# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=621 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 622 --- ## [Strange High CPU usage related to licensing](https://discuss.elastic.co/t/strange-high-cpu-usage-related-to-licensing/276676)
**Author:** [@elnapo](https://discuss.elastic.co/u/elnapo)\ **Replies:** 6\ **Last updated:** [June 24, 2021, 12:44pm UTC](https://discuss.elastic.co/t/strange-high-cpu-usage-related-to-licensing/276676 "2021-06-24T12:44:04Z")
Encountered a strange Cluster behavior on a central logging cluster where about 50 filebeats are ingesting data. It seems that most of the CPU is used for security operations. Here is what GET \_nodes/hot\_threads is say… --- ## [Disptached index, is it possible to filter across indexes by another index value?](https://discuss.elastic.co/t/disptached-index-is-it-possible-to-filter-across-indexes-by-another-index-value/276920)
**Author:** [@Hugo\_Martin](https://discuss.elastic.co/u/Hugo_Martin)\ **Replies:** 0\ **Last updated:** [June 24, 2021, 11:24am UTC](https://discuss.elastic.co/t/disptached-index-is-it-possible-to-filter-across-indexes-by-another-index-value/276920 "2021-06-24T11:24:46Z")
Hi everyone, I'm pretty new to ELK and I have few questions about indexes relations. Some context: we use MongoDB as database to interract with microservices, and use monstache to sync Mongo and ES, it works perfectly.… --- ## [Nesting some other path in a subaggregation inside another nested path](https://discuss.elastic.co/t/nesting-some-other-path-in-a-subaggregation-inside-another-nested-path/276883)
**Author:** [@broy](https://discuss.elastic.co/u/broy)\ **Replies:** 0\ **Last updated:** [June 24, 2021, 6:54am UTC](https://discuss.elastic.co/t/nesting-some-other-path-in-a-subaggregation-inside-another-nested-path/276883 "2021-06-24T06:54:14Z")
Minimal schema { "mappings": { "\_doc": { "dynamic": "false", "\_source": { "includes": \[ \] }, "properties": { "\_\_collection": { "type": "keyword"… --- ## [Graph logs values and not syntetic metrics about logs](https://discuss.elastic.co/t/graph-logs-values-and-not-syntetic-metrics-about-logs/276910)
**Author:** [@PatrikM](https://discuss.elastic.co/u/PatrikM)\ **Replies:** 0\ **Last updated:** [June 24, 2021, 10:22am UTC](https://discuss.elastic.co/t/graph-logs-values-and-not-syntetic-metrics-about-logs/276910 "2021-06-24T10:22:00Z")
I have a database that has some metrics I would like to chart in elasticsearch. I managed to send those metrics to elasticsearch and I'm able to view them in the kibana discover as logs. I'm looking on how I could be … --- ## [Elasticsearch mapping with nested objects](https://discuss.elastic.co/t/elasticsearch-mapping-with-nested-objects/276888)
**Author:** [@mskocabay](https://discuss.elastic.co/u/mskocabay)\ **Replies:** 0\ **Last updated:** [June 24, 2021, 7:30am UTC](https://discuss.elastic.co/t/elasticsearch-mapping-with-nested-objects/276888 "2021-06-24T07:30:18Z")
It is my mapping. product\_base is nested object also manufacturer is child of product\_base and nested object. When i create my doc, if product\_base count more than 1 , seems product\_base.0, product\_base.1 . However i co… --- ## [Log4j2.properties- log rotation issue in ES-7.5.2 Cluster](https://discuss.elastic.co/t/log4j2-properties-log-rotation-issue-in-es-7-5-2-cluster/276881)
**Author:** [@anguri\_sudhakar](https://discuss.elastic.co/u/anguri_sudhakar)\ **Replies:** 0\ **Last updated:** [June 24, 2021, 6:35am UTC](https://discuss.elastic.co/t/log4j2-properties-log-rotation-issue-in-es-7-5-2-cluster/276881 "2021-06-24T06:35:09Z")
Hi Team , need help on log4j2.properties, not rolling over when new day happens. We are using default log4j2.properties file with elasticsearch-7.5.2 version. One observation ,in master1&2 nodes are rolling every end o… --- ## [Hosting/Indexing strategy for long-term storing data (if possible single node)](https://discuss.elastic.co/t/hosting-indexing-strategy-for-long-term-storing-data-if-possible-single-node/276657)
**Author:** [@yBother](https://discuss.elastic.co/u/yBother)\ **Replies:** 5\ **Last updated:** [June 24, 2021, 5:26am UTC](https://discuss.elastic.co/t/hosting-indexing-strategy-for-long-term-storing-data-if-possible-single-node/276657 "2021-06-24T05:26:57Z")
I have following requirements, that appear to be not so typical: Indexing up to ~5000 documents per second (small docs, (semi) structured, needs to reliable!) Exporting / Querying of big data sets up to 5\*10^6 document… --- ## [Filebeat modules](https://discuss.elastic.co/t/filebeat-modules/276862)
**Author:** [@leemase004](https://discuss.elastic.co/u/leemase004)\ **Replies:** 1\ **Last updated:** [June 24, 2021, 5:07am UTC](https://discuss.elastic.co/t/filebeat-modules/276862 "2021-06-24T05:07:32Z")
We inherited a cluster and are trying to update the ingest pipeline (ES version 7.6) Context: When we do GET ingest/pipeline there is a 15k line pipeline. It has all the processors from the filebeat modules they have up… --- ## [High level rest client with data stream](https://discuss.elastic.co/t/high-level-rest-client-with-data-stream/276828)
**Author:** [@prithvirajsivarajan](https://discuss.elastic.co/u/prithvirajsivarajan)\ **Replies:** 1\ **Last updated:** [June 24, 2021, 1:06am UTC](https://discuss.elastic.co/t/high-level-rest-client-with-data-stream/276828 "2021-06-24T01:06:57Z")
I'm using high level rest client to bulk insert data. In the BulkRequest object, we are inserting the data with the 'index' operation. like this: { "index" : { "\_index" : "test", "\_id" : "1" } } { "field1" : "value1" } … --- ## [Data backup from prod elastic cluster to backup elastic cluster periodically](https://discuss.elastic.co/t/data-backup-from-prod-elastic-cluster-to-backup-elastic-cluster-periodically/276855)
**Author:** [@jebuna\_hau](https://discuss.elastic.co/u/jebuna_hau)\ **Replies:** 1\ **Last updated:** [June 24, 2021, 12:31am UTC](https://discuss.elastic.co/t/data-backup-from-prod-elastic-cluster-to-backup-elastic-cluster-periodically/276855 "2021-06-24T00:31:36Z")
Hello, I am currently trying to find the best way to keep two elastic clusters in sync. I tried it by fetching the modified data from the main cluster and update/insert to the backup cluster. The idea is to keep the two… --- ## [Trying to follow can't follow instructions on Parent/Child relationships](https://discuss.elastic.co/t/trying-to-follow-cant-follow-instructions-on-parent-child-relationships/276596)
**Author:** [@bill\_d](https://discuss.elastic.co/u/bill_d)\ **Replies:** 5\ **Last updated:** [June 24, 2021, 12:21am UTC](https://discuss.elastic.co/t/trying-to-follow-cant-follow-instructions-on-parent-child-relationships/276596 "2021-06-24T00:21:19Z")
I'm following the example on this page: Parent/Child relationships | Elasticsearch.Net and NEST: the .NET clients \[7.x\] | Elastic. My program fails indexing the parent, with: ServerError: Type: routing\_missing\_exception… --- ## [Is Elasticsearch refresh interval useless option when updating document of specific index?](https://discuss.elastic.co/t/is-elasticsearch-refresh-interval-useless-option-when-updating-document-of-specific-index/276770)
**Author:** [@TheDevLuffy](https://discuss.elastic.co/u/TheDevLuffy)\ **Replies:** 1\ **Last updated:** [June 23, 2021, 9:41pm UTC](https://discuss.elastic.co/t/is-elasticsearch-refresh-interval-useless-option-when-updating-document-of-specific-index/276770 "2021-06-23T21:41:45Z")
Hello Is Elasticsearch refresh interval useless option when updating document of specific index ? For Example, I have two indices on my Elasticsearch (index-001, index-002) and these indices have default refresh\_inter… --- ## [Elasticsearch](https://discuss.elastic.co/t/elasticsearch/276615)
**Author:** [@Sanchit\_Agrawal](https://discuss.elastic.co/u/Sanchit_Agrawal)\ **Replies:** 1\ **Last updated:** [June 23, 2021, 9:35pm UTC](https://discuss.elastic.co/t/elasticsearch/276615 "2021-06-23T21:35:18Z")
I am new to elasticsearch. Please can you help with my other doubts- I have daily pushed to ES and the request cache is getting cleared automatically for as low as 1 document also. Can I restrict this from getting clea… --- ## [Nodes crashes, problem with leader check](https://discuss.elastic.co/t/nodes-crashes-problem-with-leader-check/276662)
**Author:** [@doc113](https://discuss.elastic.co/u/doc113)\ **Replies:** 1\ **Last updated:** [June 23, 2021, 9:33pm UTC](https://discuss.elastic.co/t/nodes-crashes-problem-with-leader-check/276662 "2021-06-23T21:33:56Z")
Greetings all! Previously, sorry for my English. Having trouble with ES cluster. Sometimes data-nodes crashes (one or more (rarely)). This can be preceded by different events: force-merge, relocating shards, real-time u… --- ## [TLS and cross cluster search](https://discuss.elastic.co/t/tls-and-cross-cluster-search/276804)
**Author:** [@NaiaraSS](https://discuss.elastic.co/u/NaiaraSS)\ **Replies:** 0\ **Last updated:** [June 23, 2021, 2:09pm UTC](https://discuss.elastic.co/t/tls-and-cross-cluster-search/276804 "2021-06-23T14:09:19Z")
Hello!!! Please, i'm using the same certificate in 2 different clusters, which works just fine, but I'm only able to see my cluster 1 on kibana, the cluster 2 is not being available to be seing on kibana to generate das… --- ## [Exact field value match](https://discuss.elastic.co/t/exact-field-value-match/276852)
**Author:** [@Abhishek\_Shinde](https://discuss.elastic.co/u/Abhishek_Shinde)\ **Replies:** 0\ **Last updated:** [June 23, 2021, 9:23pm UTC](https://discuss.elastic.co/t/exact-field-value-match/276852 "2021-06-23T21:23:40Z")
I’m trying to achieve Exact field value match, E.g. “content” : “how are you” : find all the documents which exactly have the value “how are you” inside the entire field “content” What we tried in elasticsearch: { "… --- ## [Notwithin operator](https://discuss.elastic.co/t/notwithin-operator/276849)
**Author:** [@Abhishek\_Shinde](https://discuss.elastic.co/u/Abhishek_Shinde)\ **Replies:** 0\ **Last updated:** [June 23, 2021, 9:14pm UTC](https://discuss.elastic.co/t/notwithin-operator/276849 "2021-06-23T21:14:50Z")
I’m trying to achieve with searches Notwithin operators but no luck with intervals query, • a?e NOTWITHIN (How are yo?): find all the documents not having “a?e” (? can be any character) inside the phrase “How are yo?”… --- ## [Wildcard search](https://discuss.elastic.co/t/wildcard-search/276848)
**Author:** [@Abhishek\_Shinde](https://discuss.elastic.co/u/Abhishek_Shinde)\ **Replies:** 0\ **Last updated:** [June 23, 2021, 9:08pm UTC](https://discuss.elastic.co/t/wildcard-search/276848 "2021-06-23T21:08:10Z")
I’m trying to achieve searches with wildcard characters but no luck with match and intervals query, Alice \* \* \* Bob: find all the documents that have a 5-word phrase starting with “Alice” followed by 3 words and then … --- ## [Why using \`fields\` changes the behavior of default operator?](https://discuss.elastic.co/t/why-using-fields-changes-the-behavior-of-default-operator/276840)
**Author:** [@iLemming](https://discuss.elastic.co/u/iLemming)\ **Replies:** 0\ **Last updated:** [June 23, 2021, 7:12pm UTC](https://discuss.elastic.co/t/why-using-fields-changes-the-behavior-of-default-operator/276840 "2021-06-23T19:12:44Z")
I have encountered a strange thing while trying to use fields: option in a "query\_string" query: Let's assume we have an entity and when using a query such as: "query\_string" : { "default\_operator" : "AND", "qu… --- ## [Write slow on elastic cluster](https://discuss.elastic.co/t/write-slow-on-elastic-cluster/276622)
**Author:** [@Sunil\_Chand](https://discuss.elastic.co/u/Sunil_Chand)\ **Replies:** 11\ **Last updated:** [June 23, 2021, 4:18pm UTC](https://discuss.elastic.co/t/write-slow-on-elastic-cluster/276622 "2021-06-23T16:18:36Z")
Hi All One of clusters has the following specs 8 nodes (8 data and 5 master eligible) each with 15GB heap space running on servers with 32GB of RAM. Elasticsearch version 7.6.2 on linux each node has 8 TB of space a… --- ## [How to modify multiple index names in Elasticsearch](https://discuss.elastic.co/t/how-to-modify-multiple-index-names-in-elasticsearch/276664)
**Author:** [@rknd](https://discuss.elastic.co/u/rknd)\ **Replies:** 5\ **Last updated:** [June 23, 2021, 1:29pm UTC](https://discuss.elastic.co/t/how-to-modify-multiple-index-names-in-elasticsearch/276664 "2021-06-23T13:29:22Z")
I have indices like below, europe\_serbia\_people europe\_germany\_people etc. (I have a lot of indices) I want to change all indices with putting "old" keyword to end of indices. I mean the indices that starts with euro… --- ## [Simple Query (1 cardinality, 19,000 docs) takes ~100k ms to complete](https://discuss.elastic.co/t/simple-query-1-cardinality-19-000-docs-takes-100k-ms-to-complete/276654)
**Author:** [@BenB196](https://discuss.elastic.co/u/BenB196)\ **Replies:** 3\ **Last updated:** [June 23, 2021, 12:58pm UTC](https://discuss.elastic.co/t/simple-query-1-cardinality-19-000-docs-takes-100k-ms-to-complete/276654 "2021-06-23T12:58:35Z")
Hi All, Elasticsearch: 7.13.2 I am wondering if anyone could help provide some input into an issue that I'm seeing. I am using a fairly simple query: Query is executed against filebeat-\* "query": { "bool": { … --- ## [What causes the count function to return an empty result](https://discuss.elastic.co/t/what-causes-the-count-function-to-return-an-empty-result/276613)
**Author:** [@RhodesOfficial](https://discuss.elastic.co/u/RhodesOfficial)\ **Replies:** 9\ **Last updated:** [June 23, 2021, 12:33pm UTC](https://discuss.elastic.co/t/what-causes-the-count-function-to-return-an-empty-result/276613 "2021-06-23T12:33:08Z")
I have a complex query statement（some data were desensitized）, but count (1) returns an empty result. NPE occurs in my code. So what causes this result？ Thank you for answering my question！ --- ## [After reindex, new index has same documents but data size is much less](https://discuss.elastic.co/t/after-reindex-new-index-has-same-documents-but-data-size-is-much-less/276768)
**Author:** [@Rosita\_Andrade](https://discuss.elastic.co/u/Rosita_Andrade)\ **Replies:** 3\ **Last updated:** [June 23, 2021, 12:06pm UTC](https://discuss.elastic.co/t/after-reindex-new-index-has-same-documents-but-data-size-is-much-less/276768 "2021-06-23T12:06:41Z")
Hi, This seems to be a similar case as After reindex, new index has same documents but data size is much less. I used the Reindex API and my new index is significantly smaller in size. I have a feeling, that it might b… --- ## [Multi fields, multi prefixes search](https://discuss.elastic.co/t/multi-fields-multi-prefixes-search/276504)
**Author:** [@janlmpn](https://discuss.elastic.co/u/janlmpn)\ **Replies:** 3\ **Last updated:** [June 23, 2021, 11:49am UTC](https://discuss.elastic.co/t/multi-fields-multi-prefixes-search/276504 "2021-06-23T11:49:01Z")
Hello All, hope someone can enlighten me on this one. Suppose I have the following data: { "index": { "\_index": "courses\_test", "\_id": 1 } } { "Course Name": "Bachelor of Arts in Music", "Job Role": "Theatre & Media Dir… --- ## [Adding Threat Intel fields in Elasticsearch data](https://discuss.elastic.co/t/adding-threat-intel-fields-in-elasticsearch-data/276782)
**Author:** [@Naveen\_Kumar\_Reddy\_S](https://discuss.elastic.co/u/Naveen_Kumar_Reddy_S)\ **Replies:** 0\ **Last updated:** [June 23, 2021, 11:25am UTC](https://discuss.elastic.co/t/adding-threat-intel-fields-in-elasticsearch-data/276782 "2021-06-23T11:25:15Z")
How we can add threat intel data for elastic agent logs before they are entering into the Elasticsearch cluster? I am trying to add some new fields to each log before based on the details present in that logs. Example:… --- ## [Exporting snapshot for security and hot backup](https://discuss.elastic.co/t/exporting-snapshot-for-security-and-hot-backup/276767)
**Author:** [@Bibas](https://discuss.elastic.co/u/Bibas)\ **Replies:** 2\ **Last updated:** [June 23, 2021, 10:14am UTC](https://discuss.elastic.co/t/exporting-snapshot-for-security-and-hot-backup/276767 "2021-06-23T10:14:49Z")
Hello ! I have 2 question : I know that snapshot and restore is the best way to backup an elasticsearch cluster, but since my ES is running inside a docker container which have a named volume, is it possible to back… --- ## [Elasticsearch load through beeline](https://discuss.elastic.co/t/elasticsearch-load-through-beeline/276741)
**Author:** [@praveen2](https://discuss.elastic.co/u/praveen2)\ **Replies:** 0\ **Last updated:** [June 23, 2021, 8:04am UTC](https://discuss.elastic.co/t/elasticsearch-load-through-beeline/276741 "2021-06-23T08:04:54Z")
we see this peculiar issue when loading data through es-hadoop connector es version we use 7.11.2 jars added, we see the same behavior when the jar path is either local or hdfs elasticsearch-hadoop-7.11.2.jar; common… --- ## [Download Error](https://discuss.elastic.co/t/download-error/276643)
**Author:** [@Ashwin\_Patil1](https://discuss.elastic.co/u/Ashwin_Patil1)\ **Replies:** 3\ **Last updated:** [June 23, 2021, 10:20am UTC](https://discuss.elastic.co/t/download-error/276643 "2021-06-23T10:20:30Z")
I am not able to download elasticsearch, But am able to ping www.elastic.co. Please refer the image --- ## [How could I restore snapshot from another elasticsearch server's repository?](https://discuss.elastic.co/t/how-could-i-restore-snapshot-from-another-elasticsearch-servers-repository/276731)
**Author:** [@soohyun](https://discuss.elastic.co/u/soohyun)\ **Replies:** 1\ **Last updated:** [June 23, 2021, 9:50am UTC](https://discuss.elastic.co/t/how-could-i-restore-snapshot-from-another-elasticsearch-servers-repository/276731 "2021-06-23T09:50:00Z")
I have two different Elasticsearch clusters (for example, the name of the server is test-elk-ver6 and test-elk-ver7) which has run on the different server. I want to migrate the data from test-elk-ver6 to test-elk-ver7,… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=620) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=622)