# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=604 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 605 --- ## [Aggregation Pagination](https://discuss.elastic.co/t/aggregation-pagination/279444)
**Author:** [@raonic](https://discuss.elastic.co/u/raonic)\ **Replies:** 0\ **Last updated:** [July 23, 2021, 4:07am UTC](https://discuss.elastic.co/t/aggregation-pagination/279444 "2021-07-23T04:07:53Z")
Hello, I am using ElasticSearch aggregations to group results. More specifically, I am using a composite aggregation at the top level and then using a bucket selector sub-aggregation to determine what buckets are to be … --- ## [When I set bootstrap.memory\_lock: true in ES cluster for k8s failed](https://discuss.elastic.co/t/when-i-set-bootstrap-memory-lock-true-in-es-cluster-for-k8s-failed/279441)
**Author:** [@plata37](https://discuss.elastic.co/u/plata37)\ **Replies:** 1\ **Last updated:** [July 23, 2021, 3:31am UTC](https://discuss.elastic.co/t/when-i-set-bootstrap-memory-lock-true-in-es-cluster-for-k8s-failed/279441 "2021-07-23T03:31:25Z")
the k8s yaml is below: ··· apiVersion: v1 kind: Service metadata: name: elasticsearch-headless labels: app: elasticsearch-headless spec: selector: app: elasticsearch ports: protocol: TCP port: 9300 targetP… --- ## [Execute reindex and the task is not found](https://discuss.elastic.co/t/execute-reindex-and-the-task-is-not-found/279414)
**Author:** [@asasas234](https://discuss.elastic.co/u/asasas234)\ **Replies:** 4\ **Last updated:** [July 23, 2021, 2:40am UTC](https://discuss.elastic.co/t/execute-reindex-and-the-task-is-not-found/279414 "2021-07-23T02:40:37Z")
First I execute the reindex POST \_reindex?wait\_for\_completion=false { "conflicts": "proceed", "source": { "index": "wh\_crm\_student\_order\_2020.11.09" }, "dest": { "index": "wh\_crm\_student\_order\_new\_2020.1… --- ## [How to show timestamp difference between max and min in data table](https://discuss.elastic.co/t/how-to-show-timestamp-difference-between-max-and-min-in-data-table/279347)
**Author:** [@byun618](https://discuss.elastic.co/u/byun618)\ **Replies:** 0\ **Last updated:** [July 22, 2021, 6:51am UTC](https://discuss.elastic.co/t/how-to-show-timestamp-difference-between-max-and-min-in-data-table/279347 "2021-07-22T06:51:41Z")
hello everyone i did show max timestamp and min stamp of each orderId. i want to show difference of them. i did in dev tools with this query. GET /toss-v2-confirmed-confirm\_response/\_search { "aggs": { "grou… --- ## [The target principal name is incorrect](https://discuss.elastic.co/t/the-target-principal-name-is-incorrect/279113)
**Author:** [@sunilr](https://discuss.elastic.co/u/sunilr)\ **Replies:** 2\ **Last updated:** [July 22, 2021, 9:48pm UTC](https://discuss.elastic.co/t/the-target-principal-name-is-incorrect/279113 "2021-07-22T21:48:38Z")
I am using these below settings and newly created certificate for setting up Transport and HTTP security. My setting in elasticsearch.yml is as below: xpack.security.enabled : True xpack.security.transport.ssl.enabl… --- ## [Split the field and add the fields dynamically in ingest pipeline](https://discuss.elastic.co/t/split-the-field-and-add-the-fields-dynamically-in-ingest-pipeline/279416)
**Author:** [@anjilinga](https://discuss.elastic.co/u/anjilinga)\ **Replies:** 0\ **Last updated:** [July 22, 2021, 4:57pm UTC](https://discuss.elastic.co/t/split-the-field-and-add-the-fields-dynamically-in-ingest-pipeline/279416 "2021-07-22T16:57:12Z")
Hi Team, We have scenario like audio files field with the values as path1,path2,path3 ( the number of paths are dynamic), In ingest pipeline need to split this field and create audio1 =path1, audio2=path2, audio3=path3… --- ## [ElasticSearch - Match or less](https://discuss.elastic.co/t/elasticsearch-match-or-less/279341)
**Author:** [@zhadad](https://discuss.elastic.co/u/zhadad)\ **Replies:** 2\ **Last updated:** [July 22, 2021, 4:05pm UTC](https://discuss.elastic.co/t/elasticsearch-match-or-less/279341 "2021-07-22T16:05:25Z")
is there an way to query the following using elasticsearch (version 2) : indexed documents examples : {\_id=1 , "tags": \[ "t1"\]} {\_id=2 , "tags": \[ "t1", "t2" \]} {\_id=3 , "tags": \[ "t1", "t2", "t3" \]} The followin… --- ## [Job for elasticsearch.service failed because the control process exited with error code. See "systemctl status elasticsearch.service" and "journalctl -xe" for details](https://discuss.elastic.co/t/job-for-elasticsearch-service-failed-because-the-control-process-exited-with-error-code-see-systemctl-status-elasticsearch-service-and-journalctl-xe-for-details/279405)
**Author:** [@scriptdil](https://discuss.elastic.co/u/scriptdil)\ **Replies:** 1\ **Last updated:** [July 22, 2021, 3:51pm UTC](https://discuss.elastic.co/t/job-for-elasticsearch-service-failed-because-the-control-process-exited-with-error-code-see-systemctl-status-elasticsearch-service-and-journalctl-xe-for-details/279405 "2021-07-22T15:51:37Z")
Hi i am new here. I have been trying to install Elastic search on a second server without success. I cant figure out what is wrong Error Message: Job for elasticsearch.service failed because the control process exited … --- ## [Float value is matched as integer](https://discuss.elastic.co/t/float-value-is-matched-as-integer/279406)
**Author:** [@Leuteris](https://discuss.elastic.co/u/Leuteris)\ **Replies:** 0\ **Last updated:** [July 22, 2021, 3:22pm UTC](https://discuss.elastic.co/t/float-value-is-matched-as-integer/279406 "2021-07-22T15:22:07Z")
I've indexed the following document: { "\_index": "index\_name", "\_type": "\_doc", "\_id": "ePvEB-X7TNSfKMdwxOcGTw", "\_score": 1.0, "\_source"… --- ## [Boosting per field and index when searching multiple indexes](https://discuss.elastic.co/t/boosting-per-field-and-index-when-searching-multiple-indexes/279287)
**Author:** [@bsharma](https://discuss.elastic.co/u/bsharma)\ **Replies:** 1\ **Last updated:** [July 22, 2021, 3:09pm UTC](https://discuss.elastic.co/t/boosting-per-field-and-index-when-searching-multiple-indexes/279287 "2021-07-22T15:09:27Z")
I am searching multiple indexes. I want to be able to boost specific fields of specific indexes. I could not find a way to specify boost for a field of a index. I found examples in documentation where boosts are specifie… --- ## [Email alert body readable format](https://discuss.elastic.co/t/email-alert-body-readable-format/279344)
**Author:** [@saswatmishra94](https://discuss.elastic.co/u/saswatmishra94)\ **Replies:** 0\ **Last updated:** [July 22, 2021, 6:26am UTC](https://discuss.elastic.co/t/email-alert-body-readable-format/279344 "2021-07-22T06:26:02Z")
Hi All , I have been recently introduced to ELK and been working on it for last 3-4 weeks . This is a totally new integration we are doing . I have gone through lot of articles which helped me a lot in achieving differe… --- ## [Elasticsearch lookup email from different index](https://discuss.elastic.co/t/elasticsearch-lookup-email-from-different-index/279302)
**Author:** [@Jathin](https://discuss.elastic.co/u/Jathin)\ **Replies:** 1\ **Last updated:** [July 22, 2021, 3:03pm UTC](https://discuss.elastic.co/t/elasticsearch-lookup-email-from-different-index/279302 "2021-07-22T15:03:38Z")
PUT audit/doc { "userid": "some\_guid", "operation": "performed action a" } PUT audit/doc { "userid": "some\_guid", "operation": "performed action b" } PUT audit/doc { "userid": "some\_guid", "operation": "performed action… --- ## [Best way to parse response from /\_nodes/stats API using java](https://discuss.elastic.co/t/best-way-to-parse-response-from-nodes-stats-api-using-java/279356)
**Author:** [@Praveen\_Atluri](https://discuss.elastic.co/u/Praveen_Atluri)\ **Replies:** 1\ **Last updated:** [July 22, 2021, 2:53pm UTC](https://discuss.elastic.co/t/best-way-to-parse-response-from-nodes-stats-api-using-java/279356 "2021-07-22T14:53:00Z")
I am trying to write a java program which frequently calls the /\_nodes/stats endpoint and other metrics endpoints and plot them. What is the best way to parse the output from above endpoints and extract specific data fro… --- ## [Applying a filter to the last x nested documents in the selected period, to find if one of them match a condition](https://discuss.elastic.co/t/applying-a-filter-to-the-last-x-nested-documents-in-the-selected-period-to-find-if-one-of-them-match-a-condition/279399)
**Author:** [@ChqThomas](https://discuss.elastic.co/u/ChqThomas)\ **Replies:** 0\ **Last updated:** [July 22, 2021, 2:48pm UTC](https://discuss.elastic.co/t/applying-a-filter-to-the-last-x-nested-documents-in-the-selected-period-to-find-if-one-of-them-match-a-condition/279399 "2021-07-22T14:48:40Z")
Hi, I'm trying to retrieve the number of users who bought the product "123" at least once in their last three sales in the selected period. With this data structure : mapping : { "properties": { "user\_id": { … --- ## [ILM policy keeps reverting - disabling delete phase](https://discuss.elastic.co/t/ilm-policy-keeps-reverting-disabling-delete-phase/279317)
**Author:** [@mw77](https://discuss.elastic.co/u/mw77)\ **Replies:** 1\ **Last updated:** [July 22, 2021, 2:33pm UTC](https://discuss.elastic.co/t/ilm-policy-keeps-reverting-disabling-delete-phase/279317 "2021-07-22T14:33:34Z")
Hi Guys, I have create a ILM policy which has around 90 indices attached to it. from the UI I have created a policy and below is the request when I click on show request. I am enabling the delete phase after rollover … --- ## [Filter Script with array](https://discuss.elastic.co/t/filter-script-with-array/279190)
**Author:** [@hdlinh1808](https://discuss.elastic.co/u/hdlinh1808)\ **Replies:** 3\ **Last updated:** [July 22, 2021, 2:29pm UTC](https://discuss.elastic.co/t/filter-script-with-array/279190 "2021-07-22T14:29:42Z")
Hi everyone, I have a question about filter script for array in ES I have documents or schema like this: { "name": "linh", "array": \[ { "ts": 1, … --- ## [\_search filter data: is possible to do this?](https://discuss.elastic.co/t/search-filter-data-is-possible-to-do-this/279387)
**Author:** [@Marcsu](https://discuss.elastic.co/u/Marcsu)\ **Replies:** 1\ **Last updated:** [July 22, 2021, 2:27pm UTC](https://discuss.elastic.co/t/search-filter-data-is-possible-to-do-this/279387 "2021-07-22T14:27:57Z")
Hi, I'm trying to return only content that do match with a specific field value and not return the rest data of document... I mean, I try to realize a filter over data of document. I'm new in ES. Some idea to do that… --- ## [Get The id of the ES document created by FSCrawler](https://discuss.elastic.co/t/get-the-id-of-the-es-document-created-by-fscrawler/278939)
**Author:** [@Francois\_Saab](https://discuss.elastic.co/u/Francois_Saab)\ **Replies:** 1\ **Last updated:** [July 22, 2021, 2:20pm UTC](https://discuss.elastic.co/t/get-the-id-of-the-es-document-created-by-fscrawler/278939 "2021-07-22T14:20:57Z")
When FSCrawler sends a document to ES, i need to associate the \_id of the doc created by FSCrawler with an internal ID in our DB. How to get the \_id of the doc created by FSCrawler each time a new document is being inde… --- ## [Autocomplete best match is not first in results](https://discuss.elastic.co/t/autocomplete-best-match-is-not-first-in-results/279186)
**Author:** [@net](https://discuss.elastic.co/u/net)\ **Replies:** 3\ **Last updated:** [July 22, 2021, 1:35pm UTC](https://discuss.elastic.co/t/autocomplete-best-match-is-not-first-in-results/279186 "2021-07-22T13:35:02Z")
When I search for "charles sta" the first result in the list is "U.S. Dept. of State, Office of Logistics Management, Charleston" and the second result is "Charles Stark Draper Laboratory, Inc. (CSDL)" The second result… --- ## [How to read the body (json data) of the request in a custom plugin](https://discuss.elastic.co/t/how-to-read-the-body-json-data-of-the-request-in-a-custom-plugin/279375)
**Author:** [@shadowfox38](https://discuss.elastic.co/u/shadowfox38)\ **Replies:** 2\ **Last updated:** [July 22, 2021, 12:37pm UTC](https://discuss.elastic.co/t/how-to-read-the-body-json-data-of-the-request-in-a-custom-plugin/279375 "2021-07-22T12:37:17Z")
I am trying to create a custom plugin which needs to read the body of the request (by body i mean json data that is sent along with the request) so i should be able to read the json data of a request like POST myendpoi… --- ## [How to export forecast data into a destination index](https://discuss.elastic.co/t/how-to-export-forecast-data-into-a-destination-index/279380)
**Author:** [@StephaneB](https://discuss.elastic.co/u/StephaneB)\ **Replies:** 0\ **Last updated:** [July 22, 2021, 12:30pm UTC](https://discuss.elastic.co/t/how-to-export-forecast-data-into-a-destination-index/279380 "2021-07-22T12:30:42Z")
Hello, I'm currently using API to create job, datafeed and associated forecast in order to determine if some predicted values will exceed a specific threshold in the next weeks: if no value exceeds the threshold then … --- ## [How to parse smile serialized files (files with .dat) (files with snap-\* and meta-\* prefixes)](https://discuss.elastic.co/t/how-to-parse-smile-serialized-files-files-with-dat-files-with-snap-and-meta-prefixes/278621)
**Author:** [@shadowfox38](https://discuss.elastic.co/u/shadowfox38)\ **Replies:** 17\ **Last updated:** [July 22, 2021, 11:54am UTC](https://discuss.elastic.co/t/how-to-parse-smile-serialized-files-files-with-dat-files-with-snap-and-meta-prefixes/278621 "2021-07-22T11:54:27Z")
When Elastic search snapshot deletes fail in between, some dangling indexes are left, which increase the size of the repository. I wanted to find such indexes by referring to the snapshot metadata files. I need help in … --- ## [ES is getting killed :(](https://discuss.elastic.co/t/es-is-getting-killed/279362)
**Author:** [@kamal\_khushi](https://discuss.elastic.co/u/kamal_khushi)\ **Replies:** 2\ **Last updated:** [July 22, 2021, 9:40am UTC](https://discuss.elastic.co/t/es-is-getting-killed/279362 "2021-07-22T09:40:29Z")
OS:-ubuntu ram:-16gb Storage:-500GB CPU:-i5 10th gen i have Cloned ES in two different directory : Es1 Es2 Then first i launched Es1/bin/elastisearch And next i launched Es2/bin/elastisearch while Es2 is launchi… --- ## [Filtering on a property of the first element in a Nested property array](https://discuss.elastic.co/t/filtering-on-a-property-of-the-first-element-in-a-nested-property-array/279298)
**Author:** [@Sikelela\_Nkohla](https://discuss.elastic.co/u/Sikelela_Nkohla)\ **Replies:** 1\ **Last updated:** [July 22, 2021, 7:54am UTC](https://discuss.elastic.co/t/filtering-on-a-property-of-the-first-element-in-a-nested-property-array/279298 "2021-07-22T07:54:52Z")
We have the following document structure : "Document" : { "arvTreatmentStarted" : "started", "followUps" : \[ { "followUpDate" : "2012-01-01", "arvDrugs" : { "dispenseDoseQuantity" : "30", "dispenseDoseDaysSupply… --- ## [Esrally giving multiple search queries in the same track.json](https://discuss.elastic.co/t/esrally-giving-multiple-search-queries-in-the-same-track-json/279184)
**Author:** [@Sameera\_De\_Silva](https://discuss.elastic.co/u/Sameera_De_Silva)\ **Replies:** 4\ **Last updated:** [July 22, 2021, 7:25am UTC](https://discuss.elastic.co/t/esrally-giving-multiple-search-queries-in-the-same-track-json/279184 "2021-07-22T07:25:27Z")
Could we give multiple search queries in the same track.json I want to give 2 queries which given below/ So I added it in several places in different ways to organize it . However, when I validate the .json , I get … --- ## [Installing specific elasticsearch version in Homebrew - Mac OS](https://discuss.elastic.co/t/installing-specific-elasticsearch-version-in-homebrew-mac-os/278586)
**Author:** [@Sandeep\_Raju](https://discuss.elastic.co/u/Sandeep_Raju)\ **Replies:** 3\ **Last updated:** [July 22, 2021, 6:33am UTC](https://discuss.elastic.co/t/installing-specific-elasticsearch-version-in-homebrew-mac-os/278586 "2021-07-22T06:33:12Z")
Hi all, I'm having trouble in installing specific versions of elasticsearch in mac OS using Homebrew. In Homebrew, I can only install the latest version which is available. If I want to install a version eg: 7.13.2 , … --- ## [I want to show time diff](https://discuss.elastic.co/t/i-want-to-show-time-diff/279342)
**Author:** [@byun618](https://discuss.elastic.co/u/byun618)\ **Replies:** 0\ **Last updated:** [July 22, 2021, 6:19am UTC](https://discuss.elastic.co/t/i-want-to-show-time-diff/279342 "2021-07-22T06:19:54Z")
hello every one. this is the data. and i want to show time diff between max and min. p.s this is my first post. so feel free to comment about my post 'form', 'rule' or something --- ## [Search through encrypted data](https://discuss.elastic.co/t/search-through-encrypted-data/278922)
**Author:** [@Roman\_Kagan](https://discuss.elastic.co/u/Roman_Kagan)\ **Replies:** 1\ **Last updated:** [July 22, 2021, 4:41am UTC](https://discuss.elastic.co/t/search-through-encrypted-data/278922 "2021-07-22T04:41:30Z")
Hello: Apparently, in healthcare, the new stipulation evolving - to encrypt the PHI data (no, not the disk - data) - so no one would be able to get the data in cleartext. I know, I know devs can decrypt the data if the… --- ## [Multiple nodes of ElasticSearch](https://discuss.elastic.co/t/multiple-nodes-of-elasticsearch/279219)
**Author:** [@DwiAnugrahHendrawan](https://discuss.elastic.co/u/DwiAnugrahHendrawan)\ **Replies:** 1\ **Last updated:** [July 21, 2021, 8:42pm UTC](https://discuss.elastic.co/t/multiple-nodes-of-elasticsearch/279219 "2021-07-21T20:42:38Z")
Hi there, I am trying to find out, what license I need to implement multiple nodes of elasticsearch and example I have 3 nodes those that means I have 1 primary nodes and 2 secondary nodes, and the secondary nodes sta… --- ## [Combining two data sources into one or making a parent and child relation with two different sources](https://discuss.elastic.co/t/combining-two-data-sources-into-one-or-making-a-parent-and-child-relation-with-two-different-sources/279089)
**Author:** [@edster](https://discuss.elastic.co/u/edster)\ **Replies:** 2\ **Last updated:** [July 21, 2021, 7:05pm UTC](https://discuss.elastic.co/t/combining-two-data-sources-into-one-or-making-a-parent-and-child-relation-with-two-different-sources/279089 "2021-07-21T19:05:54Z")
Hello, So just to set some context around this. We are trying to work around the limitation of returning only at most 10k results during a search and with filters due to having an immense amount of data and it also comi… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=603) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=605)