# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=616 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 617 --- ## [Extra memory required to accomodate extra buckets](https://discuss.elastic.co/t/extra-memory-required-to-accomodate-extra-buckets/277186)
**Author:** [@prashant1](https://discuss.elastic.co/u/prashant1)\ **Replies:** 5\ **Last updated:** [July 5, 2021, 2:06am UTC](https://discuss.elastic.co/t/extra-memory-required-to-accomodate-extra-buckets/277186 "2021-07-05T02:06:10Z")
We are getting too many buckets exception error in viewing the visualization. The default limit for max.buckets is 10000 if we want to increase this parameter to 20000 to resolve the exception so how much would be the e… --- ## [Snapshot on fast changing clusters](https://discuss.elastic.co/t/snapshot-on-fast-changing-clusters/276468)
**Author:** [@nadler](https://discuss.elastic.co/u/nadler)\ **Replies:** 5\ **Last updated:** [July 5, 2021, 2:01am UTC](https://discuss.elastic.co/t/snapshot-on-fast-changing-clusters/276468 "2021-07-05T02:01:15Z")
Hey, So, in the last two weeks i have encountered a problem with one of our clusters. I have a daily backup procedure running on it and often, while the snapshot procedure is running, we get the following exception: I… --- ## [Why is TermQuery so much faster than PointRangeQuery?](https://discuss.elastic.co/t/why-is-termquery-so-much-faster-than-pointrangequery/277740)
**Author:** [@asasas234](https://discuss.elastic.co/u/asasas234)\ **Replies:** 0\ **Last updated:** [July 4, 2021, 2:42pm UTC](https://discuss.elastic.co/t/why-is-termquery-so-much-faster-than-pointrangequery/277740 "2021-07-04T14:42:25Z")
I have 1 index with data volume around 80 million. I had 1 slow query before, which was 3 conditions, including 1 date equivalent query as well as 2 numeric column equivalent queries, and the query time was at least 5 se… --- ## [Index Shrinking?](https://discuss.elastic.co/t/index-shrinking/277739)
**Author:** [@herzel.sapago](https://discuss.elastic.co/u/herzel.sapago)\ **Replies:** 1\ **Last updated:** [July 4, 2021, 2:18pm UTC](https://discuss.elastic.co/t/index-shrinking/277739 "2021-07-04T14:18:37Z")
Hi We are implementing elastic in our company. As the person who responsible for it, I had been ask from my manager to check for grow of index each day and report it to group of managers. well I did it, finding that … --- ## [Elasticsearch-7.9.2-amd64.deb exit status 78](https://discuss.elastic.co/t/elasticsearch-7-9-2-amd64-deb-exit-status-78/277717)
**Author:** [@Sayantan\_Chakraborty](https://discuss.elastic.co/u/Sayantan_Chakraborty)\ **Replies:** 8\ **Last updated:** [July 4, 2021, 1:29pm UTC](https://discuss.elastic.co/t/elasticsearch-7-9-2-amd64-deb-exit-status-78/277717 "2021-07-04T13:29:29Z")
hi, i am facing a few issues for the Magento2.4.x installation. The process' exit code is 'exited' and its exit status is 78. Jul 04 02:12:40 somehost systemd\[1\]: elasticsearch.service: Failed with result\> -- Subject: U… --- ## [Impact of increasing index.max\_result\_window size to 10 million?](https://discuss.elastic.co/t/impact-of-increasing-index-max-result-window-size-to-10-million/277241)
**Author:** [@StringerBell](https://discuss.elastic.co/u/StringerBell)\ **Replies:** 2\ **Last updated:** [July 4, 2021, 1:34pm UTC](https://discuss.elastic.co/t/impact-of-increasing-index-max-result-window-size-to-10-million/277241 "2021-07-04T13:34:24Z")
I have a scenario where I want to increase the index.max\_result\_window size to about 10 million. My query only cares about fetching the sort order and not the actual \_source field. Does changing the max\_result\_window si… --- ## [Elasticsearch-plugin install PLUGIN hangs](https://discuss.elastic.co/t/elasticsearch-plugin-install-plugin-hangs/277732)
**Author:** [@mlrodrigo](https://discuss.elastic.co/u/mlrodrigo)\ **Replies:** 0\ **Last updated:** [July 4, 2021, 11:09am UTC](https://discuss.elastic.co/t/elasticsearch-plugin-install-plugin-hangs/277732 "2021-07-04T11:09:02Z")
Installing an Elasticsearch plugin hangs after a few tries due to (likely) a lack of entropy in /dev/random: bin/elasticsearch-plugin install analysis-smartcn --verbose -\> Installing analysis-smartcn Checking if url exi… --- ## [Elasticsearch Query Expansion problem, multi-field search](https://discuss.elastic.co/t/elasticsearch-query-expansion-problem-multi-field-search/277729)
**Author:** [@Federico\_Bottarelli](https://discuss.elastic.co/u/Federico_Bottarelli)\ **Replies:** 0\ **Last updated:** [July 4, 2021, 10:16am UTC](https://discuss.elastic.co/t/elasticsearch-query-expansion-problem-multi-field-search/277729 "2021-07-04T10:16:17Z")
Hi guys. I'm trying to expand some queries via Blind Relevance Feedback for an Information Retrieval project using TREC evaluation system, (CORD-19 database) I would like to use prefixes of the best terms instead of who… --- ## [Dynamically Re-Indexing Old Indices After A Long Time](https://discuss.elastic.co/t/dynamically-re-indexing-old-indices-after-a-long-time/275302)
**Author:** [@rknd](https://discuss.elastic.co/u/rknd)\ **Replies:** 1\ **Last updated:** [July 3, 2021, 7:42pm UTC](https://discuss.elastic.co/t/dynamically-re-indexing-old-indices-after-a-long-time/275302 "2021-07-03T19:42:53Z")
I have some indices like below; people\_in\_maribor people\_in\_rome etc. This indices get bigger after a long time. I want to ask how to reindex automatically old indices after a long time. As an example, I mean after… --- ## [Rally benchmarking Elasticsearch with 429 error code](https://discuss.elastic.co/t/rally-benchmarking-elasticsearch-with-429-error-code/276917)
**Author:** [@parallelism](https://discuss.elastic.co/u/parallelism)\ **Replies:** 1\ **Last updated:** [July 3, 2021, 6:11pm UTC](https://discuss.elastic.co/t/rally-benchmarking-elasticsearch-with-429-error-code/276917 "2021-07-03T18:11:18Z")
Hello, We are testing a new Elasticsearch cluster with Rally. The indexing task is getting an error rate greater than zero and we also found that the total number of indexed documents does not match the target number of… --- ## [Elasticsearch high load on some nodes](https://discuss.elastic.co/t/elasticsearch-high-load-on-some-nodes/276907)
**Author:** [@bxl](https://discuss.elastic.co/u/bxl)\ **Replies:** 1\ **Last updated:** [July 3, 2021, 6:08pm UTC](https://discuss.elastic.co/t/elasticsearch-high-load-on-some-nodes/276907 "2021-07-03T18:08:36Z")
os :CentOS Linux release 7.5.1804 (Core) java:1.8.0\_275 elasticsearch:6.8.1 ::: {192.168.1.3\_hot}{r6gbkwdTRDSUUooaLfWZPw}{djXsTjmBS3OM1IBzw4E2hA}{192.168.1.3}{192.168.1.3:9300}{ml.machine\_memory=540476571648, ml.max\_o… --- ## [Remove postfix of indices name on Restore](https://discuss.elastic.co/t/remove-postfix-of-indices-name-on-restore/276937)
**Author:** [@egibrajshori](https://discuss.elastic.co/u/egibrajshori)\ **Replies:** 1\ **Last updated:** [July 3, 2021, 6:05pm UTC](https://discuss.elastic.co/t/remove-postfix-of-indices-name-on-restore/276937 "2021-07-03T18:05:45Z")
I have a snapshot of an Elasticsearch cluster which has a number of indices. I have to restore the cluster on a new Elasticsearch cluster. All the indices have a -reindexed postfix as part of their name. What I need to … --- ## [ElasticSearch Segment merge not happening when deleted documents count is greater than 50%](https://discuss.elastic.co/t/elasticsearch-segment-merge-not-happening-when-deleted-documents-count-is-greater-than-50/277209)
**Author:** [@Vignesh\_Ramesh](https://discuss.elastic.co/u/Vignesh_Ramesh)\ **Replies:** 1\ **Last updated:** [July 3, 2021, 5:54pm UTC](https://discuss.elastic.co/t/elasticsearch-segment-merge-not-happening-when-deleted-documents-count-is-greater-than-50/277209 "2021-07-03T17:54:47Z")
Elasticsearch version: 7.10.0 I have an elasticsearch index with 8 shards in 8 different nodes and with a document count greater than 25 million documents(nested not included). It's an heavy update index. The document s… --- ## [Elasticsearch 7.13.2 linux(centos) service - Custom JVM - Doesn't start](https://discuss.elastic.co/t/elasticsearch-7-13-2-linux-centos-service-custom-jvm-doesnt-start/277668)
**Author:** [@Rajnish\_Kumar](https://discuss.elastic.co/u/Rajnish_Kumar)\ **Replies:** 2\ **Last updated:** [July 3, 2021, 2:56pm UTC](https://discuss.elastic.co/t/elasticsearch-7-13-2-linux-centos-service-custom-jvm-doesnt-start/277668 "2021-07-03T14:56:49Z")
It's installed as a linux service. It comes up and works fine using the bundled jdk(16). \[tsadmin@tsmkmslin04 ~\]$ curl -XGET 'http://localhost:9200' { "name" : "tsmkmslin04", "cluster\_name" : "elasticsearch", "clu… --- ## [ElasticSearch distinct results by multiple fields with pagination](https://discuss.elastic.co/t/elasticsearch-distinct-results-by-multiple-fields-with-pagination/277455)
**Author:** [@adolbik](https://discuss.elastic.co/u/adolbik)\ **Replies:** 2\ **Last updated:** [July 3, 2021, 7:52am UTC](https://discuss.elastic.co/t/elasticsearch-distinct-results-by-multiple-fields-with-pagination/277455 "2021-07-03T07:52:08Z")
I have index with bunch of events (user viewed page, clicked something and etc.). I have a page in the system where I need to display uniq results (only one row per user + event + itemId). It means if we have 7 rows like… --- ## [Type date\_range formatting v6.8 vs v7.12](https://discuss.elastic.co/t/type-date-range-formatting-v6-8-vs-v7-12/277698)
**Author:** [@elasticfish](https://discuss.elastic.co/u/elasticfish)\ **Replies:** 0\ **Last updated:** [July 3, 2021, 7:38am UTC](https://discuss.elastic.co/t/type-date-range-formatting-v6-8-vs-v7-12/277698 "2021-07-03T07:38:33Z")
Hello, I am upgrading from ES 6.8 to ES 7.12.1 and I have a dynamic template like: "dynamic\_templates": \[ { "ecom\_data": { "mapping": { "type": "date\_range", "f… --- ## [Uncertain if Refresh is needed](https://discuss.elastic.co/t/uncertain-if-refresh-is-needed/277692)
**Author:** [@dude88](https://discuss.elastic.co/u/dude88)\ **Replies:** 4\ **Last updated:** [July 3, 2021, 5:32am UTC](https://discuss.elastic.co/t/uncertain-if-refresh-is-needed/277692 "2021-07-03T05:32:14Z")
Hi I need to run approximately 30,000 updateByQuery's against my index which has about 35 million decently large documents, sequentially. I'm currently setting refresh:true, and the eta for my script to complete all 30,0… --- ## [\[bool\] malformed query, expected \[END\_OBJECT\] but found \[FIELD\_NAME\]](https://discuss.elastic.co/t/bool-malformed-query-expected-end-object-but-found-field-name/277676)
**Author:** [@Cherrys](https://discuss.elastic.co/u/Cherrys)\ **Replies:** 0\ **Last updated:** [July 2, 2021, 5:40pm UTC](https://discuss.elastic.co/t/bool-malformed-query-expected-end-object-but-found-field-name/277676 "2021-07-02T17:40:21Z")
\*\*Request\*\* POST customer\_details/\_search { "\_source": { "includes": \[ "globalName", "customerName","type" ,"container.type"\] }, "query": { "bool": { "filter": \[ { "has\_parent": … --- ## [Elasticsearch 3 nodes cluster not joining with each other](https://discuss.elastic.co/t/elasticsearch-3-nodes-cluster-not-joining-with-each-other/277060)
**Author:** [@RAM\_NATHAN](https://discuss.elastic.co/u/RAM_NATHAN)\ **Replies:** 16\ **Last updated:** [July 2, 2021, 3:04pm UTC](https://discuss.elastic.co/t/elasticsearch-3-nodes-cluster-not-joining-with-each-other/277060 "2021-07-02T15:04:44Z")
Hi I have 3 nodes cluster with below config Node 1 :: cluster.name: "as\_elasticsearch" node.name: "node-1" node.data: true path.repo: "/var/elasticsearch/snapshot/" path.data: "/var/lib/elasticsearch" network.… --- ## [Painless Script throws NullPointer exception](https://discuss.elastic.co/t/painless-script-throws-nullpointer-exception/277037)
**Author:** [@pcosic](https://discuss.elastic.co/u/pcosic)\ **Replies:** 5\ **Last updated:** [July 2, 2021, 12:02pm UTC](https://discuss.elastic.co/t/painless-script-throws-nullpointer-exception/277037 "2021-07-02T12:02:00Z")
Hi there, the last days I tried to use a supervised model for DGA detection. As usual, you prepare your index with an ingest pipeline and then use the inference processor to insert a prediction into the event. So far … --- ## [ES 1.7.6 Search within root and nested objects](https://discuss.elastic.co/t/es-1-7-6-search-within-root-and-nested-objects/277333)
**Author:** [@ValeryL](https://discuss.elastic.co/u/ValeryL)\ **Replies:** 4\ **Last updated:** [July 2, 2021, 10:18am UTC](https://discuss.elastic.co/t/es-1-7-6-search-within-root-and-nested-objects/277333 "2021-07-02T10:18:05Z")
Hi there, I'm trying to understand, why search within root and nested objects works in ES 1.7 and now it dosn't work in ES 7.13. May be I'm missing something? I use the following index mapping and search requests: ES 1.… --- ## [Esrally loaddriver configurations](https://discuss.elastic.co/t/esrally-loaddriver-configurations/276803)
**Author:** [@purushothamkdr143](https://discuss.elastic.co/u/purushothamkdr143)\ **Replies:** 2\ **Last updated:** [July 2, 2021, 8:59am UTC](https://discuss.elastic.co/t/esrally-loaddriver-configurations/276803 "2021-07-02T08:59:11Z")
Hi All, I am trying to setup esrally in k8s, As per the Tips and Tricks — Rally 2.2.1 documentation it is good approach or solution to distribute the load to loaddrivers. what would be the better configurations for load… --- ## [Elasticsearch register backup repository with different UID and GID](https://discuss.elastic.co/t/elasticsearch-register-backup-repository-with-different-uid-and-gid/277212)
**Author:** [@KA3AXCTAH](https://discuss.elastic.co/u/KA3AXCTAH)\ **Replies:** 6\ **Last updated:** [July 2, 2021, 8:18am UTC](https://discuss.elastic.co/t/elasticsearch-register-backup-repository-with-different-uid-and-gid/277212 "2021-07-02T08:18:18Z")
I have 2 Elasticsearch clusters they are backed up to the same NFS share, but in different directories and the elasticsearch user on these VMs has different UIDs and GIDs For example, for the corn project, the elasticsea… --- ## [Converting Date-String into Date with Ingest-pipeline not working](https://discuss.elastic.co/t/converting-date-string-into-date-with-ingest-pipeline-not-working/277613)
**Author:** [@adamio](https://discuss.elastic.co/u/adamio)\ **Replies:** 1\ **Last updated:** [July 2, 2021, 6:54am UTC](https://discuss.elastic.co/t/converting-date-string-into-date-with-ingest-pipeline-not-working/277613 "2021-07-02T06:54:18Z")
We have this pipeline: PUT \_ingest/pipeline/j2-e2a-test { "processors": \[ { "grok": { "field": "message", "patterns": \[ "(?m)(?\%{DATE\_EU}\\\\s+%{TIME})\\\\s+(%{WORD:loglevel… --- ## [What are the specifications of your shard configuration or equipment?](https://discuss.elastic.co/t/what-are-the-specifications-of-your-shard-configuration-or-equipment/276155)
**Author:** [@its-ogawa](https://discuss.elastic.co/u/its-ogawa)\ **Replies:** 12\ **Last updated:** [July 2, 2021, 6:46am UTC](https://discuss.elastic.co/t/what-are-the-specifications-of-your-shard-configuration-or-equipment/276155 "2021-07-02T06:46:45Z")
I'm using Filebeat, Logstash and ElasticSearch to collect logs. Today, I encountered the following error. # tail /var/log/logstash/logstash-plain.log \[2021-06-16T10:10:48,509\]\[WARN \]\[logstash.outputs.elasticsearch\]\[mai… --- ## [Mapping file \_settings.json does not exist for elasticsearch version 7](https://discuss.elastic.co/t/mapping-file-settings-json-does-not-exist-for-elasticsearch-version-7/277603)
**Author:** [@dotel](https://discuss.elastic.co/u/dotel)\ **Replies:** 1\ **Last updated:** [July 2, 2021, 5:12am UTC](https://discuss.elastic.co/t/mapping-file-settings-json-does-not-exist-for-elasticsearch-version-7/277603 "2021-07-02T05:12:50Z")
I'm using elastic search 7.13.2 and fscrawler-2.5. When I try to create a new job in fscrawler using bin/fscrawler testjob2 it prompts me to create a new job and creates a new job with config file here /root/.fscrawler/t… --- ## [Count specific entries in some field](https://discuss.elastic.co/t/count-specific-entries-in-some-field/277610)
**Author:** [@denisnovac](https://discuss.elastic.co/u/denisnovac)\ **Replies:** 0\ **Last updated:** [July 2, 2021, 4:04am UTC](https://discuss.elastic.co/t/count-specific-entries-in-some-field/277610 "2021-07-02T04:04:18Z")
Hi everyone. I have this aggregation to count the inputs in some field: "aggs": { "prodt": { "filter": { "bool": {} }, "aggs": { "prodt": { … --- ## [Is greates store logs into one indice or store in N small indices?](https://discuss.elastic.co/t/is-greates-store-logs-into-one-indice-or-store-in-n-small-indices/277588)
**Author:** [@guimap](https://discuss.elastic.co/u/guimap)\ **Replies:** 4\ **Last updated:** [July 1, 2021, 10:14pm UTC](https://discuss.elastic.co/t/is-greates-store-logs-into-one-indice-or-store-in-n-small-indices/277588 "2021-07-01T22:14:05Z")
Hi I was wondering which is greatest way to store logs data, store into only one indice ( maybe use ILM to manager this indice ) or split in small indices (like: logs-2021.07.01, logs-2021.07.02 etc) What the greatest … --- ## [Implementing a parent-child relationship and changing parent of a child document](https://discuss.elastic.co/t/implementing-a-parent-child-relationship-and-changing-parent-of-a-child-document/277498)
**Author:** [@ViniciusSPaiva](https://discuss.elastic.co/u/ViniciusSPaiva)\ **Replies:** 2\ **Last updated:** [July 1, 2021, 9:56pm UTC](https://discuss.elastic.co/t/implementing-a-parent-child-relationship-and-changing-parent-of-a-child-document/277498 "2021-07-01T21:56:39Z")
Hello, We need to create a solution able to search for two entities: record and file. Each one has its properties and records can have zero or more files. Appears to be very simple, but I am finding very difficult to f… --- ## [Numbers - ignore scientific notation](https://discuss.elastic.co/t/numbers-ignore-scientific-notation/277600)
**Author:** [@myronuecker](https://discuss.elastic.co/u/myronuecker)\ **Replies:** 0\ **Last updated:** [July 1, 2021, 9:42pm UTC](https://discuss.elastic.co/t/numbers-ignore-scientific-notation/277600 "2021-07-01T21:42:01Z")
We have fields that are defined like this: "type": "text", "store": true, "fields": { "date": { "type": "date", "ignore\_malformed": true, "format": "yyyy-MM-dd HH:mm:ss||yyyy-MM-dd" }, "number": { "… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=615) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=617)