# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=619 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 620 --- ## [High system load during search when total index size is large](https://discuss.elastic.co/t/high-system-load-during-search-when-total-index-size-is-large/274439)
**Author:** [@smlbiobot](https://discuss.elastic.co/u/smlbiobot)\ **Replies:** 8\ **Last updated:** [June 28, 2021, 6:56pm UTC](https://discuss.elastic.co/t/high-system-load-during-search-when-total-index-size-is-large/274439 "2021-06-28T18:56:56Z")
I have a cluster setup where some nodes can experience high system load for a specific index. Index The index is time-based, and is named as such: index-2021.03 index-2021.04 index-2021.05 In other words, I begin a n… --- ## [How to build a plugin for a not yet released version?](https://discuss.elastic.co/t/how-to-build-a-plugin-for-a-not-yet-released-version/276833)
**Author:** [@rafis](https://discuss.elastic.co/u/rafis)\ **Replies:** 6\ **Last updated:** [June 28, 2021, 6:21pm UTC](https://discuss.elastic.co/t/how-to-build-a-plugin-for-a-not-yet-released-version/276833 "2021-06-28T18:21:04Z")
Hello, I need to test a fix for elasticsearch 7.14.0 code with my plugin installed. The plugin version must match to be installed, but the latest publicly available build-tools is 7.13.2. I can build elasticsearch-7.14.… --- ## [How to convert logstash elasticsearch plugin in ingest pipeline?](https://discuss.elastic.co/t/how-to-convert-logstash-elasticsearch-plugin-in-ingest-pipeline/277156)
**Author:** [@crpj](https://discuss.elastic.co/u/crpj)\ **Replies:** 3\ **Last updated:** [June 28, 2021, 5:38pm UTC](https://discuss.elastic.co/t/how-to-convert-logstash-elasticsearch-plugin-in-ingest-pipeline/277156 "2021-06-28T17:38:41Z")
Hello, I would like to know if and how it is possible to use the logstash elasticsearch plugin in an ingest pipeline, currently the use of a workaround in logstash which enables enriching data based in a query from ano… --- ## [Alphabetically sort name field](https://discuss.elastic.co/t/alphabetically-sort-name-field/276505)
**Author:** [@gautamz07](https://discuss.elastic.co/u/gautamz07)\ **Replies:** 2\ **Last updated:** [June 28, 2021, 5:26pm UTC](https://discuss.elastic.co/t/alphabetically-sort-name-field/276505 "2021-06-28T17:26:13Z")
I have the following definition for the name field "name": { "type": "text", "fields": { "keyword": { "type": "keyword", "ignore\_above": 256 } } }, How do i sort this alphabetically ? I am tr… --- ## [Proximity searches](https://discuss.elastic.co/t/proximity-searches/276850)
**Author:** [@Abhishek\_Shinde](https://discuss.elastic.co/u/Abhishek_Shinde)\ **Replies:** 3\ **Last updated:** [June 28, 2021, 3:49pm UTC](https://discuss.elastic.co/t/proximity-searches/276850 "2021-06-28T15:49:02Z")
I’m trying to achieve Proximity searches with whole wild card, • (Alice \* Bob) NEAR/4 (Sam \* \* John): find all the documents having the phrase “Alice \* Bob” within 4 words distance to “Sam \* \* John”. I’ve tried followi… --- ## [Not whitelisted in reindex.remote.whitelist error with Docker clusters](https://discuss.elastic.co/t/not-whitelisted-in-reindex-remote-whitelist-error-with-docker-clusters/277253)
**Author:** [@cis4life](https://discuss.elastic.co/u/cis4life)\ **Replies:** 0\ **Last updated:** [June 28, 2021, 3:39pm UTC](https://discuss.elastic.co/t/not-whitelisted-in-reindex-remote-whitelist-error-with-docker-clusters/277253 "2021-06-28T15:39:28Z")
I have 2 ES docker clusters. I want to re-index some indexes from the smaller docker es cluster to my larger es docker cluster. When i follow the instructions to reindex i get the "not whitelisted in reindex.remote.wh… --- ## [elasticsearch-7.14.0-SNAPSHOT and 7.x branch depend on different versions of lucene](https://discuss.elastic.co/t/elasticsearch-7-14-0-snapshot-and-7-x-branch-depend-on-different-versions-of-lucene/277216)
**Author:** [@rafis](https://discuss.elastic.co/u/rafis)\ **Replies:** 3\ **Last updated:** [June 28, 2021, 1:46pm UTC](https://discuss.elastic.co/t/elasticsearch-7-14-0-snapshot-and-7-x-branch-depend-on-different-versions-of-lucene/277216 "2021-06-28T13:46:54Z")
Hello, https://snapshots.elastic.co/maven/org/elasticsearch/elasticsearch/7.14.0-SNAPSHOT/elasticsearch-7.14.0-SNAPSHOT.pom depends on lucene 8.9.0-snapshot-ddc238e5df8, but 7.x branch of elasticsearch repository - on 8… --- ## [Different number of hits between DSL Query and KQL](https://discuss.elastic.co/t/different-number-of-hits-between-dsl-query-and-kql/277063)
**Author:** [@baddack](https://discuss.elastic.co/u/baddack)\ **Replies:** 1\ **Last updated:** [June 28, 2021, 11:11am UTC](https://discuss.elastic.co/t/different-number-of-hits-between-dsl-query-and-kql/277063 "2021-06-28T11:11:50Z")
Hello everyone, I was curious about working with DSL queries, so I made some tests and I found something strange. I have a winlogbeat-security index which contains windows security events and I am searching logs with … --- ## [Can't start elasticsearch](https://discuss.elastic.co/t/cant-start-elasticsearch/277086)
**Author:** [@Fatma\_Alzahraa](https://discuss.elastic.co/u/Fatma_Alzahraa)\ **Replies:** 2\ **Last updated:** [June 28, 2021, 10:37am UTC](https://discuss.elastic.co/t/cant-start-elasticsearch/277086 "2021-06-28T10:37:18Z")
Hello , I installed elasticsearch but can't start and get errors centos 7 jdk version : jdk 11 elasticsearch version : 7.13.2 \[root@server bin\]# systemctl status elasticsearch.service ● elasticsearch.service - Elas… --- ## [org.elasticsearch.hadoop.EsHadoopIllegalStateException: Position for field' not found in row](https://discuss.elastic.co/t/org-elasticsearch-hadoop-eshadoopillegalstateexception-position-for-field-not-found-in-row/274662)
**Author:** [@priamai](https://discuss.elastic.co/u/priamai)\ **Replies:** 1\ **Last updated:** [June 28, 2021, 10:23am UTC](https://discuss.elastic.co/t/org-elasticsearch-hadoop-eshadoopillegalstateexception-position-for-field-not-found-in-row/274662 "2021-06-28T10:23:14Z")
Hi there, I have seen this issue before and it seems stills to apply. I am using this version via pyspark: ss = ( SparkSession.builder.appName("ES") .config("spark.driver.memory", "8g") .config( "spark.jars.packa… --- ## [Calculate a list of identical date prefixes for a date range](https://discuss.elastic.co/t/calculate-a-list-of-identical-date-prefixes-for-a-date-range/277199)
**Author:** [@asasas234](https://discuss.elastic.co/u/asasas234)\ **Replies:** 0\ **Last updated:** [June 28, 2021, 10:11am UTC](https://discuss.elastic.co/t/calculate-a-list-of-identical-date-prefixes-for-a-date-range/277199 "2021-06-28T10:11:06Z")
The background is, I want to use the keyword field to optimize the search of 1 date range, because it is keyword, I need to use prefix search, but if it is 1 date range, I need to calculate 2 date prefixes based on the s… --- ## [The specified log group does not exist. Error when configuring lambda function for cloudwatch logs](https://discuss.elastic.co/t/the-specified-log-group-does-not-exist-error-when-configuring-lambda-function-for-cloudwatch-logs/277193)
**Author:** [@Origin\_Jing](https://discuss.elastic.co/u/Origin_Jing)\ **Replies:** 0\ **Last updated:** [June 28, 2021, 9:26am UTC](https://discuss.elastic.co/t/the-specified-log-group-does-not-exist-error-when-configuring-lambda-function-for-cloudwatch-logs/277193 "2021-06-28T09:26:00Z")
I'm trying to setup the functionbeat aws example. However, I keep getting "ResourceState: CREATE\_FAILED, ResourceStatusReason: The specified log group does not exist. (Service: AWSLogs; Status Code: 400; Error Code: Reso… --- ## [ILM policy without alias](https://discuss.elastic.co/t/ilm-policy-without-alias/277188)
**Author:** [@francois75](https://discuss.elastic.co/u/francois75)\ **Replies:** 0\ **Last updated:** [June 28, 2021, 8:52am UTC](https://discuss.elastic.co/t/ilm-policy-without-alias/277188 "2021-06-28T08:52:04Z")
To smoothly transit from Elasticsearch curator to ILM I want to implement a simple ILM policy that change index status according to its age. So I've create a policy and added to existing indices as following: { "inde… --- ## [Questions related to transforms limitations](https://discuss.elastic.co/t/questions-related-to-transforms-limitations/277158)
**Author:** [@crpj](https://discuss.elastic.co/u/crpj)\ **Replies:** 1\ **Last updated:** [June 28, 2021, 7:35am UTC](https://discuss.elastic.co/t/questions-related-to-transforms-limitations/277158 "2021-06-28T07:35:01Z")
Hello, I am experimenting Transforms and I would to confirm that the limitations below are true: Doc removal detection in source and reflection upon next sync. If a doc is removed at source the value remains in the de… --- ## [Offline Elastic Restore From GCS](https://discuss.elastic.co/t/offline-elastic-restore-from-gcs/276842)
**Author:** [@simonross936](https://discuss.elastic.co/u/simonross936)\ **Replies:** 4\ **Last updated:** [June 28, 2021, 6:50am UTC](https://discuss.elastic.co/t/offline-elastic-restore-from-gcs/276842 "2021-06-28T06:50:43Z")
I needed to shift a sizeable amount of data from GCS repository. Directly from the Google Console, I downloaded the Elastic snapshots to a local external hard drive. With a fully functioning local Elastic instance, wher… --- ## [Can I create ingest processor to do some action like append tags or insert an alert to other index when a document match some conditions](https://discuss.elastic.co/t/can-i-create-ingest-processor-to-do-some-action-like-append-tags-or-insert-an-alert-to-other-index-when-a-document-match-some-conditions/276999)
**Author:** [@ndhcoder](https://discuss.elastic.co/u/ndhcoder)\ **Replies:** 3\ **Last updated:** [June 28, 2021, 6:13am UTC](https://discuss.elastic.co/t/can-i-create-ingest-processor-to-do-some-action-like-append-tags-or-insert-an-alert-to-other-index-when-a-document-match-some-conditions/276999 "2021-06-28T06:13:50Z")
Hello everyone, Have a nice day ! I have a problem, Can I create ingest processor to do some action like append tags or insert an alert to other index when a document match some conditions ? Example: I want to get so… --- ## [Coordinating Node Role in Data Ingestion](https://discuss.elastic.co/t/coordinating-node-role-in-data-ingestion/277157)
**Author:** [@vikasp](https://discuss.elastic.co/u/vikasp)\ **Replies:** 4\ **Last updated:** [June 28, 2021, 6:08am UTC](https://discuss.elastic.co/t/coordinating-node-role-in-data-ingestion/277157 "2021-06-28T06:08:05Z")
Can anybody please help me understand the role of coordinating node with respect to data ingestion. I understand the role of the coordinating nodes in terms of search queries (the scatter and gather phases), But what i… --- ## [CCR stats. Question about negative values](https://discuss.elastic.co/t/ccr-stats-question-about-negative-values/276916)
**Author:** [@Armen\_Petrosyan](https://discuss.elastic.co/u/Armen_Petrosyan)\ **Replies:** 1\ **Last updated:** [June 28, 2021, 5:25am UTC](https://discuss.elastic.co/t/ccr-stats-question-about-negative-values/276916 "2021-06-28T05:25:16Z")
Hi. I have two ES clusters 7.7.1. Leader cluster include 1 index with 2 primary and 2 replica shards. (total 6) I indexed few documents (the same doc). I see that those documents indexed to the one primary shard, mean… --- ## [Encrypted connection between Logstash and Elasticsearch](https://discuss.elastic.co/t/encrypted-connection-between-logstash-and-elasticsearch/277091)
**Author:** [@manfred](https://discuss.elastic.co/u/manfred)\ **Replies:** 2\ **Last updated:** [June 28, 2021, 4:51am UTC](https://discuss.elastic.co/t/encrypted-connection-between-logstash-and-elasticsearch/277091 "2021-06-28T04:51:32Z")
Hi. How to encrypt communication between Logstash and Elasticsearch DB ? From what I read it uses by default plain HTTP, is there a way to make it HTTPS ? --- ## [How to delete a field completely from an index](https://discuss.elastic.co/t/how-to-delete-a-field-completely-from-an-index/276893)
**Author:** [@kwoxer](https://discuss.elastic.co/u/kwoxer)\ **Replies:** 6\ **Last updated:** [June 28, 2021, 3:43am UTC](https://discuss.elastic.co/t/how-to-delete-a-field-completely-from-an-index/276893 "2021-06-28T03:43:45Z")
I created some field in the past for testing. Let's take the "STATISTIC-PROCESS-RUNTIME-HOUR" as an example. So I was able to find a way to remove that field from my index with: POST filebeat-7.13.0-2021.05.26-000001/\_… --- ## [In Kibana data is coming at localtime+3 instead of UTC+3](https://discuss.elastic.co/t/in-kibana-data-is-coming-at-localtime-3-instead-of-utc-3/277116)
**Author:** [@Yaniv\_Etrogi](https://discuss.elastic.co/u/Yaniv_Etrogi)\ **Replies:** 2\ **Last updated:** [June 28, 2021, 12:18am UTC](https://discuss.elastic.co/t/in-kibana-data-is-coming-at-localtime-3-instead-of-utc-3/277116 "2021-06-28T00:18:24Z")
My system Ubuntu 18.04 Elastic version 7.12 run on docker PowerShell sending data to Elastic from Windows hosts System is set to UTC+3 Elastic is set to UTC+3 My problem In Kibana data is coming at localtime+3 ins… --- ## [Elastic Data Node leaves the cluster after force merge](https://discuss.elastic.co/t/elastic-data-node-leaves-the-cluster-after-force-merge/276672)
**Author:** [@gdd](https://discuss.elastic.co/u/gdd)\ **Replies:** 4\ **Last updated:** [June 27, 2021, 11:00pm UTC](https://discuss.elastic.co/t/elastic-data-node-leaves-the-cluster-after-force-merge/276672 "2021-06-27T23:00:23Z")
Elasticsearch version 7.3.2, JVM 12.0.2; Heap 15 GB. The machine remains blocked and it's not possible to access by ssh. These the node statististics just before the issue. And these are the system metrics: Anyb… --- ## [Convert text value to IP](https://discuss.elastic.co/t/convert-text-value-to-ip/277146)
**Author:** [@frank\_rib](https://discuss.elastic.co/u/frank_rib)\ **Replies:** 2\ **Last updated:** [June 27, 2021, 10:27pm UTC](https://discuss.elastic.co/t/convert-text-value-to-ip/277146 "2021-06-27T22:27:14Z")
Hello every body, I am parsing the wallix logs by using the kv plugin kv{ source =\> "syslog\_message" value\_split =\> "=\\"" field\_split =\> "\\"\\s" } As results i get all the output as text as you can see bellow: \> { \>… --- ## [DSL aggregation query in event pair documents for showing in kibana](https://discuss.elastic.co/t/dsl-aggregation-query-in-event-pair-documents-for-showing-in-kibana/277165)
**Author:** [@irajtaghlidi](https://discuss.elastic.co/u/irajtaghlidi)\ **Replies:** 0\ **Last updated:** [June 27, 2021, 10:03pm UTC](https://discuss.elastic.co/t/dsl-aggregation-query-in-event-pair-documents-for-showing-in-kibana/277165 "2021-06-27T22:03:30Z")
I have event document pairs that each one shows the start or end of an event. Every two events have a key with the save value. for example: doc1: { startTime: 123 endTime: 0 buildId: ABC1 (shared ID) } doc2: { … --- ## [Field names with dot notation in ES Node.js client](https://discuss.elastic.co/t/field-names-with-dot-notation-in-es-node-js-client/277147)
**Author:** [@Cholley\_Alexandre](https://discuss.elastic.co/u/Cholley_Alexandre)\ **Replies:** 1\ **Last updated:** [June 27, 2021, 4:41pm UTC](https://discuss.elastic.co/t/field-names-with-dot-notation-in-es-node-js-client/277147 "2021-06-27T16:41:11Z")
Hi, I'm trying to write a field with dot notation in the body of the Search API in Node.js Client but it doesn't work. The mapping is : "my\_field": { "type":"text", "fields": { "keyword": { "type"… --- ## [Harvester read/write is not working](https://discuss.elastic.co/t/harvester-read-write-is-not-working/277130)
**Author:** [@shankul](https://discuss.elastic.co/u/shankul)\ **Replies:** 2\ **Last updated:** [June 27, 2021, 2:01pm UTC](https://discuss.elastic.co/t/harvester-read-write-is-not-working/277130 "2021-06-27T14:01:10Z")
Hi Team, We are facing some intermittent issues in Kibana logs. While checking we got to know that we are not able to process the filebeat logs and rac is that harvester is not able to write the logs as its only reading… --- ## [Clean install of ES 7.13.2 on Ubuntu 20.04 hangs](https://discuss.elastic.co/t/clean-install-of-es-7-13-2-on-ubuntu-20-04-hangs/276808)
**Author:** [@Roger\_Clark](https://discuss.elastic.co/u/Roger_Clark)\ **Replies:** 6\ **Last updated:** [June 27, 2021, 11:28am UTC](https://discuss.elastic.co/t/clean-install-of-es-7-13-2-on-ubuntu-20-04-hangs/276808 "2021-06-27T11:28:02Z")
I've been trying to test a clean config of ES stack on an Ubuntu VM following Install Elasticsearch with Debian Package | Elasticsearch Guide \[7.13\] | Elastic The system was a clean install to a 4 core 4GB VM on 20.04.2… --- ## [{"statusCode":500,"error":"Internal Server Error","message":"An internal server error occurred."}](https://discuss.elastic.co/t/statuscode-500-error-internal-server-error-message-an-internal-server-error-occurred/277013)
**Author:** [@Tirupathirao](https://discuss.elastic.co/u/Tirupathirao)\ **Replies:** 6\ **Last updated:** [June 26, 2021, 6:57am UTC](https://discuss.elastic.co/t/statuscode-500-error-internal-server-error-message-an-internal-server-error-occurred/277013 "2021-06-26T06:57:31Z")
{"statusCode":500,"error":"Internal Server Error","message":"An internal server error occurred."} --- ## [Resolve unassigned shards?](https://discuss.elastic.co/t/resolve-unassigned-shards/276793)
**Author:** [@lchan](https://discuss.elastic.co/u/lchan)\ **Replies:** 5\ **Last updated:** [June 26, 2021, 3:17am UTC](https://discuss.elastic.co/t/resolve-unassigned-shards/276793 "2021-06-26T03:17:57Z")
I am an unassigned shards issue on a newly setup cluster where the ilm policy is not moving the shares from hot to warm. The ilm policy is set to rollover after 1d or 50gb but the allocation is complaining about node do… --- ## [Index.mapping.total\_fields.limit](https://discuss.elastic.co/t/index-mapping-total-fields-limit/275193)
**Author:** [@Bruceclegg](https://discuss.elastic.co/u/Bruceclegg)\ **Replies:** 6\ **Last updated:** [June 25, 2021, 7:01pm UTC](https://discuss.elastic.co/t/index-mapping-total-fields-limit/275193 "2021-06-25T19:01:43Z")
... We're running elasticsearch 6.8.15 For various reasons we are unable to run Lifecycle Management on our indexes - so I have set up a cron job which uses curator that when an index reaches a certain size or age it w… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=618) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=620)