# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=608 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 609 --- ## [Data redundancy with a single nested level vs multilevel nested document](https://discuss.elastic.co/t/data-redundancy-with-a-single-nested-level-vs-multilevel-nested-document/278471)
**Author:** [@sai\_Yeluri](https://discuss.elastic.co/u/sai_Yeluri)\ **Replies:** 5\ **Last updated:** [July 15, 2021, 1:04pm UTC](https://discuss.elastic.co/t/data-redundancy-with-a-single-nested-level-vs-multilevel-nested-document/278471 "2021-07-15T13:04:10Z")
Is it better to have a data redundancy with single nested object or maintain multilevel nested document? There are performance concerns when nested types are used, as per elasticsearch documentation Nested field type | … --- ## [Running ELK Services as Root](https://discuss.elastic.co/t/running-elk-services-as-root/278673)
**Author:** [@6igwig](https://discuss.elastic.co/u/6igwig)\ **Replies:** 1\ **Last updated:** [July 15, 2021, 12:38pm UTC](https://discuss.elastic.co/t/running-elk-services-as-root/278673 "2021-07-15T12:38:14Z")
I am utilizing the full ELK stack in Linux including beats and logstash. I have found a few posts online that recommend not running these services as root such as this discussion post. I tried to find some more informat… --- ## [How to calculate read/write throughput at cluster level?](https://discuss.elastic.co/t/how-to-calculate-read-write-throughput-at-cluster-level/278775)
**Author:** [@Bhagwati\_Malav](https://discuss.elastic.co/u/Bhagwati_Malav)\ **Replies:** 2\ **Last updated:** [July 15, 2021, 12:35pm UTC](https://discuss.elastic.co/t/how-to-calculate-read-write-throughput-at-cluster-level/278775 "2021-07-15T12:35:44Z")
I am working on designing es cluster with below given setup master nodes 3 (m5.a large) 2vcpu, 8gb data nodes 2 (m5.ax large) 4vcpu, 16 gb Keeping default elastic configuration currently. read thread pool - 7 write … --- ## [Indices in delete phase are actually not being deleted](https://discuss.elastic.co/t/indices-in-delete-phase-are-actually-not-being-deleted/278764)
**Author:** [@jfs1](https://discuss.elastic.co/u/jfs1)\ **Replies:** 1\ **Last updated:** [July 15, 2021, 12:22pm UTC](https://discuss.elastic.co/t/indices-in-delete-phase-are-actually-not-being-deleted/278764 "2021-07-15T12:22:34Z")
Actually, a duplicate subject, but this one is no longer an issue related to the kibana bug. I just upgrade my cluster to 7.13 and the issue remains. My indices are not deleted in the "delete" phase of ilm. The ILM sett… --- ## [Convert String to Date](https://discuss.elastic.co/t/convert-string-to-date/278782)
**Author:** [@Meryem\_BS](https://discuss.elastic.co/u/Meryem_BS)\ **Replies:** 0\ **Last updated:** [July 15, 2021, 12:01pm UTC](https://discuss.elastic.co/t/convert-string-to-date/278782 "2021-07-15T12:01:33Z")
Hello, In the logs I upload to Kibana have a "mytimestamp" field, supposedly of type Date but when I inject the logs and parsed it in json, my timestamp is converted to type string. Do you know how can I convert my tim… --- ## [Save NodeClient variable to disk](https://discuss.elastic.co/t/save-nodeclient-variable-to-disk/278773)
**Author:** [@daksh0225](https://discuss.elastic.co/u/daksh0225)\ **Replies:** 0\ **Last updated:** [July 15, 2021, 11:33am UTC](https://discuss.elastic.co/t/save-nodeclient-variable-to-disk/278773 "2021-07-15T11:33:30Z")
Hi all, I have been modifying the source code to accomodate some custom features that I would like to have. In doing so, I have added some new class variables to NodeClient. Currently, these variables do not persist ove… --- ## [Weird index shard allocation behaviour](https://discuss.elastic.co/t/weird-index-shard-allocation-behaviour/278734)
**Author:** [@Lefty](https://discuss.elastic.co/u/Lefty)\ **Replies:** 6\ **Last updated:** [July 15, 2021, 11:30am UTC](https://discuss.elastic.co/t/weird-index-shard-allocation-behaviour/278734 "2021-07-15T11:30:10Z")
Hello everyone, I wonder if you can help me - I have a very weird problem I am running the ELK stack version 7.12.0 I have a 5 data node Elastic cluster - 8 TB of disk each 32GB RAM, 8 CPUs Utilization of disk on the… --- ## [Get group by and distinct count of values using other field in Elasticsearch](https://discuss.elastic.co/t/get-group-by-and-distinct-count-of-values-using-other-field-in-elasticsearch/278762)
**Author:** [@Vinay\_Ranjan](https://discuss.elastic.co/u/Vinay_Ranjan)\ **Replies:** 0\ **Last updated:** [July 15, 2021, 10:06am UTC](https://discuss.elastic.co/t/get-group-by-and-distinct-count-of-values-using-other-field-in-elasticsearch/278762 "2021-07-15T10:06:16Z")
I have an index having document structure as below - { "key": \["10", "20"\], "keywords": \[ { 'case': 1, 'word': 'abc' }, { 'case': 2, 'word': 'def' }, { 'case': 1 … --- ## [Delete all indices exept some based on the index name](https://discuss.elastic.co/t/delete-all-indices-exept-some-based-on-the-index-name/277536)
**Author:** [@rizvaughan](https://discuss.elastic.co/u/rizvaughan)\ **Replies:** 5\ **Last updated:** [July 15, 2021, 8:47am UTC](https://discuss.elastic.co/t/delete-all-indices-exept-some-based-on-the-index-name/277536 "2021-07-15T08:47:00Z")
Hello all, We are using curator to delete indices after a certain amount of time in our environments. I am facing an issue with understanding how to make it work for deleting indices based on time but leaving some indic… --- ## [Exporting detection rules and its exceptions](https://discuss.elastic.co/t/exporting-detection-rules-and-its-exceptions/278753)
**Author:** [@realtech2338](https://discuss.elastic.co/u/realtech2338)\ **Replies:** 0\ **Last updated:** [July 15, 2021, 8:43am UTC](https://discuss.elastic.co/t/exporting-detection-rules-and-its-exceptions/278753 "2021-07-15T08:43:16Z")
how to export all detection rules along with its query into csv format from elasticsearch portal? how to export exceptions under each detection rule into csv format from elasticsearch portal? --- ## [Error in jvmgcmonitorservice (gc overhead)](https://discuss.elastic.co/t/error-in-jvmgcmonitorservice-gc-overhead/278241)
**Author:** [@its-ogawa](https://discuss.elastic.co/u/its-ogawa)\ **Replies:** 9\ **Last updated:** [July 15, 2021, 8:13am UTC](https://discuss.elastic.co/t/error-in-jvmgcmonitorservice-gc-overhead/278241 "2021-07-15T08:13:39Z")
I am having the following problem. $ cat /var/log/elasticsearch/elasticsearch.log | grep WARN \[2021-07-09T00:04:51,795\]\[WARN \]\[o.e.m.j.JvmGcMonitorService\] \[ITS-ELST-01\] \[gc\]\[young\]\[214003\]\[2290\] duration \[1.7s\], collec… --- ## [Need Clarification Regarding Size Parameter in ES Query](https://discuss.elastic.co/t/need-clarification-regarding-size-parameter-in-es-query/278735)
**Author:** [@sayamiasis](https://discuss.elastic.co/u/sayamiasis)\ **Replies:** 3\ **Last updated:** [July 15, 2021, 7:23am UTC](https://discuss.elastic.co/t/need-clarification-regarding-size-parameter-in-es-query/278735 "2021-07-15T07:23:27Z")
I wanted to know if there is a difference in executing these two queries when the result response is consisting of only 3 documents. query1: { "size":10, "query": { "bool":{ "must":\[ { "term":{ "t… --- ## [Communication issue between beats and logstash](https://discuss.elastic.co/t/communication-issue-between-beats-and-logstash/278748)
**Author:** [@knagasri](https://discuss.elastic.co/u/knagasri)\ **Replies:** 0\ **Last updated:** [July 15, 2021, 7:03am UTC](https://discuss.elastic.co/t/communication-issue-between-beats-and-logstash/278748 "2021-07-15T07:03:52Z")
We had deployed ECK:1.3.0 and deployed elasticsearch, kibana (7.9.0) and filebeat (7.9.2) . we had given file beat configuration as below: Note: here we are deploying filebeat as a daemon set. # Filebeat apiVersion: be… --- ## [High Search Rejected](https://discuss.elastic.co/t/high-search-rejected/278700)
**Author:** [@Vishnu\_Singhal](https://discuss.elastic.co/u/Vishnu_Singhal)\ **Replies:** 4\ **Last updated:** [July 15, 2021, 6:09am UTC](https://discuss.elastic.co/t/high-search-rejected/278700 "2021-07-15T06:09:00Z")
Hi, My ELasticsearch thread pool search has very high rejected ration. I have sufficient 72 CPU nodes. node\_name name active queue rejected ES10 search 7 0 22703 ES07 search 0 0 0 … --- ## [org.elasticsearch.action.search.SearchPhaseExecutionException: all shards failed](https://discuss.elastic.co/t/org-elasticsearch-action-search-searchphaseexecutionexception-all-shards-failed/278411)
**Author:** [@its-ogawa](https://discuss.elastic.co/u/its-ogawa)\ **Replies:** 1\ **Last updated:** [July 15, 2021, 5:10am UTC](https://discuss.elastic.co/t/org-elasticsearch-action-search-searchphaseexecutionexception-all-shards-failed/278411 "2021-07-15T05:10:21Z")
org.elasticsearch.action.search.SearchPhaseExecutionException: all shards failed It is said that all shards fail, what is happening? The index in question shows that the health was green. What do I need to do to avoid… --- ## [Must\_not with an exception](https://discuss.elastic.co/t/must-not-with-an-exception/278301)
**Author:** [@bcam135](https://discuss.elastic.co/u/bcam135)\ **Replies:** 3\ **Last updated:** [July 14, 2021, 9:05pm UTC](https://discuss.elastic.co/t/must-not-with-an-exception/278301 "2021-07-14T21:05:55Z")
In basic terms, I have a current kibana alert and the query is set up to exclude all systems that have 800-999 in the hostname with the extraction query code below. That works fine. However, I would I would like to exc… --- ## ["name" field](https://discuss.elastic.co/t/name-field/278713)
**Author:** [@rojin](https://discuss.elastic.co/u/rojin)\ **Replies:** 0\ **Last updated:** [July 14, 2021, 8:30pm UTC](https://discuss.elastic.co/t/name-field/278713 "2021-07-14T20:30:41Z")
Hey, just wondering if I can use the "name" field in grok patterns. when I use it, the error appears to be like this: \["Error"\], "id"=\>"692aaaf9cd6aedfa9e73788106ef94fc1d968d10a1586c197812a6e14d84010a"}\]=\>\[{"thread\_id"=\>… --- ## [Rules export in excel and exception search under rule](https://discuss.elastic.co/t/rules-export-in-excel-and-exception-search-under-rule/278703)
**Author:** [@realtech2338](https://discuss.elastic.co/u/realtech2338)\ **Replies:** 0\ **Last updated:** [July 14, 2021, 6:29pm UTC](https://discuss.elastic.co/t/rules-export-in-excel-and-exception-search-under-rule/278703 "2021-07-14T18:29:08Z")
is there a way to download all elastic rules into excel and also exceptions under each rule into excel from ealsticsearch Also how to use search option under exceptions? --- ## [Why ILM is impractical for managing logs / what curator can and cannot do better](https://discuss.elastic.co/t/why-ilm-is-impractical-for-managing-logs-what-curator-can-and-cannot-do-better/276563)
**Author:** [@m.passing](https://discuss.elastic.co/u/m.passing)\ **Replies:** 4\ **Last updated:** [July 14, 2021, 4:09pm UTC](https://discuss.elastic.co/t/why-ilm-is-impractical-for-managing-logs-what-curator-can-and-cannot-do-better/276563 "2021-07-14T16:09:29Z")
In our setup we have been using curator since a long time, but recent features (namely cold nodes with searchable snapshots), are not supported by it. I want to point out the issues we are having with ILM and the workaro… --- ## [ILM stalled by waiting for shard to be active](https://discuss.elastic.co/t/ilm-stalled-by-waiting-for-shard-to-be-active/278618)
**Author:** [@AdamZ](https://discuss.elastic.co/u/AdamZ)\ **Replies:** 3\ **Last updated:** [July 14, 2021, 3:26pm UTC](https://discuss.elastic.co/t/ilm-stalled-by-waiting-for-shard-to-be-active/278618 "2021-07-14T15:26:45Z")
Hello! I have an ILM Policy configured but it stops at rollover phase. I checked one of the indexes with this query: GET /apm-7.10.0-error-000001/\_ilm/explain?human And the response is: { "indices" : { "apm-7.… --- ## [Could a Master node work as a Coordinating only-role?](https://discuss.elastic.co/t/could-a-master-node-work-as-a-coordinating-only-role/278626)
**Author:** [@rschirin](https://discuss.elastic.co/u/rschirin)\ **Replies:** 3\ **Last updated:** [July 14, 2021, 3:25pm UTC](https://discuss.elastic.co/t/could-a-master-node-work-as-a-coordinating-only-role/278626 "2021-07-14T15:25:35Z")
hey there, I have an infrastructure composed by 3 MASTER + 3 DATA nodes and every client will communicate only with MASTER nodes. are MASTER nodes acting as a Coordinating or not? To relieve DATA nodes regarding resou… --- ## [Example showing how to best use fuzzy multiterm/phrase matching?](https://discuss.elastic.co/t/example-showing-how-to-best-use-fuzzy-multiterm-phrase-matching/278598)
**Author:** [@nahh](https://discuss.elastic.co/u/nahh)\ **Replies:** 3\ **Last updated:** [July 14, 2021, 3:20pm UTC](https://discuss.elastic.co/t/example-showing-how-to-best-use-fuzzy-multiterm-phrase-matching/278598 "2021-07-14T15:20:30Z")
I'm looking for a complete example showing how you can effectively perform fuzzy phrase matching, to get useful results as a user types text. So far, the closest I've got is splitting the search query string into words … --- ## [How to install specific older version of elasticsearch in Mac OS](https://discuss.elastic.co/t/how-to-install-specific-older-version-of-elasticsearch-in-mac-os/278683)
**Author:** [@Sandeep\_Raju](https://discuss.elastic.co/u/Sandeep_Raju)\ **Replies:** 0\ **Last updated:** [July 14, 2021, 2:43pm UTC](https://discuss.elastic.co/t/how-to-install-specific-older-version-of-elasticsearch-in-mac-os/278683 "2021-07-14T14:43:38Z")
Hi all, I'm trying to install Elasticsearch using Homebrew version. I'm trying to install Elasticsearch 7.13.2 version. But when the use the below command, brew install elastic/tap/elasticsearch-full The latest vers… --- ## [Invalid SSL cert error when connecting to elasticsearch using DBeaver](https://discuss.elastic.co/t/invalid-ssl-cert-error-when-connecting-to-elasticsearch-using-dbeaver/278510)
**Author:** [@Fong\_Ng](https://discuss.elastic.co/u/Fong_Ng)\ **Replies:** 3\ **Last updated:** [July 14, 2021, 1:46pm UTC](https://discuss.elastic.co/t/invalid-ssl-cert-error-when-connecting-to-elasticsearch-using-dbeaver/278510 "2021-07-14T13:46:43Z")
I have trouble using SSL keystore or truststore to connect to Elasticsearch client using DBeaver. This is an elastic stack on k8s installation on my local machine. I followed the official tutorial to set up a connection … --- ## [Index lifecycle policy does not apply to newly created timeseries indexes](https://discuss.elastic.co/t/index-lifecycle-policy-does-not-apply-to-newly-created-timeseries-indexes/277993)
**Author:** [@PMDubuc](https://discuss.elastic.co/u/PMDubuc)\ **Replies:** 17\ **Last updated:** [July 14, 2021, 2:03pm UTC](https://discuss.elastic.co/t/index-lifecycle-policy-does-not-apply-to-newly-created-timeseries-indexes/277993 "2021-07-14T14:03:21Z")
I'm using version 7.8.1 of the elastic stack for indexing log files with filebeat into daily logstash-yyyy-mm-dd indexes. I've created an index pattern and template for the indexes and a Logstash\_Index\_Retention policy … --- ## [Get contents of a array list of a document in aggregations](https://discuss.elastic.co/t/get-contents-of-a-array-list-of-a-document-in-aggregations/278674)
**Author:** [@Krishna\_Mohan\_K](https://discuss.elastic.co/u/Krishna_Mohan_K)\ **Replies:** 0\ **Last updated:** [July 14, 2021, 1:59pm UTC](https://discuss.elastic.co/t/get-contents-of-a-array-list-of-a-document-in-aggregations/278674 "2021-07-14T13:59:41Z")
Hi All, I am new to ES. As a part of document we have dates, type and array objects. I have written an ES query with aggregations to date, type. I am trying to get list of array objects inside type aggregation. Please … --- ## [ERROR Failed to complete action: restore. \: Exception encountered](https://discuss.elastic.co/t/error-failed-to-complete-action-restore-class-curator-exceptions-failedexecution-exception-encountered/278595)
**Author:** [@Es\_P\_T](https://discuss.elastic.co/u/Es_P_T)\ **Replies:** 1\ **Last updated:** [July 14, 2021, 1:03pm UTC](https://discuss.elastic.co/t/error-failed-to-complete-action-restore-class-curator-exceptions-failedexecution-exception-encountered/278595 "2021-07-14T13:03:30Z")
Hi ES, Below is my code and I am trying to take a snapshot from one cluster and restore it in different cluster using Elasticsearch Curator. 1: action: restore description: \>- Restore all indi… --- ## [Index operation rejected with Service Not Available error / Master Node Failed in logs](https://discuss.elastic.co/t/index-operation-rejected-with-service-not-available-error-master-node-failed-in-logs/278657)
**Author:** [@Steve\_Robinson](https://discuss.elastic.co/u/Steve_Robinson)\ **Replies:** 0\ **Last updated:** [July 14, 2021, 12:25pm UTC](https://discuss.elastic.co/t/index-operation-rejected-with-service-not-available-error-master-node-failed-in-logs/278657 "2021-07-14T12:25:09Z")
We noticed an index op fail with the error: {"ok":false,"message":"The requested resource is currently unavailable."} today. When investigating the server logs during this time, it appears as if the master node in our c… --- ## [From parameter in delete by query API](https://discuss.elastic.co/t/from-parameter-in-delete-by-query-api/278636)
**Author:** [@Sourav\_Patra](https://discuss.elastic.co/u/Sourav_Patra)\ **Replies:** 0\ **Last updated:** [July 14, 2021, 10:02am UTC](https://discuss.elastic.co/t/from-parameter-in-delete-by-query-api/278636 "2021-07-14T10:02:19Z")
I am trying to use the \[delete\_by\_query\](https://www.elastic.co/guide/en/elasticsearch/reference/7.x/docs-delete-by-query.html) API to keep a maximum of 5 documents for a user that are most recent. I am using the sort pa… --- ## [Elasticsearch not starting problem](https://discuss.elastic.co/t/elasticsearch-not-starting-problem/278496)
**Author:** [@SRIGURU\_VEL](https://discuss.elastic.co/u/SRIGURU_VEL)\ **Replies:** 2\ **Last updated:** [July 14, 2021, 9:26am UTC](https://discuss.elastic.co/t/elasticsearch-not-starting-problem/278496 "2021-07-14T09:26:56Z")
Hello experts, I am using elk 7.12.0 in my local machine. I enabled Xpack and generated some certificates for securing purpose. But when I start my Elasticsearch i got an error. the error is: \[2021-07-13T12:48:08,92… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=607) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=609)