# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=611 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 612 --- ## [CompositeAgg DateHistograms - fill empty interval gaps & key\_as\_string like normal DateHistogramAgg](https://discuss.elastic.co/t/compositeagg-datehistograms-fill-empty-interval-gaps-key-as-string-like-normal-datehistogramagg/278271)
**Author:** [@xskerik](https://discuss.elastic.co/u/xskerik)\ **Replies:** 1\ **Last updated:** [July 12, 2021, 8:40am UTC](https://discuss.elastic.co/t/compositeagg-datehistograms-fill-empty-interval-gaps-key-as-string-like-normal-datehistogramagg/278271 "2021-07-12T08:40:21Z")
This is basically follow up of issue CompositeAgg Histograms - fill empty interval gaps like normal histogramAggregation It would be nice if DateHistogram under Composite agg behaves more like plain DateHistogram. IDK… --- ## [Uploading nested csv giving error- 0: object mapping for \[comments\] tried to parse field \[comments\] as object, but found a concrete value](https://discuss.elastic.co/t/uploading-nested-csv-giving-error-0-object-mapping-for-comments-tried-to-parse-field-comments-as-object-but-found-a-concrete-value/278273)
**Author:** [@anaya](https://discuss.elastic.co/u/anaya)\ **Replies:** 1\ **Last updated:** [July 12, 2021, 8:39am UTC](https://discuss.elastic.co/t/uploading-nested-csv-giving-error-0-object-mapping-for-comments-tried-to-parse-field-comments-as-object-but-found-a-concrete-value/278273 "2021-07-12T08:39:08Z")
Hi! I am trying to upload some data to elastic through a csv file which has multiple fields, out of which one is a nested field. The mapping i defined is as follows- "comments": { "type": "nested", "properties":{ "n… --- ## [Illegal\_argument\_exception on empty index](https://discuss.elastic.co/t/illegal-argument-exception-on-empty-index/278277)
**Author:** [@vitalismaxim](https://discuss.elastic.co/u/vitalismaxim)\ **Replies:** 1\ **Last updated:** [July 12, 2021, 8:38am UTC](https://discuss.elastic.co/t/illegal-argument-exception-on-empty-index/278277 "2021-07-12T08:38:19Z")
Hi, I'm trying to index some files to a new and empty index called 'envri' but on the first file I'm getting 'illegal\_argument\_exception' , 'mapper \[spatialCoverage\] cannot be changed from type \[long\] to \[float\]. I unde… --- ## [To use or not to use NodeSelector.SKIP\_DEDICATED\_MASTERS with high level rest client](https://discuss.elastic.co/t/to-use-or-not-to-use-nodeselector-skip-dedicated-masters-with-high-level-rest-client/278310)
**Author:** [@blindwitness](https://discuss.elastic.co/u/blindwitness)\ **Replies:** 1\ **Last updated:** [July 12, 2021, 8:24am UTC](https://discuss.elastic.co/t/to-use-or-not-to-use-nodeselector-skip-dedicated-masters-with-high-level-rest-client/278310 "2021-07-12T08:24:12Z")
Hello, The documentation is slightly unclear in regards to using NodeSelectors for the rest client. We have a cluster with dedicated master-eligible nodes and dedicated data/ingest nodes. It seems that with this config… --- ## [Elasticsearch reindex then cant add mapping](https://discuss.elastic.co/t/elasticsearch-reindex-then-cant-add-mapping/278345)
**Author:** [@jordanuseselastic](https://discuss.elastic.co/u/jordanuseselastic)\ **Replies:** 1\ **Last updated:** [July 12, 2021, 8:16am UTC](https://discuss.elastic.co/t/elasticsearch-reindex-then-cant-add-mapping/278345 "2021-07-12T08:16:50Z")
Hi Elasticsearch experts! Wondering if someone can help with a strange thing that is happening: We have an index in which the amount of mappings has grown massive (over 3000) and we want to reduce this by reindexing. In … --- ## [Json\_parse\_exception multisearch](https://discuss.elastic.co/t/json-parse-exception-multisearch/278116)
**Author:** [@draft10](https://discuss.elastic.co/u/draft10)\ **Replies:** 5\ **Last updated:** [July 12, 2021, 8:08am UTC](https://discuss.elastic.co/t/json-parse-exception-multisearch/278116 "2021-07-12T08:08:06Z")
curl -X GET --user user:pass "localhost:port/element1-2021.07.06/\_msearch?pretty" -H 'Content-Type: application/json' -d' { } {"query": {"match" : {"application":"Scanner"}}} {"index": "element1-2021.07.06"} {"query"… --- ## [Restoring data when disabling \_source](https://discuss.elastic.co/t/restoring-data-when-disabling-source/277182)
**Author:** [@Bertg](https://discuss.elastic.co/u/Bertg)\ **Replies:** 6\ **Last updated:** [July 12, 2021, 8:04am UTC](https://discuss.elastic.co/t/restoring-data-when-disabling-source/277182 "2021-07-12T08:04:34Z")
Following up on a StackExchange conversation, I was wondering "how" and "how successful" one could rebuild data from an index without the \_source data. The ES documentation on disabling the \_source field warns about us… --- ## [Multiple condition checking and compare count](https://discuss.elastic.co/t/multiple-condition-checking-and-compare-count/278214)
**Author:** [@ranju](https://discuss.elastic.co/u/ranju)\ **Replies:** 3\ **Last updated:** [July 12, 2021, 8:03am UTC](https://discuss.elastic.co/t/multiple-condition-checking-and-compare-count/278214 "2021-07-12T08:03:38Z")
Need to check two conditions with test type, for eg we have two types of test RTPCR and Antigen. we need to get an alert if the count of Antigen tests with positive cases is greater than 70% of RTPCR's positive case cou… --- ## [Use query match only to boost and don't increase the recall set](https://discuss.elastic.co/t/use-query-match-only-to-boost-and-dont-increase-the-recall-set/278385)
**Author:** [@Bikas\_Katwal](https://discuss.elastic.co/u/Bikas_Katwal)\ **Replies:** 0\ **Last updated:** [July 12, 2021, 7:40am UTC](https://discuss.elastic.co/t/use-query-match-only-to-boost-and-dont-increase-the-recall-set/278385 "2021-07-12T07:40:02Z")
I have multiple match queries inside the should clause. I would like to add another field match, which should be used only to boost scores and not increase the recall set. I have the below query that is being used curre… --- ## [Reindexing Large index](https://discuss.elastic.co/t/reindexing-large-index/278313)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 1\ **Last updated:** [July 12, 2021, 6:40am UTC](https://discuss.elastic.co/t/reindexing-large-index/278313 "2021-07-12T06:40:48Z")
Earlier we were using ELK stack version 7.11 when we upgrade to 7.13.2 we phase mapping conflict problem although we didn't define mapping for event\_id,thread\_id,z\_elastic\_ecs.event.code GET log-wlb-2021.07.02-00000… --- ## [What is the best mix of index and shards on Elastic Cloud](https://discuss.elastic.co/t/what-is-the-best-mix-of-index-and-shards-on-elastic-cloud/276896)
**Author:** [@kwoxer](https://discuss.elastic.co/u/kwoxer)\ **Replies:** 29\ **Last updated:** [July 12, 2021, 5:27am UTC](https://discuss.elastic.co/t/what-is-the-best-mix-of-index-and-shards-on-elastic-cloud/276896 "2021-07-12T05:27:40Z")
As the title says, we are using Elastic Cloud with 3 Elastic Instances. We are currently having 338 shards: but just having one index: Is this a proper way? Or should I create one index for each day maybe? (btw … --- ## [Java code to connect elasticsearch](https://discuss.elastic.co/t/java-code-to-connect-elasticsearch/278364)
**Author:** [@Cherrys](https://discuss.elastic.co/u/Cherrys)\ **Replies:** 1\ **Last updated:** [July 11, 2021, 7:07pm UTC](https://discuss.elastic.co/t/java-code-to-connect-elasticsearch/278364 "2021-07-11T19:07:50Z")
HI folks, How can I connect ElasticSearch using Java class. we have requirment suchs as we need java code to send request and get response from ElasticSearch . --- ## [Change index alias](https://discuss.elastic.co/t/change-index-alias/278355)
**Author:** [@malsioufi](https://discuss.elastic.co/u/malsioufi)\ **Replies:** 0\ **Last updated:** [July 11, 2021, 10:59am UTC](https://discuss.elastic.co/t/change-index-alias/278355 "2021-07-11T10:59:51Z")
Hi, Previously I have created an index alias tests PUT tests-00000001 { "aliases": { "tests": { "is\_write\_index": true } } } I have used it as rollover alias to create an index template PUT \_index\_t… --- ## [Metricbeat cluster sizing](https://discuss.elastic.co/t/metricbeat-cluster-sizing/276872)
**Author:** [@premierpsp](https://discuss.elastic.co/u/premierpsp)\ **Replies:** 16\ **Last updated:** [July 11, 2021, 7:12am UTC](https://discuss.elastic.co/t/metricbeat-cluster-sizing/276872 "2021-07-11T07:12:29Z")
Hello, I need your help. I’m deploying metricbeat on 3000 servers. The problem is that from 1000 agents loaded, kibana has problems to display the metrics. In fact, there are metrics that kibana cannot display. I think … --- ## [Search query for boolean operators in Elasticsearch 7.10?](https://discuss.elastic.co/t/search-query-for-boolean-operators-in-elasticsearch-7-10/278346)
**Author:** [@Nishikant\_Tayade](https://discuss.elastic.co/u/Nishikant_Tayade)\ **Replies:** 0\ **Last updated:** [July 11, 2021, 3:32am UTC](https://discuss.elastic.co/t/search-query-for-boolean-operators-in-elasticsearch-7-10/278346 "2021-07-11T03:32:01Z")
I have an index with large set of documents. I want to perform following boolean queries for the below operators: 1. eq 2. ne 3. startsWith 4. endsWith 5. contains 6. void : Return the document whi… --- ## [ILM my index is not doing rollover properly](https://discuss.elastic.co/t/ilm-my-index-is-not-doing-rollover-properly/278334)
**Author:** [@Daud\_Ahmed1](https://discuss.elastic.co/u/Daud_Ahmed1)\ **Replies:** 4\ **Last updated:** [July 10, 2021, 2:29pm UTC](https://discuss.elastic.co/t/ilm-my-index-is-not-doing-rollover-properly/278334 "2021-07-10T14:29:07Z")
Below is my ILM policy { "policy": { "phases": { "hot": { "min\_age": "0ms", "actions": { "rollover": { "max\_age": "30d", "max\_size": "50gb" }, … --- ## [Starting Elasticsearch fails](https://discuss.elastic.co/t/starting-elasticsearch-fails/278318)
**Author:** [@maof97](https://discuss.elastic.co/u/maof97)\ **Replies:** 2\ **Last updated:** [July 10, 2021, 8:42am UTC](https://discuss.elastic.co/t/starting-elasticsearch-fails/278318 "2021-07-10T08:42:05Z")
Hi, I had an outage at my Server (self-hosted) and now every time I want to start ES this error appears: Jul 10 08:15:44 pelk logstash\[720\]: \[2021-07-10T08:15:44,162\]\[WARN \]\[logstash.outputs.elasticsearch\]\[pfelk\] Attemp… --- ## [Cannot compute used swap when total swap is 0 and free swap is 0](https://discuss.elastic.co/t/cannot-compute-used-swap-when-total-swap-is-0-and-free-swap-is-0/277128)
**Author:** [@alexus](https://discuss.elastic.co/u/alexus)\ **Replies:** 2\ **Last updated:** [June 28, 2021, 12:35am UTC](https://discuss.elastic.co/t/cannot-compute-used-swap-when-total-swap-is-0-and-free-swap-is-0/277128 "2021-06-28T00:35:12Z")
Hello World! My logs are getting flooded with following message: cannot compute used swap when total swap is 0 and free swap is 0 I assume it's safe to ignore since it's not recommended to have swap enabled anyways,… --- ## [Extracting @timestamp from Source within Hits](https://discuss.elastic.co/t/extracting-timestamp-from-source-within-hits/278306)
**Author:** [@NoviceESCoder](https://discuss.elastic.co/u/NoviceESCoder)\ **Replies:** 0\ **Last updated:** [July 9, 2021, 8:22pm UTC](https://discuss.elastic.co/t/extracting-timestamp-from-source-within-hits/278306 "2021-07-09T20:22:56Z")
I am trying to extract @timestamp from .Source but whenever I type a dot after the word Source I do not get any options that Source can contain where I can grab @timestamp. Is there a specific way I can grab @timestamp f… --- ## [Custom scoring based on number of matches](https://discuss.elastic.co/t/custom-scoring-based-on-number-of-matches/278305)
**Author:** [@Viktor\_Krasynskyy](https://discuss.elastic.co/u/Viktor_Krasynskyy)\ **Replies:** 0\ **Last updated:** [July 9, 2021, 7:15pm UTC](https://discuss.elastic.co/t/custom-scoring-based-on-number-of-matches/278305 "2021-07-09T19:15:49Z")
My question is somewhat similar to an old feature request Add match count scoring option · Issue #13806 · elastic/elasticsearch · GitHub but some options suggested there are already deprecated. I'm trying to create a cu… --- ## [Troubles with JVM Heap](https://discuss.elastic.co/t/troubles-with-jvm-heap/278290)
**Author:** [@Di\_Croatiano](https://discuss.elastic.co/u/Di_Croatiano)\ **Replies:** 1\ **Last updated:** [July 9, 2021, 4:25pm UTC](https://discuss.elastic.co/t/troubles-with-jvm-heap/278290 "2021-07-09T16:25:54Z")
Hello there! After a considerable time optimizing and testing different configurations, I have no idea why my ES nodes uses so much of a JVM heap, with not so many shards in a cluster. I’m definitely missing something, … --- ## [How do I reference a field name that contains a dot in watcher logging action](https://discuss.elastic.co/t/how-do-i-reference-a-field-name-that-contains-a-dot-in-watcher-logging-action/266614)
**Author:** [@Emilio\_Vega](https://discuss.elastic.co/u/Emilio_Vega)\ **Replies:** 3\ **Last updated:** [July 9, 2021, 3:19pm UTC](https://discuss.elastic.co/t/how-do-i-reference-a-field-name-that-contains-a-dot-in-watcher-logging-action/266614 "2021-07-09T15:19:41Z")
An elastic template index got field names using dots ("property.name") and I am wondering if it is possible reference them using "ctx.payload.hits.hits.0.\_source" object. I did some different attempts without success. I… --- ## [SSL Handshake error while adding node to elasticsearch](https://discuss.elastic.co/t/ssl-handshake-error-while-adding-node-to-elasticsearch/278283)
**Author:** [@rohan0018](https://discuss.elastic.co/u/rohan0018)\ **Replies:** 0\ **Last updated:** [July 9, 2021, 1:18pm UTC](https://discuss.elastic.co/t/ssl-handshake-error-while-adding-node-to-elasticsearch/278283 "2021-07-09T13:18:26Z")
Hello I am trying to add node in elasticsearch cluster, when I restart elasticsearch service on data node it give below error. "\[2021-07-09T18:14:25,561\]\[WARN \]\[o.e.t.TcpTransport \] \[NODE2\] exception caught on transpor… --- ## [From Splunk to ELK: how to perform statistic searches?](https://discuss.elastic.co/t/from-splunk-to-elk-how-to-perform-statistic-searches/277644)
**Author:** [@Wooden\_tree](https://discuss.elastic.co/u/Wooden_tree)\ **Replies:** 2\ **Last updated:** [July 9, 2021, 1:13pm UTC](https://discuss.elastic.co/t/from-splunk-to-elk-how-to-perform-statistic-searches/277644 "2021-07-09T13:13:59Z")
Hi, I spent last few years with Splunk and now I’m an ELK user. I’d like to know if there is a way to perform a statistical search in ELK. Let’s say, I have some firewall logs and I’d like to use it to detect a port sc… --- ## [Ensuring master election in elastic search cluster is among desired nodes](https://discuss.elastic.co/t/ensuring-master-election-in-elastic-search-cluster-is-among-desired-nodes/277664)
**Author:** [@mahudees](https://discuss.elastic.co/u/mahudees)\ **Replies:** 3\ **Last updated:** [July 9, 2021, 12:00pm UTC](https://discuss.elastic.co/t/ensuring-master-election-in-elastic-search-cluster-is-among-desired-nodes/277664 "2021-07-09T12:00:25Z")
Hi, We have a 3 node elastic cluster running as part of our application. All the 3 are master eligible nodes. We also have mongodb cluster and our application cluster also running in the same node. Design is, master of… --- ## [ElasticSearch: Order top-level aggregation buckets based on reverse\_nested doc\_count](https://discuss.elastic.co/t/elasticsearch-order-top-level-aggregation-buckets-based-on-reverse-nested-doc-count/278250)
**Author:** [@afasias](https://discuss.elastic.co/u/afasias)\ **Replies:** 1\ **Last updated:** [July 9, 2021, 10:23am UTC](https://discuss.elastic.co/t/elasticsearch-order-top-level-aggregation-buckets-based-on-reverse-nested-doc-count/278250 "2021-07-09T10:23:58Z")
Hi. My Elasticsearch info: { "version": { "number": "6.3.1", "build\_flavor": "oss", "build\_type": "zip", "build\_hash": "9d3e794", "build\_date": "2020-06-09T23:40:32.185794Z",… --- ## [Ilm is creating an infinite initial index of {index\_name}-000001](https://discuss.elastic.co/t/ilm-is-creating-an-infinite-initial-index-of-index-name-000001/278254)
**Author:** [@Stewart](https://discuss.elastic.co/u/Stewart)\ **Replies:** 1\ **Last updated:** [July 9, 2021, 8:37am UTC](https://discuss.elastic.co/t/ilm-is-creating-an-infinite-initial-index-of-index-name-000001/278254 "2021-07-09T08:37:26Z")
I would like to ask an ILM related issue. The index is being deleted with ilm and it is working, but from a certain moment, the initial 0000001 index is created in the indices that are suddenly well rolled over, and th… --- ## [Index \[ilm-history -3-0001\] blocked by :\[TOO\_MANY\_REQUESTS/12/disk usage exceeded, index has read-only-allow-delete block\]](https://discuss.elastic.co/t/index-ilm-history-3-0001-blocked-by-too-many-requests-12-disk-usage-exceeded-index-has-read-only-allow-delete-block/278051)
**Author:** [@mba](https://discuss.elastic.co/u/mba)\ **Replies:** 5\ **Last updated:** [July 9, 2021, 8:27am UTC](https://discuss.elastic.co/t/index-ilm-history-3-0001-blocked-by-too-many-requests-12-disk-usage-exceeded-index-has-read-only-allow-delete-block/278051 "2021-07-09T08:27:41Z")
index \[ilm-history -3-0001\] blocked by :\[TOO\_MANY\_REQUESTS/12/disk usage exceeded, index has read-only-allow-delete block\] --- ## [Comparing Date Fields of Nested Objects](https://discuss.elastic.co/t/comparing-date-fields-of-nested-objects/278222)
**Author:** [@Fatih\_Kurnaz](https://discuss.elastic.co/u/Fatih_Kurnaz)\ **Replies:** 1\ **Last updated:** [July 9, 2021, 8:27am UTC](https://discuss.elastic.co/t/comparing-date-fields-of-nested-objects/278222 "2021-07-09T08:27:13Z")
Hi Everyone; Here my painless script; "script\_fields": { "seen": { "script": { "source": """ for (view in params\['\_source'\]\['viewing\_appointments'\]) { if (new Date().getTime() - view.view… --- ## [Not able to connect to elastic host](https://discuss.elastic.co/t/not-able-to-connect-to-elastic-host/278247)
**Author:** [@mac2](https://discuss.elastic.co/u/mac2)\ **Replies:** 1\ **Last updated:** [July 9, 2021, 8:23am UTC](https://discuss.elastic.co/t/not-able-to-connect-to-elastic-host/278247 "2021-07-09T08:23:31Z")
I am trying to connect to the elastic running on a linux box from my local windows azure machine using below in java Preformatted textTransportClient transportClient = (new PreBuiltTransportClient(Settings.EMPTY, new Cl… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=610) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=612)