# Elasticsearch

**URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=602

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 603

---

## [Fetching results beyond 10k - scroll/searchAfter](https://discuss.elastic.co/t/fetching-results-beyond-10k-scroll-searchafter/279702)

<div class="topic-metadata">

**Author:** [@mouli\_99](https://discuss.elastic.co/u/mouli_99)\
**Replies:** 4\
**Last updated:** [July 27, 2021, 10:02am UTC](https://discuss.elastic.co/t/fetching-results-beyond-10k-scroll-searchafter/279702 "2021-07-27T10:02:23Z")

</div>

We are on elastic 7.8, we have use case to fetch beyond 10k results are in interactive mode from users on pretty decent scale (say ~40 concurrent hits) We have stumbled upon scroll (everytime open a scroll, retrieve a…

---

## [Latency issues when using nested queries and inner hists](https://discuss.elastic.co/t/latency-issues-when-using-nested-queries-and-inner-hists/279711)

<div class="topic-metadata">

**Author:** [@wedul](https://discuss.elastic.co/u/wedul)\
**Replies:** 0\
**Last updated:** [July 27, 2021, 9:34am UTC](https://discuss.elastic.co/t/latency-issues-when-using-nested-queries-and-inner-hists/279711 "2021-07-27T09:34:47Z")

</div>

I have two questions while using elasticsearch. using version : 7.1.1 index cluster: master node: 5, client node 6, data node 18, 4 shard, 10gb search rate : about 5~600 tps index mapping example: { "mappings": { …

---

## [Update elasticsearch.yml in elastic cloud through API](https://discuss.elastic.co/t/update-elasticsearch-yml-in-elastic-cloud-through-api/279598)

<div class="topic-metadata">

**Author:** [@idelix](https://discuss.elastic.co/u/idelix)\
**Replies:** 3\
**Last updated:** [July 27, 2021, 9:38am UTC](https://discuss.elastic.co/t/update-elasticsearch-yml-in-elastic-cloud-through-api/279598 "2021-07-27T09:38:55Z")

</div>

Hello, I deployed Elastic Cloud in Azure using terraform provider hovewer I cannot use terraform to update elasticsearch.yml (below) since OpenID configuration (Secure your clusters with OpenID Connect | Elasticsearch S…

---

## [Elasticsearch .NET DocumentExists() returns error: Invalid NEST response built from a unsuccessful (200) low level call on HEAD](https://discuss.elastic.co/t/elasticsearch-net-documentexists-returns-error-invalid-nest-response-built-from-a-unsuccessful-200-low-level-call-on-head/278970)

<div class="topic-metadata">

**Author:** [@AdstraCat](https://discuss.elastic.co/u/AdstraCat)\
**Replies:** 1\
**Last updated:** [July 27, 2021, 9:31am UTC](https://discuss.elastic.co/t/elasticsearch-net-documentexists-returns-error-invalid-nest-response-built-from-a-unsuccessful-200-low-level-call-on-head/278970 "2021-07-27T09:31:00Z")

</div>

Hi everyone I have a document already exists in an index in elastic below And here's my C# code for checking if this document exists: ExistsResponse existsResponse = await \_elasticClient.DocumentExistsAsync\<T\>(type…

---

## [Terms aggregation with nested objects performs poorly](https://discuss.elastic.co/t/terms-aggregation-with-nested-objects-performs-poorly/279706)

<div class="topic-metadata">

**Author:** [@pa.pecherskij](https://discuss.elastic.co/u/pa.pecherskij)\
**Replies:** 0\
**Last updated:** [July 27, 2021, 8:50am UTC](https://discuss.elastic.co/t/terms-aggregation-with-nested-objects-performs-poorly/279706 "2021-07-27T08:50:22Z")

</div>

Hello! For one of our scenarios we require to run terms aggregation with script on nested objects to extract ids only from certain nested objects (based on passed mention type and identity data). And from basic load tes…

---

## [Winlogbeat Dashboards mullered](https://discuss.elastic.co/t/winlogbeat-dashboards-mullered/279688)

<div class="topic-metadata">

**Author:** [@insurin](https://discuss.elastic.co/u/insurin)\
**Replies:** 0\
**Last updated:** [July 27, 2021, 6:59am UTC](https://discuss.elastic.co/t/winlogbeat-dashboards-mullered/279688 "2021-07-27T06:59:59Z")

</div>

Hello all. After recovering my ELK server back to normal operation after I increased disk space and deleted one of my main winlogbeat indices which was 650gb, I can now see a new winlogbeat-7-12-1 growing in size. I have…

---

## [Manual delete of indices on elastic search not freeing up space](https://discuss.elastic.co/t/manual-delete-of-indices-on-elastic-search-not-freeing-up-space/279686)

<div class="topic-metadata">

**Author:** [@save4elastic](https://discuss.elastic.co/u/save4elastic)\
**Replies:** 2\
**Last updated:** [July 27, 2021, 5:47am UTC](https://discuss.elastic.co/t/manual-delete-of-indices-on-elastic-search-not-freeing-up-space/279686 "2021-07-27T05:47:37Z")

</div>

I have 2TB of indices. It just hit the flood stage watermark. I resolved this via CURL and now it allows manually deleting some indices. It removes them from Kibana, etc. I can delete it via curl or Kibana and it is ackn…

---

## [External SSL for inter-node communication](https://discuss.elastic.co/t/external-ssl-for-inter-node-communication/279662)

<div class="topic-metadata">

**Author:** [@mesudip](https://discuss.elastic.co/u/mesudip)\
**Replies:** 1\
**Last updated:** [July 27, 2021, 3:29am UTC](https://discuss.elastic.co/t/external-ssl-for-inter-node-communication/279662 "2021-07-27T03:29:23Z")

</div>

Hi, I am on elasticsearch-7.13, and for rules section I am getting message " You must enable Transport Layer Security between Elasticsearch and kibana". I've enabled SSL with let'sencrypt certificate on a nginx revers…

---

## [Index value to be used across different index patterns](https://discuss.elastic.co/t/index-value-to-be-used-across-different-index-patterns/279676)

<div class="topic-metadata">

**Author:** [@IsAa](https://discuss.elastic.co/u/IsAa)\
**Replies:** 1\
**Last updated:** [July 27, 2021, 12:39am UTC](https://discuss.elastic.co/t/index-value-to-be-used-across-different-index-patterns/279676 "2021-07-27T00:39:39Z")

</div>

Hi, I understand that if you have a dashboard with multiple index patterns. If you use the search field and apply filter to any of the fields; if that field exists in other indices too it will apply that filter i.e. se…

---

## [Cannot update parameter analyzer from autocomplete to default](https://discuss.elastic.co/t/cannot-update-parameter-analyzer-from-autocomplete-to-default/277257)

<div class="topic-metadata">

**Author:** [@Luiz\_Firmino](https://discuss.elastic.co/u/Luiz_Firmino)\
**Replies:** 4\
**Last updated:** [July 26, 2021, 11:04pm UTC](https://discuss.elastic.co/t/cannot-update-parameter-analyzer-from-autocomplete-to-default/277257 "2021-07-26T23:04:21Z")

</div>

Hello all, I have no prior knowledge on ES and I'm trying to make an old code written for elasticsearch 6.5 to work on the 7.3 version. So far I got the code updated and running however I can't understand why during re-…

---

## [Kibana Scripted field : Not able to parse the String to Double/Int](https://discuss.elastic.co/t/kibana-scripted-field-not-able-to-parse-the-string-to-double-int/279590)

<div class="topic-metadata">

**Author:** [@Rohit\_Dwivedi](https://discuss.elastic.co/u/Rohit_Dwivedi)\
**Replies:** 0\
**Last updated:** [July 26, 2021, 5:24am UTC](https://discuss.elastic.co/t/kibana-scripted-field-not-able-to-parse-the-string-to-double-int/279590 "2021-07-26T05:24:44Z")

</div>

I am getting one weired error. I have field called no\_of\_scanned value which is String in Kibana The data look like 1234 4567 etc I cant do some aggregation so trying to convert this into int/double . SO I created a s…

---

## [Possible to have a health check url without authentication](https://discuss.elastic.co/t/possible-to-have-a-health-check-url-without-authentication/279564)

<div class="topic-metadata">

**Author:** [@f1outsourcing](https://discuss.elastic.co/u/f1outsourcing)\
**Replies:** 3\
**Last updated:** [July 26, 2021, 10:04pm UTC](https://discuss.elastic.co/t/possible-to-have-a-health-check-url-without-authentication/279564 "2021-07-26T22:04:50Z")

</div>

My container monitoring environment does not allow me to specify username and password for the health check url option. Is it possible to disable this for a specific url or 127.0.0.1 still having the xpack.security.enab…

---

## [What this query mean?](https://discuss.elastic.co/t/what-this-query-mean/279669)

<div class="topic-metadata">

**Author:** [@rgelb](https://discuss.elastic.co/u/rgelb)\
**Replies:** 0\
**Last updated:** [July 26, 2021, 9:49pm UTC](https://discuss.elastic.co/t/what-this-query-mean/279669 "2021-07-26T21:49:20Z")

</div>

I've inherited a project with the following query: POST listings/\_search { "aggs": { "gridcells": { "aggs": { "latlons": { "aggs": { "latStats": { "stats": { …

---

## [How to replace objects in documents?](https://discuss.elastic.co/t/how-to-replace-objects-in-documents/279657)

<div class="topic-metadata">

**Author:** [@nahh](https://discuss.elastic.co/u/nahh)\
**Replies:** 4\
**Last updated:** [July 26, 2021, 7:15pm UTC](https://discuss.elastic.co/t/how-to-replace-objects-in-documents/279657 "2021-07-26T19:15:32Z")

</div>

This may be a bug, but if not it's undocumented behavior (see Object field type). I accidentally created some objects with properties I don't want them to have, and I need to remove them. The object is dynamic and looks …

---

## [Benchmarking cluster with rally](https://discuss.elastic.co/t/benchmarking-cluster-with-rally/279475)

<div class="topic-metadata">

**Author:** [@Abdelhalim](https://discuss.elastic.co/u/Abdelhalim)\
**Replies:** 2\
**Last updated:** [July 26, 2021, 5:09pm UTC](https://discuss.elastic.co/t/benchmarking-cluster-with-rally/279475 "2021-07-26T17:09:37Z")

</div>

Hello, I have set a development cluster with 3 master Nodes, 2 hot data nodes and 1 warm node, and I wanted to benchmark it to reproduce results which looks like the results got in here : Benchmarking and sizing your E…

---

## [Why is first index creation each day slower?](https://discuss.elastic.co/t/why-is-first-index-creation-each-day-slower/279096)

<div class="topic-metadata">

**Author:** [@lbarker\_q](https://discuss.elastic.co/u/lbarker_q)\
**Replies:** 6\
**Last updated:** [July 26, 2021, 4:54pm UTC](https://discuss.elastic.co/t/why-is-first-index-creation-each-day-slower/279096 "2021-07-26T16:54:19Z")

</div>

Hello On various Elasticsearch deployments I am finding that the first time I create a document in a new index each day (or at least in a long period of time) the response time is much higher. In these cases the total r…

---

## [Query performance- filter aggregation with the same filter improve performance drastically](https://discuss.elastic.co/t/query-performance-filter-aggregation-with-the-same-filter-improve-performance-drastically/279618)

<div class="topic-metadata">

**Author:** [@alexs1](https://discuss.elastic.co/u/alexs1)\
**Replies:** 4\
**Last updated:** [July 26, 2021, 1:47pm UTC](https://discuss.elastic.co/t/query-performance-filter-aggregation-with-the-same-filter-improve-performance-drastically/279618 "2021-07-26T13:47:12Z")

</div>

Can anyone explain why the left (pseudo) query runs above 5s the while the right part in 30ms? The filters in the example below, are identical (aggs/ query filters). isn't the aggregation part suppose to run on filtere…

---

## [How to use Elasticsearch from a SPA?](https://discuss.elastic.co/t/how-to-use-elasticsearch-from-a-spa/279522)

<div class="topic-metadata">

**Author:** [@kazza](https://discuss.elastic.co/u/kazza)\
**Replies:** 3\
**Last updated:** [July 26, 2021, 12:23pm UTC](https://discuss.elastic.co/t/how-to-use-elasticsearch-from-a-spa/279522 "2021-07-26T12:23:19Z")

</div>

I have been wondering what is the best practice when wanting to query Elasticsearch directly from browser javascript. E.g. such as a React/VueJS/Angular application. I hoped that it would be possible to use a standard o…

---

## [NoShardAvailableActionException Error on ElasticSearch on Docker](https://discuss.elastic.co/t/noshardavailableactionexception-error-on-elasticsearch-on-docker/279555)

<div class="topic-metadata">

**Author:** [@panagiss](https://discuss.elastic.co/u/panagiss)\
**Replies:** 2\
**Last updated:** [July 26, 2021, 11:52am UTC](https://discuss.elastic.co/t/noshardavailableactionexception-error-on-elasticsearch-on-docker/279555 "2021-07-26T11:52:49Z")

</div>

I set up basic security for the Elastic Stack plus secured HTTPS traffic recently and i encrypted all communication between the elastic nodes even though i use only one node. The thins is now kibana will have this error…

---

## [ES is getting killed :(](https://discuss.elastic.co/t/es-is-getting-killed/279354)

<div class="topic-metadata">

**Author:** [@kamal\_khushi](https://discuss.elastic.co/u/kamal_khushi)\
**Replies:** 13\
**Last updated:** [July 26, 2021, 11:39am UTC](https://discuss.elastic.co/t/es-is-getting-killed/279354 "2021-07-26T11:39:12Z")

</div>

OS:-ubuntu ram:-16gb Storage:-500GB CPU:-i5 10th gen i have Cloned ES in two different directory : Es1 Es2 Then first i launched Es1/bin/elastisearch And next i launched Es2/bin/elastisearch while Es2 is launchi…

---

## [Lfd on Server: Suspicious File Alert](https://discuss.elastic.co/t/lfd-on-server-suspicious-file-alert/279541)

<div class="topic-metadata">

**Author:** [@NileYouth](https://discuss.elastic.co/u/NileYouth)\
**Replies:** 3\
**Last updated:** [July 26, 2021, 9:35am UTC](https://discuss.elastic.co/t/lfd-on-server-suspicious-file-alert/279541 "2021-07-26T09:35:44Z")

</div>

I have got many suspiction on CSF notfication can any one help in this or how can I exclode this files Time: Sat Jul 24 20:25:39 2021 +0200 File: /tmp/systemd-private-07b3a323be3d4e5e9196051704fa4e9b-elasticsearch.s…

---

## [Disk space issues on 7.10](https://discuss.elastic.co/t/disk-space-issues-on-7-10/279584)

<div class="topic-metadata">

**Author:** [@Russell\_Fulton](https://discuss.elastic.co/u/Russell_Fulton)\
**Replies:** 4\
**Last updated:** [July 26, 2021, 8:54am UTC](https://discuss.elastic.co/t/disk-space-issues-on-7-10/279584 "2021-07-26T08:54:51Z")

</div>

I have two more or less identical servers in my cluster that each have 3 disks in the data\_path each with 1.5TB. Recently one of the server has started running out of disk on one of the three disks (the first in the li…

---

## [Heap usage](https://discuss.elastic.co/t/heap-usage/279149)

<div class="topic-metadata">

**Author:** [@Abhishek\_Shinde](https://discuss.elastic.co/u/Abhishek_Shinde)\
**Replies:** 2\
**Last updated:** [July 26, 2021, 8:42am UTC](https://discuss.elastic.co/t/heap-usage/279149 "2021-07-26T08:42:21Z")

</div>

I'm trying to understand how Elasticsearch uses heap while performing the searches. Does it load entire shard into memory or particular segment for searching the users data?

---

## [How to add a field to the result of the aggregation](https://discuss.elastic.co/t/how-to-add-a-field-to-the-result-of-the-aggregation/279581)

<div class="topic-metadata">

**Author:** [@wajika](https://discuss.elastic.co/u/wajika)\
**Replies:** 2\
**Last updated:** [July 26, 2021, 8:24am UTC](https://discuss.elastic.co/t/how-to-add-a-field-to-the-result-of-the-aggregation/279581 "2021-07-26T08:24:26Z")

</div>

I wrote an aggregation, and it meets my requirements, but I also need to add a field (trace.id) when the results are displayed. Trace.id does not need to be aggregated. How should dsl be written in this case? Can an…

---

## [Report mail every day](https://discuss.elastic.co/t/report-mail-every-day/279601)

<div class="topic-metadata">

**Author:** [@bilel\_meddeb](https://discuss.elastic.co/u/bilel_meddeb)\
**Replies:** 0\
**Last updated:** [July 26, 2021, 7:54am UTC](https://discuss.elastic.co/t/report-mail-every-day/279601 "2021-07-26T07:54:37Z")

</div>

hello, i need help please I'm new in elasticsearch. I want to create (report or mail) that be generated every day at 07h. This report should contain all alert generated all the night thx

---

## [Elasticsearch will return a decreased 'hits total' value](https://discuss.elastic.co/t/elasticsearch-will-return-a-decreased-hits-total-value/279556)

<div class="topic-metadata">

**Author:** [@wangqinghuan](https://discuss.elastic.co/u/wangqinghuan)\
**Replies:** 1\
**Last updated:** [July 26, 2021, 7:44am UTC](https://discuss.elastic.co/t/elasticsearch-will-return-a-decreased-hits-total-value/279556 "2021-07-26T07:44:53Z")

</div>

Hi community I have a flink job which will consume Kafka message and load into Elasticsearch. In order to monitor the number of documents loaded into Elasticsearch, I write a DSL to get the 'hits total' in Elasticsearc…

---

## [After securing elasticsearch cluster uuid not found](https://discuss.elastic.co/t/after-securing-elasticsearch-cluster-uuid-not-found/279594)

<div class="topic-metadata">

**Author:** [@Salim\_Adnan](https://discuss.elastic.co/u/Salim_Adnan)\
**Replies:** 2\
**Last updated:** [July 26, 2021, 7:39am UTC](https://discuss.elastic.co/t/after-securing-elasticsearch-cluster-uuid-not-found/279594 "2021-07-26T07:39:43Z")

</div>

i have create 4 elastice node all are working find before securing them after securing my cluster uuid not working i detach-cluster my cluster but the problem not solve etc i do following command \> cd /usr/share/elast…

---

## [Caused by: java.net.UnknownHostException: fx-elasticsearch: Name does not resolve](https://discuss.elastic.co/t/caused-by-java-net-unknownhostexception-fx-elasticsearch-name-does-not-resolve/279596)

<div class="topic-metadata">

**Author:** [@MdRashid](https://discuss.elastic.co/u/MdRashid)\
**Replies:** 5\
**Last updated:** [July 26, 2021, 7:33am UTC](https://discuss.elastic.co/t/caused-by-java-net-unknownhostexception-fx-elasticsearch-name-does-not-resolve/279596 "2021-07-26T07:33:58Z")

</div>

Hi All, I have issue of fx-elasticsearch not found and i have deploy as docker compose file one more error i got in same container Caused by: org.springframework.beans.factory.BeanCreationException: Error creating bea…

---

## [Search/match multiple fields in Elasticsearch](https://discuss.elastic.co/t/search-match-multiple-fields-in-elasticsearch/279448)

<div class="topic-metadata">

**Author:** [@noetic](https://discuss.elastic.co/u/noetic)\
**Replies:** 1\
**Last updated:** [July 26, 2021, 7:32am UTC](https://discuss.elastic.co/t/search-match-multiple-fields-in-elasticsearch/279448 "2021-07-26T07:32:10Z")

</div>

I'm trying to build a query in Elasticsearch with PHP combining an exact match and search by keywords/text. I'm using the should for an exact match, and for text, I'm using the term match. My query is: $params = \[ '…

---

## [Elasticsearch Bulk Insert through Python Client API](https://discuss.elastic.co/t/elasticsearch-bulk-insert-through-python-client-api/279032)

<div class="topic-metadata">

**Author:** [@Anirudhan](https://discuss.elastic.co/u/Anirudhan)\
**Replies:** 7\
**Last updated:** [July 26, 2021, 7:24am UTC](https://discuss.elastic.co/t/elasticsearch-bulk-insert-through-python-client-api/279032 "2021-07-26T07:24:59Z")

</div>

Dear Team, I am trying to bulk insert 3000 records into an elastic search using BULK API. Whichever documents having the keyword version are not being inserted. For eg: \[{"name": "XXXX", "description": "XXXX", "\_id": …

[Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=601)

[Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=603)
