# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=598 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 599 --- ## [Setting up security and alerting in basic license cluster](https://discuss.elastic.co/t/setting-up-security-and-alerting-in-basic-license-cluster/280296)
**Author:** [@azxqw](https://discuss.elastic.co/u/azxqw)\ **Replies:** 2\ **Last updated:** [August 4, 2021, 2:50am UTC](https://discuss.elastic.co/t/setting-up-security-and-alerting-in-basic-license-cluster/280296 "2021-08-04T02:50:34Z")
Hi I want to enable the security settings to use the alerting capabillites of the stack. What i dont understand from the user guide is this - do i need to do what is told on every node in the cluster? --- ## [Dynamic rollover alias and template name](https://discuss.elastic.co/t/dynamic-rollover-alias-and-template-name/280371)
**Author:** [@tong6462](https://discuss.elastic.co/u/tong6462)\ **Replies:** 6\ **Last updated:** [August 4, 2021, 1:32am UTC](https://discuss.elastic.co/t/dynamic-rollover-alias-and-template-name/280371 "2021-08-04T01:32:57Z")
Hi. Could it be possible to allow using variables in the properties " ilm\_rollover\_alias " as well as " template\_name " in the Elasticsearch output, like we can do with the "index" property? Index lifecycle error ille… --- ## [ILM Questions](https://discuss.elastic.co/t/ilm-questions/205298)
**Author:** [@Wayne\_Taylor](https://discuss.elastic.co/u/Wayne_Taylor)\ **Replies:** 1\ **Last updated:** [August 3, 2021, 11:29pm UTC](https://discuss.elastic.co/t/ilm-questions/205298 "2021-08-03T23:29:52Z")
Hi Elastic Team, I know there is a lot of questions on ILM which encompasses both the Elasticsearch aspects as well as Kibana. Background: We use Fluentd for our log ingestion framework developed by our DevOps teams t… --- ## [IllegalStateException: alias has more than one write index](https://discuss.elastic.co/t/illegalstateexception-alias-has-more-than-one-write-index/254065)
**Author:** [@exper0](https://discuss.elastic.co/u/exper0)\ **Replies:** 1\ **Last updated:** [August 3, 2021, 11:08pm UTC](https://discuss.elastic.co/t/illegalstateexception-alias-has-more-than-one-write-index/254065 "2021-08-03T23:08:39Z")
Hello, I'm getting the same error on all ES data nodes saying that alias has more than one write index so none of data nodes can actually start, cluster is dead. Is there any way to fix the problem without deleting all … --- ## [ES fails to start with error index has more than one write index](https://discuss.elastic.co/t/es-fails-to-start-with-error-index-has-more-than-one-write-index/245828)
**Author:** [@Prashant\_Agrawal](https://discuss.elastic.co/u/Prashant_Agrawal)\ **Replies:** 1\ **Last updated:** [August 3, 2021, 11:07pm UTC](https://discuss.elastic.co/t/es-fails-to-start-with-error-index-has-more-than-one-write-index/245828 "2021-08-03T23:07:20Z")
There was an ES cluster which was running for a while but suddenly docker got restarted and all nodes started to fail with below error: "stacktrace": \["org.elasticsearch.bootstrap.StartupException: java.lang.IllegalSta… --- ## [IllegalStateException: Alias has more than one write index](https://discuss.elastic.co/t/illegalstateexception-alias-has-more-than-one-write-index/210771)
**Author:** [@tami](https://discuss.elastic.co/u/tami)\ **Replies:** 3\ **Last updated:** [August 3, 2021, 11:05pm UTC](https://discuss.elastic.co/t/illegalstateexception-alias-has-more-than-one-write-index/210771 "2021-08-03T23:05:58Z")
We are running version 6.8.3 with a 3.2.2 (master.client.data) setup. Our cluster is currently in the reds state: curl -X GET '$HOST/\_cat/health' 1575572989 19:09:49 es-cluster-dogfood red 6 1 1050 1050 0 0 1116 0 - 48… --- ## [Tanium Configuring Elasticsearch destinations](https://discuss.elastic.co/t/tanium-configuring-elasticsearch-destinations/280291)
**Author:** [@travlest](https://discuss.elastic.co/u/travlest)\ **Replies:** 1\ **Last updated:** [August 3, 2021, 10:45pm UTC](https://discuss.elastic.co/t/tanium-configuring-elasticsearch-destinations/280291 "2021-08-03T22:45:02Z")
Hi, I am new to ELK. I have deployed an ELK stack with Filebeat. Right now I would like to connect my ELK to Tanium using this documentation tanium. But I am encountering this error. I tried to find the solutions onl… --- ## [Resolve one of the index in cluster is with Yellow status](https://discuss.elastic.co/t/resolve-one-of-the-index-in-cluster-is-with-yellow-status/280274)
**Author:** [@SabirPiludiya](https://discuss.elastic.co/u/SabirPiludiya)\ **Replies:** 3\ **Last updated:** [August 3, 2021, 9:24pm UTC](https://discuss.elastic.co/t/resolve-one-of-the-index-in-cluster-is-with-yellow-status/280274 "2021-08-03T21:24:15Z")
We are running HA Elasticsearch in k8s. Recently we found one of the indexes in the Yellow status due to Unassigned shards which leads the whole cluster state to yellow. Shard of that index status in NODE-A is STARTED a… --- ## [Restore from snapshot fails with no recovery information](https://discuss.elastic.co/t/restore-from-snapshot-fails-with-no-recovery-information/280355)
**Author:** [@bill\_d](https://discuss.elastic.co/u/bill_d)\ **Replies:** 2\ **Last updated:** [August 3, 2021, 7:43pm UTC](https://discuss.elastic.co/t/restore-from-snapshot-fails-with-no-recovery-information/280355 "2021-08-03T19:43:25Z")
I have 2 similarly configured 3 node elasticsearch clusters. Both run 7.10.2, but one is bigger than the other. I'm trying to restore an index from a snapshot. In the small cluster, the restore takes about 3 minutes, … --- ## [Checking runner ip connectivity... FAILED Can't connect $RUNNER\_HOST\_IP \[172.xx.x.xx:22000\]: ConnectionError](https://discuss.elastic.co/t/checking-runner-ip-connectivity-failed-cant-connect-runner-host-ip-172-xx-x-xx-22000-connectionerror/278940)
**Author:** [@vjam](https://discuss.elastic.co/u/vjam)\ **Replies:** 21\ **Last updated:** [August 3, 2021, 5:31pm UTC](https://discuss.elastic.co/t/checking-runner-ip-connectivity-failed-cant-connect-runner-host-ip-172-xx-x-xx-22000-connectionerror/278940 "2021-08-03T17:31:26Z")
Hello All - We are trying to install Elastic (cloud-enterprise-version 2.8.1) in the following environment. AWS, RHEL-8 Docker (docker-ce-19.03.15) but seem to be constantly getting the error below Checking runner ip… --- ## [Rally create-track limit document count](https://discuss.elastic.co/t/rally-create-track-limit-document-count/279916)
**Author:** [@mots](https://discuss.elastic.co/u/mots)\ **Replies:** 4\ **Last updated:** [August 3, 2021, 4:10pm UTC](https://discuss.elastic.co/t/rally-create-track-limit-document-count/279916 "2021-08-03T16:10:59Z")
I am able to create a custom track following these instructions. But the target index I am using has over 5 mil documents. It's taking too long to create the custom track and I don't even need that many documents to run… --- ## [Aggregate destination ip addresses and destination ports](https://discuss.elastic.co/t/aggregate-destination-ip-addresses-and-destination-ports/280342)
**Author:** [@Marco\_Lazzarotto](https://discuss.elastic.co/u/Marco_Lazzarotto)\ **Replies:** 0\ **Last updated:** [August 3, 2021, 3:38pm UTC](https://discuss.elastic.co/t/aggregate-destination-ip-addresses-and-destination-ports/280342 "2021-08-03T15:38:23Z")
I'm collecting hundreds of thousands of logs from a firewall (Cisco ASA). On every log record, among other details, I have destination ip addresses and destination ports. Now, I need to have an aggregated list of all d… --- ## [ILM policy doesn't work for jaeger](https://discuss.elastic.co/t/ilm-policy-doesnt-work-for-jaeger/280333)
**Author:** [@heruv1m](https://discuss.elastic.co/u/heruv1m)\ **Replies:** 0\ **Last updated:** [August 3, 2021, 2:59pm UTC](https://discuss.elastic.co/t/ilm-policy-doesnt-work-for-jaeger/280333 "2021-08-03T14:59:59Z")
I'm using elasticsearch as storage backend for jaeger. I initialized ilm, then created index. It worked well until 4-th index. On 4-th index ilm not applied anymore. Steps to reproduce Create ilm policy \_ilm/policy/… --- ## [ElasticSerach API - update by query script params null\_pointer\_exception](https://discuss.elastic.co/t/elasticserach-api-update-by-query-script-params-null-pointer-exception/280325)
**Author:** [@Savas12.01](https://discuss.elastic.co/u/Savas12.01)\ **Replies:** 1\ **Last updated:** [August 3, 2021, 2:18pm UTC](https://discuss.elastic.co/t/elasticserach-api-update-by-query-script-params-null-pointer-exception/280325 "2021-08-03T14:18:41Z")
I am new to the ElasticSearch and am i trying to make use of the \_update\_by\_query route. I am sending this body: { "query": { "match": { "id": "fdfsfsfs-058f-437d-bc52-473808ba61c2" } }, "script": { … --- ## [Can't divide two fields when querying an index](https://discuss.elastic.co/t/cant-divide-two-fields-when-querying-an-index/280264)
**Author:** [@Luis\_P](https://discuss.elastic.co/u/Luis_P)\ **Replies:** 9\ **Last updated:** [August 3, 2021, 11:59am UTC](https://discuss.elastic.co/t/cant-divide-two-fields-when-querying-an-index/280264 "2021-08-03T11:59:17Z")
Hello, I'm new to Elasticsearch and Kibana and I've been trying to create a watcher that alerts me when the free disk space ratio is lower than a defined value. I believe I've managed to build a working watcher however, … --- ## [Mapping private IP Address to geolocation with GeoIP Processor](https://discuss.elastic.co/t/mapping-private-ip-address-to-geolocation-with-geoip-processor/279981)
**Author:** [@Vannessa\_Kemeni](https://discuss.elastic.co/u/Vannessa_Kemeni)\ **Replies:** 4\ **Last updated:** [August 3, 2021, 11:54am UTC](https://discuss.elastic.co/t/mapping-private-ip-address-to-geolocation-with-geoip-processor/279981 "2021-08-03T11:54:55Z")
Hello, i am using a tool, that uses Elastic search. For retrieving the geolocaton of the IP Address a Json file was created that uses the GeoIP Processor. I updated this file in order to set the geolocation of the priva… --- ## [Disk.indices is higher than disk.used in cat allocation](https://discuss.elastic.co/t/disk-indices-is-higher-than-disk-used-in-cat-allocation/279853)
**Author:** [@sandeepkanabar](https://discuss.elastic.co/u/sandeepkanabar)\ **Replies:** 13\ **Last updated:** [August 3, 2021, 11:02am UTC](https://discuss.elastic.co/t/disk-indices-is-higher-than-disk-used-in-cat-allocation/279853 "2021-08-03T11:02:35Z")
When I run the following command: GET \_cat/allocation?v&s=disk.indices&h=shards,disk.indices,disk.used,disk.available,disk.total,disk.percent it shows the following output: shards disk.indices disk.used disk.total dis… --- ## [Disable Fuzziness in Query](https://discuss.elastic.co/t/disable-fuzziness-in-query/280073)
**Author:** [@usman1](https://discuss.elastic.co/u/usman1)\ **Replies:** 3\ **Last updated:** [August 3, 2021, 9:11am UTC](https://discuss.elastic.co/t/disable-fuzziness-in-query/280073 "2021-08-03T09:11:07Z")
I am fetching results with the following query where search is being done on Strings (Recipe name): let body2 = { size: 200, from: 0, sort : \[ { "@timestamp" : {"order": "desc", "form… --- ## [Details of Top N records](https://discuss.elastic.co/t/details-of-top-n-records/280224)
**Author:** [@ddramireddy](https://discuss.elastic.co/u/ddramireddy)\ **Replies:** 1\ **Last updated:** [August 3, 2021, 7:09am UTC](https://discuss.elastic.co/t/details-of-top-n-records/280224 "2021-08-03T07:09:21Z")
Hi, I have an index with following schema: GroupName,Time,Value Example values: G1 2020-01-01 1:00:00. 10 G2 2020-01-01 1:00:00. 15 G3 2020-01-01 1:00:00. 20 G1 2020-01-01 2:00:00. 10 G2 2020-01-01 2:00:00. 20 G… --- ## [API/endpoint to get analyzer/filter details](https://discuss.elastic.co/t/api-endpoint-to-get-analyzer-filter-details/280254)
**Author:** [@mattkallo](https://discuss.elastic.co/u/mattkallo)\ **Replies:** 1\ **Last updated:** [August 3, 2021, 7:06am UTC](https://discuss.elastic.co/t/api-endpoint-to-get-analyzer-filter-details/280254 "2021-08-03T07:06:35Z")
I have a synonyms analyzer with 2 filters configured to read from synonyms mapping files. I use the /\_analyze API to see how the analyzer processes text. But is there a way to get a summary of configured filters or ana… --- ## [Getting false hits on queries (boolean, match, term, and filters)](https://discuss.elastic.co/t/getting-false-hits-on-queries-boolean-match-term-and-filters/280100)
**Author:** [@encompassJeff](https://discuss.elastic.co/u/encompassJeff)\ **Replies:** 4\ **Last updated:** [August 3, 2021, 6:53am UTC](https://discuss.elastic.co/t/getting-false-hits-on-queries-boolean-match-term-and-filters/280100 "2021-08-03T06:53:09Z")
I use Elastic to host an index used for managing list filters, which returns IDs matching a query, that I then use in Seek call on a SQL database to retrieve large sets of data with decent efficiency. Lately I've seen a … --- ## [Cannot access elasticsearch or kibana on browser but able to access within the server using curl](https://discuss.elastic.co/t/cannot-access-elasticsearch-or-kibana-on-browser-but-able-to-access-within-the-server-using-curl/280270)
**Author:** [@Srinivas1602](https://discuss.elastic.co/u/Srinivas1602)\ **Replies:** 2\ **Last updated:** [August 3, 2021, 4:29am UTC](https://discuss.elastic.co/t/cannot-access-elasticsearch-or-kibana-on-browser-but-able-to-access-within-the-server-using-curl/280270 "2021-08-03T04:29:48Z")
Hi, I am facing a problem while connecting to elastic search urls on browser. I have an elastic search with one master node and 2 datanodes configured and running on the respective servers. When I curl on the respecti… --- ## [Elasticsearch Index Shards](https://discuss.elastic.co/t/elasticsearch-index-shards/280206)
**Author:** [@RAM\_NATHAN](https://discuss.elastic.co/u/RAM_NATHAN)\ **Replies:** 1\ **Last updated:** [August 3, 2021, 1:47am UTC](https://discuss.elastic.co/t/elasticsearch-index-shards/280206 "2021-08-03T01:47:24Z")
Hi Im creating an elasticsearch index with 3 shards. But as of today I have single node elasticsearch. I have future plan to have 3 nodes cluster and hence created 3 shards now. Will it be a right approach --- ## [ECK: Added nodes and now queries are unable to find stored scripts](https://discuss.elastic.co/t/eck-added-nodes-and-now-queries-are-unable-to-find-stored-scripts/279301)
**Author:** [@Thomas\_Doman](https://discuss.elastic.co/u/Thomas_Doman)\ **Replies:** 12\ **Last updated:** [August 2, 2021, 11:28pm UTC](https://discuss.elastic.co/t/eck-added-nodes-and-now-queries-are-unable-to-find-stored-scripts/279301 "2021-08-02T23:28:18Z")
ES: 6.8.13 We're in the process of moving from manually maintained ES clusters to Elastic Cloud on Kubernetes (ECK). In our first test environment (a single node cluster), we added 3 ECK nodes. Afterward, all our sear… --- ## [Elasticsearch timeout error on operations](https://discuss.elastic.co/t/elasticsearch-timeout-error-on-operations/280239)
**Author:** [@iuryfukuda](https://discuss.elastic.co/u/iuryfukuda)\ **Replies:** 4\ **Last updated:** [August 2, 2021, 11:22pm UTC](https://discuss.elastic.co/t/elasticsearch-timeout-error-on-operations/280239 "2021-08-02T23:22:46Z")
We have timeout error on worker clients who use ES go client: time="2021-08-02T16:04:45Z" level=error msg="error handling connection with queue: error saving bulk: error making bulk request dial tcp 20.96.122.135:9200:… --- ## [Update documents based on other updates](https://discuss.elastic.co/t/update-documents-based-on-other-updates/280237)
**Author:** [@nilei](https://discuss.elastic.co/u/nilei)\ **Replies:** 1\ **Last updated:** [August 2, 2021, 10:44pm UTC](https://discuss.elastic.co/t/update-documents-based-on-other-updates/280237 "2021-08-02T22:44:56Z")
Hi :wave: I have two indices where one of them potentially contains several million documents (let us say index "installation") and the other one only a few hundreds (index "product" for now). Now, I want to update some… --- ## [Monitoring Cluster Sizing](https://discuss.elastic.co/t/monitoring-cluster-sizing/280229)
**Author:** [@shahidraza](https://discuss.elastic.co/u/shahidraza)\ **Replies:** 1\ **Last updated:** [August 2, 2021, 9:37pm UTC](https://discuss.elastic.co/t/monitoring-cluster-sizing/280229 "2021-08-02T21:37:39Z")
Hi Team, I want to set up a Monitoring Cluster for my Dev, Test, and Non-Prod & Prod Cluster. Are any hardware sizing documents available for the same which I can refer for standard sizing? Dev and Test one Monitorin… --- ## [Elasticsearch client memory is not getting utilized](https://discuss.elastic.co/t/elasticsearch-client-memory-is-not-getting-utilized/279966)
**Author:** [@Varun\_S](https://discuss.elastic.co/u/Varun_S)\ **Replies:** 1\ **Last updated:** [August 2, 2021, 9:28pm UTC](https://discuss.elastic.co/t/elasticsearch-client-memory-is-not-getting-utilized/279966 "2021-08-02T21:28:18Z")
Hi Team, We have deployed elasticsearch in kubernetes environment with the below memory and cpu configuration. Data has been pushed to elasticsearch from multiple clients\[7 clients\], elasticsearch data memory is get… --- ## [ESRALLY : CREATE/DELETE operations fail 100% everytime](https://discuss.elastic.co/t/esrally-create-delete-operations-fail-100-everytime/280162)
**Author:** [@mots](https://discuss.elastic.co/u/mots)\ **Replies:** 2\ **Last updated:** [August 2, 2021, 6:20pm UTC](https://discuss.elastic.co/t/esrally-create-delete-operations-fail-100-everytime/280162 "2021-08-02T18:20:04Z")
I have created a custom track with 2 documents just to debug this use case. I am running this on a remote target index deployed on AWS. I am trying to debug why my create/delete operations always fail with 100%. I canno… --- ## [Find documents containing not more terms than in the query with fuzzines](https://discuss.elastic.co/t/find-documents-containing-not-more-terms-than-in-the-query-with-fuzzines/280043)
**Author:** [@karolix1279](https://discuss.elastic.co/u/karolix1279)\ **Replies:** 6\ **Last updated:** [August 2, 2021, 5:19pm UTC](https://discuss.elastic.co/t/find-documents-containing-not-more-terms-than-in-the-query-with-fuzzines/280043 "2021-08-02T17:19:10Z")
Let's assume there are three documents in database: {name: "John"} {name: "John Brown"} {name: "Brown"} I would like to search documents in the following way: Search: "John". Result: document 1 Search: "John Brown".… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=597) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=599)