# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=612 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 613 --- ## [Date Field with Millis stored as double leading to error](https://discuss.elastic.co/t/date-field-with-millis-stored-as-double-leading-to-error/277519)
**Author:** [@Bertram](https://discuss.elastic.co/u/Bertram)\ **Replies:** 4\ **Last updated:** [July 9, 2021, 7:25am UTC](https://discuss.elastic.co/t/date-field-with-millis-stored-as-double-leading-to-error/277519 "2021-07-09T07:25:40Z")
Hey there, I recently got this strange problem in a new index: Basic info: Elasticsearch Version: 7.13.2 Nodes: 1 Node (localhost in Dev-Env) Middleware: \[Elasticsearch-PHP\] API-Wrapper The index got a date field a… --- ## [I'm confused: Keyword Mapping and Multi-fields](https://discuss.elastic.co/t/im-confused-keyword-mapping-and-multi-fields/278237)
**Author:** [@tomx1](https://discuss.elastic.co/u/tomx1)\ **Replies:** 3\ **Last updated:** [July 9, 2021, 7:11am UTC](https://discuss.elastic.co/t/im-confused-keyword-mapping-and-multi-fields/278237 "2021-07-09T07:11:03Z")
I'm trying to switch our logging data to ECS. So I've adapted our logstash config to use some new field names and created a static mapping in the destination index. But the data is not indexed as keyword as I would expec… --- ## [Aggs order with a query scope, got docs not in the query scope, why?](https://discuss.elastic.co/t/aggs-order-with-a-query-scope-got-docs-not-in-the-query-scope-why/278230)
**Author:** [@daniel\_wang](https://discuss.elastic.co/u/daniel_wang)\ **Replies:** 2\ **Last updated:** [July 9, 2021, 7:05am UTC](https://discuss.elastic.co/t/aggs-order-with-a-query-scope-got-docs-not-in-the-query-scope-why/278230 "2021-07-09T07:05:15Z")
My es version info: { "version": { "number": "7.7.1", "build\_flavor": "default", "build\_type": "tar", "build\_hash": "ad56dce891c901a492bb1ee393f12dfff473a423", "build\_date": "… --- ## [Advice on optimal number of indices](https://discuss.elastic.co/t/advice-on-optimal-number-of-indices/278227)
**Author:** [@jratliff](https://discuss.elastic.co/u/jratliff)\ **Replies:** 1\ **Last updated:** [July 9, 2021, 12:59am UTC](https://discuss.elastic.co/t/advice-on-optimal-number-of-indices/278227 "2021-07-09T00:59:51Z")
I am working on a system to store network flow records in Elasticsearch. There are too many documents to keep for long periods (~35 million per hour). We wrote a tool to aggregate these into fewer documents (~8 million … --- ## [Policy for index failed on step \[{"phase":"hot","action":"rollover","name":"check-rollover-ready"}\]](https://discuss.elastic.co/t/policy-for-index-failed-on-step-phase-hot-action-rollover-name-check-rollover-ready/278141)
**Author:** [@its-ogawa](https://discuss.elastic.co/u/its-ogawa)\ **Replies:** 1\ **Last updated:** [July 8, 2021, 6:40am UTC](https://discuss.elastic.co/t/policy-for-index-failed-on-step-phase-hot-action-rollover-name-check-rollover-ready/278141 "2021-07-08T06:40:09Z")
I am using Logstash to create a daily index in ElasticSearch. This time, I tried to create an index using an index template, but I noticed that ElasticSearch was generating the following ILM error. $ tail -n 30 /var/lo… --- ## [How to enable geo\_point or geo\_shape in csv data to linestring](https://discuss.elastic.co/t/how-to-enable-geo-point-or-geo-shape-in-csv-data-to-linestring/278120)
**Author:** [@yuhw1](https://discuss.elastic.co/u/yuhw1)\ **Replies:** 2\ **Last updated:** [July 9, 2021, 12:07am UTC](https://discuss.elastic.co/t/how-to-enable-geo-point-or-geo-shape-in-csv-data-to-linestring/278120 "2021-07-09T00:07:22Z")
I am trying to draw a line by extracting the location and timestamp data from the geo\_point or geo\_shape index where the csv file is uploaded. But it keeps failing, and the aggregations are not applied. So, I am asking i… --- ## [More Like This (MLT) query among only documents with a given field value?](https://discuss.elastic.co/t/more-like-this-mlt-query-among-only-documents-with-a-given-field-value/278225)
**Author:** [@aacitelli](https://discuss.elastic.co/u/aacitelli)\ **Replies:** 0\ **Last updated:** [July 8, 2021, 11:01pm UTC](https://discuss.elastic.co/t/more-like-this-mlt-query-among-only-documents-with-a-given-field-value/278225 "2021-07-08T23:01:27Z")
I have a bunch (millions, but ideally scalable to billions/trillions) of documents in an ElasticSearch 7.13.0 index, and I am successfully performing MLT queries on them. Each document has an id, a text field, and a "clu… --- ## [Need clarity on recovery throttling parameters impacting snapshot restores](https://discuss.elastic.co/t/need-clarity-on-recovery-throttling-parameters-impacting-snapshot-restores/278199)
**Author:** [@shivani\_aggarwal](https://discuss.elastic.co/u/shivani_aggarwal)\ **Replies:** 1\ **Last updated:** [July 8, 2021, 6:24pm UTC](https://discuss.elastic.co/t/need-clarity-on-recovery-throttling-parameters-impacting-snapshot-restores/278199 "2021-07-08T18:24:50Z")
Hi, Current version used - elasticsearch-oss 7.8.0 Upgrading to: elasticsearch-oss 7.10.2 Elasticsearch 7.9 breaking change mentions about Snapshot restore throttling. As per the change - Restoring from a snapshot n… --- ## [Full Collection rebuild for Indexing fails](https://discuss.elastic.co/t/full-collection-rebuild-for-indexing-fails/277679)
**Author:** [@Boodle](https://discuss.elastic.co/u/Boodle)\ **Replies:** 5\ **Last updated:** [July 8, 2021, 4:20pm UTC](https://discuss.elastic.co/t/full-collection-rebuild-for-indexing-fails/277679 "2021-07-08T16:20:07Z")
Upgraded to new Oracle12c CMS and migrated ~4 Million documents. However running the Full Collection Rebuild for Indexing fails with below error. 2 difference CMS instances are pointing to same Elasticsearch.. Error: "\>… --- ## [Node dont start after server crash](https://discuss.elastic.co/t/node-dont-start-after-server-crash/278204)
**Author:** [@ebuildy](https://discuss.elastic.co/u/ebuildy)\ **Replies:** 0\ **Last updated:** [July 8, 2021, 3:12pm UTC](https://discuss.elastic.co/t/node-dont-start-after-server-crash/278204 "2021-07-08T15:12:35Z")
We run ES 7.13.2 on k8s, with Docker engine. This is simple 3 nodes cluster with 10 indices and less than 100Go of data. The ES cluster is used to monitore another ES cluster which is working fine (via metricbeat). Our… --- ## [How to create several roles at once](https://discuss.elastic.co/t/how-to-create-several-roles-at-once/278203)
**Author:** [@mcosta](https://discuss.elastic.co/u/mcosta)\ **Replies:** 0\ **Last updated:** [July 8, 2021, 3:12pm UTC](https://discuss.elastic.co/t/how-to-create-several-roles-at-once/278203 "2021-07-08T15:12:34Z")
Hi all, Is there a way to create several roles at once using POST /\_security/role/ API? If so, can someone plz give an example? The ideia here is to first use GET /\_security/role/, remove all reserved roles and then u… --- ## [Data stream tracks generation](https://discuss.elastic.co/t/data-stream-tracks-generation/275729)
**Author:** [@demudrol](https://discuss.elastic.co/u/demudrol)\ **Replies:** 1\ **Last updated:** [July 8, 2021, 3:00pm UTC](https://discuss.elastic.co/t/data-stream-tracks-generation/275729 "2021-07-08T15:00:42Z")
Hi! There is information about following convention: .ds-\-\-\ But when define data stream in index template like this: "index\_patterns": \["my-data-stream-\*"\], "data\_stream": { }, … --- ## ["allocate\_explanation" : "allocation temporarily throttled"](https://discuss.elastic.co/t/allocate-explanation-allocation-temporarily-throttled/276709)
**Author:** [@alexus](https://discuss.elastic.co/u/alexus)\ **Replies:** 0\ **Last updated:** [June 23, 2021, 1:21am UTC](https://discuss.elastic.co/t/allocate-explanation-allocation-temporarily-throttled/276709 "2021-06-23T01:21:10Z")
Hello World! Per Cluster Allocation Explain API | Elasticsearch Guide \[6.8\] | Elastic - I ran and got following: GET /\_cluster/allocation/explain "node\_decision" : "throttled", "deciders" : \[ { … --- ## [Datafeed creation via API](https://discuss.elastic.co/t/datafeed-creation-via-api/278090)
**Author:** [@StephaneB](https://discuss.elastic.co/u/StephaneB)\ **Replies:** 4\ **Last updated:** [July 8, 2021, 2:43pm UTC](https://discuss.elastic.co/t/datafeed-creation-via-api/278090 "2021-07-08T14:43:08Z")
Hi, I have created 2 identical datafeed: 1 datafeed created via Kibana (datafeed\_job\_device1) 1 datafeed created via API (api\_datafeed\_api\_job\_device1) The 2 resulting JSON files related to these 2 datafeed are exact… --- ## [Elasticsearch 7.13](https://discuss.elastic.co/t/elasticsearch-7-13/278193)
**Author:** [@Krunal](https://discuss.elastic.co/u/Krunal)\ **Replies:** 0\ **Last updated:** [July 8, 2021, 2:01pm UTC](https://discuss.elastic.co/t/elasticsearch-7-13/278193 "2021-07-08T14:01:05Z")
Hello Expert, I have installed ELK stack on rhel and Power BI on window 10. But by which ways I can do the connectivity ? is there any plugin through which it can be connected. --- ## [Get grouped results along with siblings not matching the filter criteria](https://discuss.elastic.co/t/get-grouped-results-along-with-siblings-not-matching-the-filter-criteria/278003)
**Author:** [@Federico\_Martinez](https://discuss.elastic.co/u/Federico_Martinez)\ **Replies:** 5\ **Last updated:** [July 8, 2021, 1:21pm UTC](https://discuss.elastic.co/t/get-grouped-results-along-with-siblings-not-matching-the-filter-criteria/278003 "2021-07-08T13:21:00Z")
Hi, is it possible to query elastic for documents matching a filter criteria, grouped by a field and also get any sibling documents not matching the filter criteria? By siblings I mean documents having the same value on… --- ## [Break in Cluster Overview Graph](https://discuss.elastic.co/t/break-in-cluster-overview-graph/277224)
**Author:** [@mani1](https://discuss.elastic.co/u/mani1)\ **Replies:** 2\ **Last updated:** [July 8, 2021, 12:59pm UTC](https://discuss.elastic.co/t/break-in-cluster-overview-graph/277224 "2021-07-08T12:59:44Z")
In my Cluster Overview graph of Kibana Monitor, sometime there are breaks in the graph. I have checked that during this time there is not any Node, Logstash down, no error found in logs. Can somebody suggest what are the… --- ## [This version of the JDBC driver is only compatible with Elasticsearch version 7.13 or newer; attempting to connect to a server version 7.4.2](https://discuss.elastic.co/t/this-version-of-the-jdbc-driver-is-only-compatible-with-elasticsearch-version-7-13-or-newer-attempting-to-connect-to-a-server-version-7-4-2/278135)
**Author:** [@MinwooKim](https://discuss.elastic.co/u/MinwooKim)\ **Replies:** 4\ **Last updated:** [July 8, 2021, 11:31am UTC](https://discuss.elastic.co/t/this-version-of-the-jdbc-driver-is-only-compatible-with-elasticsearch-version-7-13-or-newer-attempting-to-connect-to-a-server-version-7-4-2/278135 "2021-07-08T11:31:43Z")
Hello, I am trying to put my elasticsearch in database views, using intellij's Datagrip. this is where I got the jdbc driver source. meanwhile, my elastic search server has 7.4.2 version. Isn't 7.4.2 newer than 7.1… --- ## [Is it necessary to delete a PIT?](https://discuss.elastic.co/t/is-it-necessary-to-delete-a-pit/277752)
**Author:** [@zhiyazw](https://discuss.elastic.co/u/zhiyazw)\ **Replies:** 1\ **Last updated:** [July 8, 2021, 10:33am UTC](https://discuss.elastic.co/t/is-it-necessary-to-delete-a-pit/277752 "2021-07-08T10:33:17Z")
In search after section, ELasticsearch said, "When you’re finished, you should delete your PIT". Is this necessary? Does a PIT get deleted automatically after timeout? Just as "Scroll" does. It's not easy to find a goo… --- ## [Multi value field different scoring for terms and terms\_set queries](https://discuss.elastic.co/t/multi-value-field-different-scoring-for-terms-and-terms-set-queries/278172)
**Author:** [@zordark](https://discuss.elastic.co/u/zordark)\ **Replies:** 0\ **Last updated:** [July 8, 2021, 10:24am UTC](https://discuss.elastic.co/t/multi-value-field-different-scoring-for-terms-and-terms-set-queries/278172 "2021-07-08T10:24:28Z")
Good day, I have small question regarding scoring. I'm using example from documentation (Terms query). If I query documents by multiple values with 'terms', like: GET my-index-000001/\_search?pretty { "query": { … --- ## [Missing authentication credentials for REST request \[/\_cluster/health?pretty\] In minimal security set up](https://discuss.elastic.co/t/missing-authentication-credentials-for-rest-request-cluster-health-pretty-in-minimal-security-set-up/278162)
**Author:** [@Mamol27](https://discuss.elastic.co/u/Mamol27)\ **Replies:** 0\ **Last updated:** [July 8, 2021, 9:36am UTC](https://discuss.elastic.co/t/missing-authentication-credentials-for-rest-request-cluster-health-pretty-in-minimal-security-set-up/278162 "2021-07-08T09:36:57Z")
Hi! I'm trying to set up basic security on elastic cluster. my elasticsearch.yml: cluster.name: ELK-CLUSTER node.name: $HOSTNAME node.master: true node.data: false node.ingest: false network.host: 0.0.0.0 http.port: … --- ## [Deploying New Elastic Cluster and Migrate Live Logs](https://discuss.elastic.co/t/deploying-new-elastic-cluster-and-migrate-live-logs/278092)
**Author:** [@Kosodrom](https://discuss.elastic.co/u/Kosodrom)\ **Replies:** 8\ **Last updated:** [July 8, 2021, 8:22am UTC](https://discuss.elastic.co/t/deploying-new-elastic-cluster-and-migrate-live-logs/278092 "2021-07-08T08:22:48Z")
Hi folks, I have following use case: I want to install a new 7.13.2 Elasticsearch cluster on some brand new VMs and migrate the indices and global cluster state from 7.6.2 cluster into it. The challenge is: there are … --- ## [No event collected from Sysmon](https://discuss.elastic.co/t/no-event-collected-from-sysmon/278147)
**Author:** [@bilel\_meddeb](https://discuss.elastic.co/u/bilel_meddeb)\ **Replies:** 0\ **Last updated:** [July 8, 2021, 7:47am UTC](https://discuss.elastic.co/t/no-event-collected-from-sysmon/278147 "2021-07-08T07:47:50Z")
HELLO, I have installed sysmon in a Windows machine using the command: ==\> sysmon.exe -i -accepteula -h md5,sha256,imphash -l -n And then restart winlogbeat. In winlogbeat log everything is working well, and i have lo… --- ## [Count impressions with Winlogbeat](https://discuss.elastic.co/t/count-impressions-with-winlogbeat/278146)
**Author:** [@rdrit](https://discuss.elastic.co/u/rdrit)\ **Replies:** 0\ **Last updated:** [July 8, 2021, 7:30am UTC](https://discuss.elastic.co/t/count-impressions-with-winlogbeat/278146 "2021-07-08T07:30:09Z")
Hello everyone, I am coming to you because I am facing a problem. I am using ELK and Winlogbeat, I have enabled print service logging on a server and I want to do a Dashboard to track impressions. After some research … --- ## [ES 6.5.4 - Error : monitoring execution failed org.elasticsearch](https://discuss.elastic.co/t/es-6-5-4-error-monitoring-execution-failed-org-elasticsearch/278076)
**Author:** [@giulian](https://discuss.elastic.co/u/giulian)\ **Replies:** 2\ **Last updated:** [July 8, 2021, 7:25am UTC](https://discuss.elastic.co/t/es-6-5-4-error-monitoring-execution-failed-org-elasticsearch/278076 "2021-07-08T07:25:27Z")
Hi in my new job i discover we use Elasticsearch cluser 6.5.4 and i am totaly newbie, i try to understand how it s work since many hours. since many day we encoutering many mistake i discover my 3 node have same error … --- ## [Return Results With Diatrics](https://discuss.elastic.co/t/return-results-with-diatrics/278123)
**Author:** [@hbobbala](https://discuss.elastic.co/u/hbobbala)\ **Replies:** 1\ **Last updated:** [July 8, 2021, 6:18am UTC](https://discuss.elastic.co/t/return-results-with-diatrics/278123 "2021-07-08T06:18:05Z")
Hi All, I'm trying to return results for names with Diacritics . I want to be able to search using regular characters and receive all results, including names with diacritics (Example: want to search for Jose and return… --- ## [Xpack users migration](https://discuss.elastic.co/t/xpack-users-migration/278138)
**Author:** [@McElroy](https://discuss.elastic.co/u/McElroy)\ **Replies:** 0\ **Last updated:** [July 8, 2021, 6:14am UTC](https://discuss.elastic.co/t/xpack-users-migration/278138 "2021-07-08T06:14:17Z")
Hi, we are currently migrating one of our clusters to new machines. We need to migrate the users and roles from xpack too. What would be the best option here? Create a snapshot and import it in the new cluster or reinde… --- ## [Is there a way to feed base64 encoded string to the ingest\_attachment plugin or fscrawler?](https://discuss.elastic.co/t/is-there-a-way-to-feed-base64-encoded-string-to-the-ingest-attachment-plugin-or-fscrawler/278016)
**Author:** [@dotel](https://discuss.elastic.co/u/dotel)\ **Replies:** 10\ **Last updated:** [July 8, 2021, 6:12am UTC](https://discuss.elastic.co/t/is-there-a-way-to-feed-base64-encoded-string-to-the-ingest-attachment-plugin-or-fscrawler/278016 "2021-07-08T06:12:34Z")
So I've been trying to come up with a poc for document content search. What I've found so far is, I can feed the documents to fscrawler and search for the content using something like GET bookstore/\_search { "query":… --- ## [Difference between simple search query and multi match](https://discuss.elastic.co/t/difference-between-simple-search-query-and-multi-match/278132)
**Author:** [@Gopal\_Chauhan](https://discuss.elastic.co/u/Gopal_Chauhan)\ **Replies:** 0\ **Last updated:** [July 8, 2021, 5:02am UTC](https://discuss.elastic.co/t/difference-between-simple-search-query-and-multi-match/278132 "2021-07-08T05:02:05Z")
Hi I am using two search query which is giving similar result. what is difference between these two query simple query string and multimatch? 1- simple\_query\_string GET index/\_search { "size": 50, "query": { "b… --- ## [Unable to register s3 repo](https://discuss.elastic.co/t/unable-to-register-s3-repo/275959)
**Author:** [@sonujatav35](https://discuss.elastic.co/u/sonujatav35)\ **Replies:** 6\ **Last updated:** [July 8, 2021, 4:19am UTC](https://discuss.elastic.co/t/unable-to-register-s3-repo/275959 "2021-07-08T04:19:15Z")
Hi, Can someone advice me what will be possible cause of this kind of error. while register the s3 repo i am getting below error. "error" : { "root\_cause" : \[ { "type" : "repository\_verification\_excep… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=611) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=613)