# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=599 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 600 --- ## [Sorting fragments returned by hit highlighting](https://discuss.elastic.co/t/sorting-fragments-returned-by-hit-highlighting/278707)
**Author:** [@timforr](https://discuss.elastic.co/u/timforr)\ **Replies:** 1\ **Last updated:** [August 2, 2021, 4:04pm UTC](https://discuss.elastic.co/t/sorting-fragments-returned-by-hit-highlighting/278707 "2021-08-02T16:04:45Z")
I have documents with multiple content fields which I am getting highlighted fragments from. The fragments from within the same field are sorted according to score, but the order the fields are returned in is random. I… --- ## [Superuser doesn't have access to read a document?](https://discuss.elastic.co/t/superuser-doesnt-have-access-to-read-a-document/280128)
**Author:** [@panagiss](https://discuss.elastic.co/u/panagiss)\ **Replies:** 3\ **Last updated:** [August 2, 2021, 1:43pm UTC](https://discuss.elastic.co/t/superuser-doesnt-have-access-to-read-a-document/280128 "2021-08-02T13:43:26Z")
This is my user's privileges { "cluster" : \[ "all" \], "global" : \[ \], "indices" : \[ { "names" : \[ "\*" \], "privileges" : \[ "all" \], "allow\_restricted\_indices"… --- ## [Elasticsearch: Apply index templates at start-up](https://discuss.elastic.co/t/elasticsearch-apply-index-templates-at-start-up/279701)
**Author:** [@raoulvdberge](https://discuss.elastic.co/u/raoulvdberge)\ **Replies:** 3\ **Last updated:** [August 2, 2021, 2:26pm UTC](https://discuss.elastic.co/t/elasticsearch-apply-index-templates-at-start-up/279701 "2021-08-02T14:26:24Z")
Hi, I was wondering if it's possible to start up Elasticsearch with index templates applied (for example by being defined in a config). We currently have a pod that has Elastic and Logstash containers, and the Logstash… --- ## [Master\_not\_discovered\_exception](https://discuss.elastic.co/t/master-not-discovered-exception/280225)
**Author:** [@prithvirajsivarajan](https://discuss.elastic.co/u/prithvirajsivarajan)\ **Replies:** 1\ **Last updated:** [August 2, 2021, 1:31pm UTC](https://discuss.elastic.co/t/master-not-discovered-exception/280225 "2021-08-02T13:31:30Z")
I have an elasticsearch cluster with 2 nodes. When I stop elasticsearch instance on master node the other one is not becoming master automatically. It gives the master not discovered exception elasticsearch.yml on node-… --- ## [How to display other \_source fields in a metric aggregation result?](https://discuss.elastic.co/t/how-to-display-other-source-fields-in-a-metric-aggregation-result/280209)
**Author:** [@StephaneB](https://discuss.elastic.co/u/StephaneB)\ **Replies:** 2\ **Last updated:** [August 2, 2021, 12:43pm UTC](https://discuss.elastic.co/t/how-to-display-other-source-fields-in-a-metric-aggregation-result/280209 "2021-08-02T12:43:06Z")
Hello, I'm working on ML job documents with the following fields: { "\_index" : ".ml-anomalies-custom-job\_device1", "\_type" : "\_doc", "\_id" : "job\_device1\_model\_forecast\_Gwn4wnoB0F2uUBpmgO6… --- ## [Lifecycle policy min\_document to not rollover empty indices](https://discuss.elastic.co/t/lifecycle-policy-min-document-to-not-rollover-empty-indices/280201)
**Author:** [@francois75](https://discuss.elastic.co/u/francois75)\ **Replies:** 0\ **Last updated:** [August 2, 2021, 9:47am UTC](https://discuss.elastic.co/t/lifecycle-policy-min-document-to-not-rollover-empty-indices/280201 "2021-08-02T09:47:37Z")
I've set the max\_age to one day so I have one index per day. But this rollover also empty indices. Is there a way to avoid this ? Adding a min\_document to rollover could help with this. --- ## [Document level & Field level security with HighLevelRest client](https://discuss.elastic.co/t/document-level-field-level-security-with-highlevelrest-client/280186)
**Author:** [@PraveenKumar\_KG](https://discuss.elastic.co/u/PraveenKumar_KG)\ **Replies:** 2\ **Last updated:** [August 2, 2021, 9:32am UTC](https://discuss.elastic.co/t/document-level-field-level-security-with-highlevelrest-client/280186 "2021-08-02T09:32:35Z")
Hi, We have built an angular and SpringBoot based application to search the data in elasticsearch and render the search details in UI. Angular frontend has sign in with access restricted with RBAC. Now I want to restr… --- ## [Ctx.payload.hits NOT working error (Good format)](https://discuss.elastic.co/t/ctx-payload-hits-not-working-error-good-format/280071)
**Author:** [@alex14](https://discuss.elastic.co/u/alex14)\ **Replies:** 2\ **Last updated:** [August 2, 2021, 8:14am UTC](https://discuss.elastic.co/t/ctx-payload-hits-not-working-error-good-format/280071 "2021-08-02T08:14:58Z")
Hey there, I´m trying to create a watcher but i need to use some fields from my index to send that information via email but i always get the same error I need to use the fields hit.\_source.service.address, 'NodeName':… --- ## [Sort and limit with aggregation](https://discuss.elastic.co/t/sort-and-limit-with-aggregation/280007)
**Author:** [@raviverel](https://discuss.elastic.co/u/raviverel)\ **Replies:** 1\ **Last updated:** [August 2, 2021, 7:52am UTC](https://discuss.elastic.co/t/sort-and-limit-with-aggregation/280007 "2021-08-02T07:52:57Z")
hey, i am want to do aggregation only on the first X items sort by some attributes, is it possible ? didn't find a way ( elastic 7.13 ) thanks --- ## [Query on elasticsearch.keystore file present in ES config directory](https://discuss.elastic.co/t/query-on-elasticsearch-keystore-file-present-in-es-config-directory/278652)
**Author:** [@chaitra\_hegde](https://discuss.elastic.co/u/chaitra_hegde)\ **Replies:** 2\ **Last updated:** [August 2, 2021, 7:51am UTC](https://discuss.elastic.co/t/query-on-elasticsearch-keystore-file-present-in-es-config-directory/278652 "2021-08-02T07:51:26Z")
Hi, I am using Elasticsearch-oss 7.8.0 in k8s environment. I want to know what is elasticsearch.keystore file present in ES Config directory(/etc/elasticsearch) which comes by default when ES rpm is installed. I saw thi… --- ## [Whats difference org.elasticsearch.index.mapper.GeoPointFieldMapper and org.elasticsearch.xpack.ml.extractor.GeoPointField](https://discuss.elastic.co/t/whats-difference-org-elasticsearch-index-mapper-geopointfieldmapper-and-org-elasticsearch-xpack-ml-extractor-geopointfield/280042)
**Author:** [@drake-jin](https://discuss.elastic.co/u/drake-jin)\ **Replies:** 1\ **Last updated:** [August 2, 2021, 7:50am UTC](https://discuss.elastic.co/t/whats-difference-org-elasticsearch-index-mapper-geopointfieldmapper-and-org-elasticsearch-xpack-ml-extractor-geopointfield/280042 "2021-08-02T07:50:36Z")
I wonder why same role classes are here in elasticsearch repository. What org.elasticsearch.xpack.ml.extractor.GeoPointField is for? What org.elasticsearch.index.mapper.GeoPointFieldMapper is for? Any documents? --- ## [Can I change the system index mapping and enrich it with new fields](https://discuss.elastic.co/t/can-i-change-the-system-index-mapping-and-enrich-it-with-new-fields/280057)
**Author:** [@Divyank\_Mahalle](https://discuss.elastic.co/u/Divyank_Mahalle)\ **Replies:** 1\ **Last updated:** [August 2, 2021, 7:28am UTC](https://discuss.elastic.co/t/can-i-change-the-system-index-mapping-and-enrich-it-with-new-fields/280057 "2021-08-02T07:28:45Z")
Hi, Can I change the mapping of the system index and enrich it with new fields. The current mapping of an index is "dynamic":"strict" and the index is hidden by default and its name starting with "." System index --- ## [Red indices when restoring from snapshot which contains indices in cold phase](https://discuss.elastic.co/t/red-indices-when-restoring-from-snapshot-which-contains-indices-in-cold-phase/279329)
**Author:** [@dimitris\_sb](https://discuss.elastic.co/u/dimitris_sb)\ **Replies:** 8\ **Last updated:** [August 2, 2021, 6:37am UTC](https://discuss.elastic.co/t/red-indices-when-restoring-from-snapshot-which-contains-indices-in-cold-phase/279329 "2021-08-02T06:37:47Z")
Hi All, I got a snapshot in s3 from cluster A (7.11.x) and tried to restore it in cluster B (7.13.x) and noticed that indices in cold nodes e.g. index-data-2021.03 were restored as e.g. restored-shrink-index-data-2021.0… --- ## [Two-Node cluster, switch master node](https://discuss.elastic.co/t/two-node-cluster-switch-master-node/280117)
**Author:** [@TheWorkingDeveloper](https://discuss.elastic.co/u/TheWorkingDeveloper)\ **Replies:** 1\ **Last updated:** [August 2, 2021, 5:49am UTC](https://discuss.elastic.co/t/two-node-cluster-switch-master-node/280117 "2021-08-02T05:49:24Z")
I have an old R710 that I've used as a server for a long time. It's pretty weak and performance is slow. Now I have a second new server that I added as purely a data-node which is appox 10x stronger. I'd like to switch t… --- ## [Data migration from Old to New Cluster](https://discuss.elastic.co/t/data-migration-from-old-to-new-cluster/280143)
**Author:** [@Imad\_Mekkaoui](https://discuss.elastic.co/u/Imad_Mekkaoui)\ **Replies:** 2\ **Last updated:** [August 2, 2021, 5:47am UTC](https://discuss.elastic.co/t/data-migration-from-old-to-new-cluster/280143 "2021-08-02T05:47:45Z")
Hi, I have a running elaticsearch cluster comprised of two (02) nodes (both master and data). I wish to migrate my database to a new cluster comprised of seven (07) nodes (3 Master nodes, 2 Data nodes, 1 Coordinator no… --- ## [How to implement pagination in composite aggregation after removing some buckets based on condition by BucketSelectorAggregation](https://discuss.elastic.co/t/how-to-implement-pagination-in-composite-aggregation-after-removing-some-buckets-based-on-condition-by-bucketselectoraggregation/280168)
**Author:** [@dipuoec](https://discuss.elastic.co/u/dipuoec)\ **Replies:** 0\ **Last updated:** [August 2, 2021, 1:27am UTC](https://discuss.elastic.co/t/how-to-implement-pagination-in-composite-aggregation-after-removing-some-buckets-based-on-condition-by-bucketselectoraggregation/280168 "2021-08-02T01:27:26Z")
I am trying to implement the inbuilt pagination feature available in Elasticsearch composite aggregation on aggregated data. This works perfectly fine until we are not removing certain buckets based on conditions of aggr… --- ## [Benchmarck elastic cluster with rally](https://discuss.elastic.co/t/benchmarck-elastic-cluster-with-rally/279068)
**Author:** [@Abdelhalim](https://discuss.elastic.co/u/Abdelhalim)\ **Replies:** 3\ **Last updated:** [August 1, 2021, 11:53pm UTC](https://discuss.elastic.co/t/benchmarck-elastic-cluster-with-rally/279068 "2021-08-01T23:53:04Z")
Hello, I am going to setup a Prod cluster, I receive 30GB of logs per day (Need to keep the data 1 month in Hot node and 11 months in warm node ) I did some maths, and I am going to use (3 hot nodes and 4 warm nodes ) … --- ## [Ctx.payload.hits NOT working error](https://discuss.elastic.co/t/ctx-payload-hits-not-working-error/280070)
**Author:** [@alex14](https://discuss.elastic.co/u/alex14)\ **Replies:** 1\ **Last updated:** [August 1, 2021, 10:16pm UTC](https://discuss.elastic.co/t/ctx-payload-hits-not-working-error/280070 "2021-08-01T22:16:51Z")
hey there, I´m trying to create a watcher but i need to use some fields from my index to send that information via email but i always get the same error "caused\_by": { "type": "null\_pointer\_exception", "reason": "Cann… --- ## [How to Setup Tenant IDs](https://discuss.elastic.co/t/how-to-setup-tenant-ids/280086)
**Author:** [@Verax](https://discuss.elastic.co/u/Verax)\ **Replies:** 1\ **Last updated:** [August 1, 2021, 10:15pm UTC](https://discuss.elastic.co/t/how-to-setup-tenant-ids/280086 "2021-08-01T22:15:45Z")
Hello, I am looking to create a MSSP and wanted to know the best process for determining whos data is whos and how to see the volume of data ingested by each tenant. Could someone please assist? Many Thanks --- ## [Elasticsearch Plugin Basic Authentication HTTPS Endpoint](https://discuss.elastic.co/t/elasticsearch-plugin-basic-authentication-https-endpoint/280094)
**Author:** [@Chris\_Denneen](https://discuss.elastic.co/u/Chris_Denneen)\ **Replies:** 0\ **Last updated:** [July 30, 2021, 4:05pm UTC](https://discuss.elastic.co/t/elasticsearch-plugin-basic-authentication-https-endpoint/280094 "2021-07-30T16:05:17Z")
As of java 1.8 you can no longer do basic auth against HTTPs endpoint. How can you use creds with bin/elasticsearch-plugin https endpoint? Looks like you need an Authorization header added but how can you do that with … --- ## [Finding missing logs against specific index](https://discuss.elastic.co/t/finding-missing-logs-against-specific-index/280153)
**Author:** [@Bilal\_Malik](https://discuss.elastic.co/u/Bilal_Malik)\ **Replies:** 2\ **Last updated:** [August 1, 2021, 6:57pm UTC](https://discuss.elastic.co/t/finding-missing-logs-against-specific-index/280153 "2021-08-01T18:57:57Z")
Hi All, i have different services, sending logs to elastic search and showing in Kibana. Is there any way to find which service is not sending logs to elastic search? from the existing logs, how i can put filter it show… --- ## [How to achieve CCR for more than 20 indices at once without snapshot](https://discuss.elastic.co/t/how-to-achieve-ccr-for-more-than-20-indices-at-once-without-snapshot/275404)
**Author:** [@Thesupersoftwareguy](https://discuss.elastic.co/u/Thesupersoftwareguy)\ **Replies:** 4\ **Last updated:** [August 1, 2021, 5:18pm UTC](https://discuss.elastic.co/t/how-to-achieve-ccr-for-more-than-20-indices-at-once-without-snapshot/275404 "2021-08-01T17:18:34Z")
Hello, I have multiple indices already created in cluster A and I want them to be replicated to cluster B , is there a way to create those many follower indices without manual effort as it will increase operational load… --- ## [Multiple logs parsing to elastic search directly through filebeat](https://discuss.elastic.co/t/multiple-logs-parsing-to-elastic-search-directly-through-filebeat/280134)
**Author:** [@maduranga\_nessus](https://discuss.elastic.co/u/maduranga_nessus)\ **Replies:** 0\ **Last updated:** [July 31, 2021, 5:24pm UTC](https://discuss.elastic.co/t/multiple-logs-parsing-to-elastic-search-directly-through-filebeat/280134 "2021-07-31T17:24:23Z")
I need to parse multiple log files to an elastic search through a file beat. File beat already installed in this pc and through that file beat nginx already parsing directly to elastic search. I need to parse apache logs… --- ## [Reindex by grouping documents by Unique ID](https://discuss.elastic.co/t/reindex-by-grouping-documents-by-unique-id/280129)
**Author:** [@mrunalini](https://discuss.elastic.co/u/mrunalini)\ **Replies:** 0\ **Last updated:** [July 31, 2021, 3:15pm UTC](https://discuss.elastic.co/t/reindex-by-grouping-documents-by-unique-id/280129 "2021-07-31T15:15:35Z")
Hi Everyone, I want to reindex my Index which has different documents with unique id . I want to reindex all the data into single documents against unique id. is it possible to do that. --- ## [Fluentd performance is degraded](https://discuss.elastic.co/t/fluentd-performance-is-degraded/280060)
**Author:** [@Voula\_Mikr](https://discuss.elastic.co/u/Voula_Mikr)\ **Replies:** 3\ **Last updated:** [July 31, 2021, 6:05am UTC](https://discuss.elastic.co/t/fluentd-performance-is-degraded/280060 "2021-07-31T06:05:31Z")
In a deployment with elasticsearch 8.x, fluentd pod performance has been degraded and following log is printed whenever a new message is received and it is about to be delivered in elastic. warning: 299 Elasticsearch-7.… --- ## [Pre-index data in ingest pipeline](https://discuss.elastic.co/t/pre-index-data-in-ingest-pipeline/280104)
**Author:** [@jjammin92](https://discuss.elastic.co/u/jjammin92)\ **Replies:** 1\ **Last updated:** [July 30, 2021, 10:31pm UTC](https://discuss.elastic.co/t/pre-index-data-in-ingest-pipeline/280104 "2021-07-30T22:31:44Z")
Good afternoon, I have some access style logs with a numeric field "player.score." I'm looking to pre-index these fields to leverage patterns for faster retrieval The values can range anywhere from 0 to 5000 being the… --- ## [Elasticsearch not doing local primary indices recovery after node restart](https://discuss.elastic.co/t/elasticsearch-not-doing-local-primary-indices-recovery-after-node-restart/280101)
**Author:** [@pranav\_sah](https://discuss.elastic.co/u/pranav_sah)\ **Replies:** 0\ **Last updated:** [July 30, 2021, 7:45pm UTC](https://discuss.elastic.co/t/elasticsearch-not-doing-local-primary-indices-recovery-after-node-restart/280101 "2021-07-30T19:45:41Z")
We have a cluster of 6 nodes of which one node was restarted due to some patch activity. Before the node was brought down we had set "cluster.routing.allocation.enable" : "primaries" on persistent level so as to have f… --- ## [Match any character regular expression does not match as expected](https://discuss.elastic.co/t/match-any-character-regular-expression-does-not-match-as-expected/278918)
**Author:** [@alexleen](https://discuss.elastic.co/u/alexleen)\ **Replies:** 6\ **Last updated:** [July 30, 2021, 2:31pm UTC](https://discuss.elastic.co/t/match-any-character-regular-expression-does-not-match-as-expected/278918 "2021-07-30T14:31:45Z")
POST /search\_test/\_doc { "text":"Jack and Jill went up the hill." } GET /search\_test/\_search?q=j%2A GET /search\_test/\_search?q=j... I would expect those two queries to return the same document since both of those regu… --- ## [ML: difference between partition\_field\_name and by\_field\_name?](https://discuss.elastic.co/t/ml-difference-between-partition-field-name-and-by-field-name/280013)
**Author:** [@CameronCenic](https://discuss.elastic.co/u/CameronCenic)\ **Replies:** 3\ **Last updated:** [July 30, 2021, 2:01pm UTC](https://discuss.elastic.co/t/ml-difference-between-partition-field-name-and-by-field-name/280013 "2021-07-30T14:01:24Z")
I do not really understand the difference between these two settings. They seem to perform the same function from my perspective. --- ## [Shard allocation on single node causes cluster overload](https://discuss.elastic.co/t/shard-allocation-on-single-node-causes-cluster-overload/279794)
**Author:** [@Petr.Simik](https://discuss.elastic.co/u/Petr.Simik)\ **Replies:** 3\ **Last updated:** [July 30, 2021, 1:06pm UTC](https://discuss.elastic.co/t/shard-allocation-on-single-node-causes-cluster-overload/279794 "2021-07-30T13:06:12Z")
Cluster creates index with 5 shards on same node. And it picks the node with least disk space. High performance ETL process writes all the data on to single node instead of to 5 multiple nodes. This causes overloads of … [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=598) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=600)