/t/elasticsearch-help-understanding-update-by-query-version-conflicts/280838)
**Author:** [@mgargi01](https://discuss.elastic.co/u/mgargi01)\ **Replies:** 0\ **Last updated:** [August 9, 2021, 4:25pm UTC](https://discuss.elastic.co/t/elasticsearch-help-understanding-update-by-query-version-conflicts/280838 "2021-08-09T16:25:13Z")
Hi - ELastic 7.6.1: I am adding some new field mappings to my index. the index is set to "dynamic" : "strict", so after the mappings are added, I run: POST index.test/\_update\_by\_query?refresh&conflicts=proceed to u… --- ## [How does elasticsearch return buckets when aggs by sum is used?](https://discuss.elastic.co/t/how-does-elasticsearch-return-buckets-when-aggs-by-sum-is-used/280740)
**Author:** [@chrisan](https://discuss.elastic.co/u/chrisan)\ **Replies:** 2\ **Last updated:** [August 9, 2021, 4:00pm UTC](https://discuss.elastic.co/t/how-does-elasticsearch-return-buckets-when-aggs-by-sum-is-used/280740 "2021-08-09T16:00:23Z")
By default, the terms aggregation will return the buckets for the top ten terms ordered by the doc\_count . One can change this default behaviour by setting the size parameter. If I am doing a search like below, how … --- ## [From single-node cluster to multi-nodes cluster](https://discuss.elastic.co/t/from-single-node-cluster-to-multi-nodes-cluster/280777)
**Author:** [@Rosanna\_Staiano](https://discuss.elastic.co/u/Rosanna_Staiano)\ **Replies:** 2\ **Last updated:** [August 9, 2021, 3:18pm UTC](https://discuss.elastic.co/t/from-single-node-cluster-to-multi-nodes-cluster/280777 "2021-08-09T15:18:53Z")
Hello! I have a single-node cluster with the "discovery.type: single node" setup, and I want to turn it into a multi-node cluster. Could you give me some advice to make this conversion in the best way? I'm using Elast… --- ## [Cannot delete winlogbeat indices using curator](https://discuss.elastic.co/t/cannot-delete-winlogbeat-indices-using-curator/280679)
**Author:** [@francescouk](https://discuss.elastic.co/u/francescouk)\ **Replies:** 2\ **Last updated:** [August 9, 2021, 2:48pm UTC](https://discuss.elastic.co/t/cannot-delete-winlogbeat-indices-using-curator/280679 "2021-08-09T14:48:03Z")
Hi there, I´m trying to use curator but something is not right. Can someone try to help me?? Following the config that I have: config.yml client: hosts: - XX.XX.XX.XX port: 9200 url\_prefix: use\_ssl: true … --- ## [Elasticsearch wont start with FIPS Mode Enabled](https://discuss.elastic.co/t/elasticsearch-wont-start-with-fips-mode-enabled/280758)
**Author:** [@Zoheb\_Khan](https://discuss.elastic.co/u/Zoheb_Khan)\ **Replies:** 2\ **Last updated:** [August 9, 2021, 2:44pm UTC](https://discuss.elastic.co/t/elasticsearch-wont-start-with-fips-mode-enabled/280758 "2021-08-09T14:44:37Z")
I am not able to bring-up elasticsearch service in FIPS mode 140-2. I keep getting exception : org.elasticsearch.bootstrap.StartupException: org.elasticsearch.common.ssl.SslConfigException: failed to find a X509Extende… --- ## [ElasticSearch/Kibana install on CENT/REHL](https://discuss.elastic.co/t/elasticsearch-kibana-install-on-cent-rehl/280583)
**Author:** [@MKirby](https://discuss.elastic.co/u/MKirby)\ **Replies:** 11\ **Last updated:** [August 9, 2021, 2:03pm UTC](https://discuss.elastic.co/t/elasticsearch-kibana-install-on-cent-rehl/280583 "2021-08-09T14:03:55Z")
Good Afternoon; I have been working with ELK now for 3.5 months and as I am going to be deploying this in RHEL in the near future it was time to move away from the Windows deployment that I have been testing with. So I… --- ## [Inconsistent completion suggester results size](https://discuss.elastic.co/t/inconsistent-completion-suggester-results-size/280807)
**Author:** [@abido](https://discuss.elastic.co/u/abido)\ **Replies:** 0\ **Last updated:** [August 9, 2021, 12:05pm UTC](https://discuss.elastic.co/t/inconsistent-completion-suggester-results-size/280807 "2021-08-09T12:05:09Z")
Hello, I am getting weird behaviour with the number of results returned by the Completion Suggester. I have the following request body for example: "suggest": { "title": { "prefix": "ja", "completion": { … --- ## [Phrase\_prefix with cross\_fields](https://discuss.elastic.co/t/phrase-prefix-with-cross-fields/280792)
**Author:** [@Razvan\_Todea](https://discuss.elastic.co/u/Razvan_Todea)\ **Replies:** 0\ **Last updated:** [August 9, 2021, 10:48am UTC](https://discuss.elastic.co/t/phrase-prefix-with-cross-fields/280792 "2021-08-09T10:48:02Z")
We want the following use case, if a record is saved in the database with the following fields. { "id": 1, "name": "Benefit", "address": "Supersonic" } Queries such as these should match: ben benefit super ben… --- ## [Incorrect shard allocation](https://discuss.elastic.co/t/incorrect-shard-allocation/280359)
**Author:** [@Petr.Simik](https://discuss.elastic.co/u/Petr.Simik)\ **Replies:** 3\ **Last updated:** [August 9, 2021, 10:32am UTC](https://discuss.elastic.co/t/incorrect-shard-allocation/280359 "2021-08-09T10:32:19Z")
i have 15nodes cluster with various mix of datasources 8% is larger shards 10-30GB size. 30% is smaller shards 1-15GB. And majority is very small shards megabites 60%. The reason of having small shards is having lot of … --- ## [The ES index does not generate fields parsed by logstash](https://discuss.elastic.co/t/the-es-index-does-not-generate-fields-parsed-by-logstash/280786)
**Author:** [@ktpktr0](https://discuss.elastic.co/u/ktpktr0)\ **Replies:** 0\ **Last updated:** [August 9, 2021, 9:55am UTC](https://discuss.elastic.co/t/the-es-index-does-not-generate-fields-parsed-by-logstash/280786 "2021-08-09T09:55:17Z")
I used logstash to parse the JSON log, but the ES index did not generate the corresponding fields logstash config: filter { if \[service\] == "roomtest" { grok { match =\> { "messag… --- ## [Cannot update field mapping with custom normalizer](https://discuss.elastic.co/t/cannot-update-field-mapping-with-custom-normalizer/280782)
**Author:** [@Rammi22](https://discuss.elastic.co/u/Rammi22)\ **Replies:** 0\ **Last updated:** [August 9, 2021, 9:14am UTC](https://discuss.elastic.co/t/cannot-update-field-mapping-with-custom-normalizer/280782 "2021-08-09T09:14:25Z")
Trying to extends a field mapper returns exception... The field: ... "detail.data.myfield": { "type": "text", "fields": { "keyword": { "type": "keyword", "ignore\_above": 256 … --- ## [Make Elasticsearch running as a service?](https://discuss.elastic.co/t/make-elasticsearch-running-as-a-service/280510)
**Author:** [@Veak](https://discuss.elastic.co/u/Veak)\ **Replies:** 2\ **Last updated:** [August 9, 2021, 9:11am UTC](https://discuss.elastic.co/t/make-elasticsearch-running-as-a-service/280510 "2021-08-09T09:11:16Z")
Hello, i've installed the elasticsearch 7.x on a raspberry PI 4B on ubuntu 20.04. I've installed it manually with the .tgz. It's working fine when i launch it manually with the command : ./elasticsearch -d (in the di… --- ## [Painless: Any easy way to define dates like now-1d, now-2d](https://discuss.elastic.co/t/painless-any-easy-way-to-define-dates-like-now-1d-now-2d/280773)
**Author:** [@kelk](https://discuss.elastic.co/u/kelk)\ **Replies:** 0\ **Last updated:** [August 9, 2021, 8:21am UTC](https://discuss.elastic.co/t/painless-any-easy-way-to-define-dates-like-now-1d-now-2d/280773 "2021-08-09T08:21:56Z")
We have a painless script to compare a logic before a date. Currently the user have to enter epoch value into the params, but was checking if you guys already have a script or logic, so we can use the "range" notations i… --- ## [Watcher action index](https://discuss.elastic.co/t/watcher-action-index/280078)
**Author:** [@bilel\_meddeb](https://discuss.elastic.co/u/bilel_meddeb)\ **Replies:** 3\ **Last updated:** [August 9, 2021, 7:54am UTC](https://discuss.elastic.co/t/watcher-action-index/280078 "2021-08-09T07:54:34Z")
hello i create a watcher with this action i want to store the result in index --- ## [When ES updated from 7.3.1 to 7.10.2, search slow 2x in fetch phase](https://discuss.elastic.co/t/when-es-updated-from-7-3-1-to-7-10-2-search-slow-2x-in-fetch-phase/280765)
**Author:** [@jiangnanxue21](https://discuss.elastic.co/u/jiangnanxue21)\ **Replies:** 0\ **Last updated:** [August 9, 2021, 6:46am UTC](https://discuss.elastic.co/t/when-es-updated-from-7-3-1-to-7-10-2-search-slow-2x-in-fetch-phase/280765 "2021-08-09T06:46:30Z")
Our product environment had updated es from 7.3.1 to 7.10.2, the index mapping and search sentence has not changed anymore. We specify include and exclude fileds by using that sourceBuilder.fetchSource(getIncludeFe… --- ## [Elasticsearch search\_phase\_execution\_exception in Python](https://discuss.elastic.co/t/elasticsearch-search-phase-execution-exception-in-python/280763)
**Author:** [@rknd](https://discuss.elastic.co/u/rknd)\ **Replies:** 0\ **Last updated:** [August 9, 2021, 6:35am UTC](https://discuss.elastic.co/t/elasticsearch-search-phase-execution-exception-in-python/280763 "2021-08-09T06:35:42Z")
I fetch all my Elasticsearch documents via using scroll api with below code in Python. size = 100 data = es.search( index=index, scroll='25m', size=size, body=body … --- ## [Find Correlation between fields in different indices](https://discuss.elastic.co/t/find-correlation-between-fields-in-different-indices/280498)
**Author:** [@WJ\_Y](https://discuss.elastic.co/u/WJ_Y)\ **Replies:** 1\ **Last updated:** [August 9, 2021, 5:24am UTC](https://discuss.elastic.co/t/find-correlation-between-fields-in-different-indices/280498 "2021-08-09T05:24:45Z")
Using Elasticsearch version 7.14.0, I want to find correlations betweet fields in different indices. An index named "A" has "name", "a-1", "a-2" fields. An index named "B" has "name", "b-1", "b-2" fields. The "name" f… --- ## [/\_security/api\_key - disable / enable](https://discuss.elastic.co/t/security-api-key-disable-enable/280755)
**Author:** [@byteandbit](https://discuss.elastic.co/u/byteandbit)\ **Replies:** 4\ **Last updated:** [August 9, 2021, 5:22am UTC](https://discuss.elastic.co/t/security-api-key-disable-enable/280755 "2021-08-09T05:22:17Z")
Hey, Just wondering if after creating API Key (/\_security/api\_key) there is a way to disable/enable it without invalidation? --- ## [Handle Multiline logs, where number of lines are not sure?](https://discuss.elastic.co/t/handle-multiline-logs-where-number-of-lines-are-not-sure/280757)
**Author:** [@bpandit](https://discuss.elastic.co/u/bpandit)\ **Replies:** 0\ **Last updated:** [August 9, 2021, 3:47am UTC](https://discuss.elastic.co/t/handle-multiline-logs-where-number-of-lines-are-not-sure/280757 "2021-08-09T03:47:57Z")
I need a way to handle multi line logs, where number of lines are not sure, below is the log data, where start \[29-Apr-2018 16:46:32\] \[pool int-mobileapp\] pid 30064 script\_filename = /var/www/html/int-mobileapp/index.p… --- ## [Remove index mappings in version 7.4](https://discuss.elastic.co/t/remove-index-mappings-in-version-7-4/280636)
**Author:** [@aldm](https://discuss.elastic.co/u/aldm)\ **Replies:** 3\ **Last updated:** [August 8, 2021, 11:26pm UTC](https://discuss.elastic.co/t/remove-index-mappings-in-version-7-4/280636 "2021-08-08T23:26:40Z")
Hi, We made a mistake to store details\_per\_category in this way { cat1: object, cat2: object, . .. } Now there are thousands of categories, which generated thousands of new fields in out index. We corrected it b… --- ## [Unable to upload json file to elastic search](https://discuss.elastic.co/t/unable-to-upload-json-file-to-elastic-search/280712)
**Author:** [@cmunka](https://discuss.elastic.co/u/cmunka)\ **Replies:** 2\ **Last updated:** [August 8, 2021, 11:19pm UTC](https://discuss.elastic.co/t/unable-to-upload-json-file-to-elastic-search/280712 "2021-08-08T23:19:27Z")
I am trying to upload a jsonl file to elastic search via \_bulk api using Python. Below is my code.! Error: Data is having multiple json object: ##code## # -\*- coding: utf-8 -\*- import requests import json url … [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=594) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=596)