# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=625 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 626 --- ## [Es7.x querystring can't boost NOT query](https://discuss.elastic.co/t/es7-x-querystring-cant-boost-not-query/275653)
**Author:** [@laigood](https://discuss.elastic.co/u/laigood)\ **Replies:** 2\ **Last updated:** [June 18, 2021, 7:45am UTC](https://discuss.elastic.co/t/es7-x-querystring-cant-boost-not-query/275653 "2021-06-18T07:45:28Z")
I found that from es7.0,querystring query can't boost NOT query,like below code,the result score is 0,not 100 as expect.I alse check in es5.x and es6.x it work as expect.someone know why? PUT test/\_doc/1 { "test": "1"… --- ## [Cannot make this work](https://discuss.elastic.co/t/cannot-make-this-work/276090)
**Author:** [@Peque](https://discuss.elastic.co/u/Peque)\ **Replies:** 4\ **Last updated:** [June 18, 2021, 5:13am UTC](https://discuss.elastic.co/t/cannot-make-this-work/276090 "2021-06-18T05:13:28Z")
Hi Group I struggling like H\*\*\* t omake this work I have created an ELK server on Ubuntu 20.04LTS - and would like to monitor both Normal Linux/Windows Server - and allso our PFsense Routers. I'm using the PFELK --\> G… --- ## [Elasticsearch build-in user changed password](https://discuss.elastic.co/t/elasticsearch-build-in-user-changed-password/276330)
**Author:** [@drewkrrb](https://discuss.elastic.co/u/drewkrrb)\ **Replies:** 5\ **Last updated:** [June 18, 2021, 3:44am UTC](https://discuss.elastic.co/t/elasticsearch-build-in-user-changed-password/276330 "2021-06-18T03:44:53Z")
Hi all Our Elasticsearch environment is deployed on our kubernetes platform using the official helm chart. We only have 2 elasticsearch pods. We are using xpack.security.enabled: true and setup the password for elastic… --- ## [Automate applying a pipeline to documents](https://discuss.elastic.co/t/automate-applying-a-pipeline-to-documents/276059)
**Author:** [@Spricer](https://discuss.elastic.co/u/Spricer)\ **Replies:** 7\ **Last updated:** [June 17, 2021, 2:41pm UTC](https://discuss.elastic.co/t/automate-applying-a-pipeline-to-documents/276059 "2021-06-17T14:41:25Z")
I created "mypipeline" pipeline with grok processor. I have syslog-ng-(xx) indexes created daily. If I apply in console: POST syslog-ng\*/\_update\_by\_query?pipeline=mypipeline I can see all my indexes get updated and s… --- ## [How to sort fields used as terms?](https://discuss.elastic.co/t/how-to-sort-fields-used-as-terms/276325)
**Author:** [@Lucas\_Boswell](https://discuss.elastic.co/u/Lucas_Boswell)\ **Replies:** 0\ **Last updated:** [June 17, 2021, 11:42pm UTC](https://discuss.elastic.co/t/how-to-sort-fields-used-as-terms/276325 "2021-06-17T23:42:53Z")
Hello there, I am attempting to understand the sorting/bucket\_sort functionality a bit better. Below is a simple query that groups by a productId, gathers some additional info related to productId, and then calculates a… --- ## [Workaround for search query issue with Lucene multiple OR](https://discuss.elastic.co/t/workaround-for-search-query-issue-with-lucene-multiple-or/276323)
**Author:** [@zkirill](https://discuss.elastic.co/u/zkirill)\ **Replies:** 0\ **Last updated:** [June 17, 2021, 11:24pm UTC](https://discuss.elastic.co/t/workaround-for-search-query-issue-with-lucene-multiple-or/276323 "2021-06-17T23:24:07Z")
In reference to the original post by @sikeeoh (Search Query with Lucene Query issue) We were able to find a workaround. I'm not sure if it accomplishes the same result but it seems to be working. "ten" OR ("teen" OR ("… --- ## [termsQuery no longer uses XContentWriters](https://discuss.elastic.co/t/termsquery-no-longer-uses-xcontentwriters/276316)
**Author:** [@Lars\_Benedetto](https://discuss.elastic.co/u/Lars_Benedetto)\ **Replies:** 0\ **Last updated:** [June 17, 2021, 9:15pm UTC](https://discuss.elastic.co/t/termsquery-no-longer-uses-xcontentwriters/276316 "2021-06-17T21:15:39Z")
Between 7.9.3 and 7.12.1 it seems the way that arguments to termsQuery() are serialized have changed. In 7.9.3 it used my XContentBuilderExtension to convert my classes to strings that could be understood by elasticsearc… --- ## [Elastic solution on multiple vlan network](https://discuss.elastic.co/t/elastic-solution-on-multiple-vlan-network/276283)
**Author:** [@Polo](https://discuss.elastic.co/u/Polo)\ **Replies:** 0\ **Last updated:** [June 17, 2021, 3:05pm UTC](https://discuss.elastic.co/t/elastic-solution-on-multiple-vlan-network/276283 "2021-06-17T15:05:22Z")
Hi all, i would like to deploy elastic solution, search, beats... in a network with multiple vlan. My network is a aggregation of many customer newtwork, each on different vlan and only accessible via dedicated "jump ho… --- ## [Entities architecture with custom fields and Upsert script issue](https://discuss.elastic.co/t/entities-architecture-with-custom-fields-and-upsert-script-issue/276267)
**Author:** [@Spyros\_Giannopoulos](https://discuss.elastic.co/u/Spyros_Giannopoulos)\ **Replies:** 1\ **Last updated:** [June 17, 2021, 2:08pm UTC](https://discuss.elastic.co/t/entities-architecture-with-custom-fields-and-upsert-script-issue/276267 "2021-06-17T14:08:15Z")
Hello, I'm building an application in ES that needs to contain information about lists of members. The members in a list have a name, surname, etc.. but also contain some custom fields which are different for each list.… --- ## [Index Date Math with seconds](https://discuss.elastic.co/t/index-date-math-with-seconds/276161)
**Author:** [@dimitris\_sb](https://discuss.elastic.co/u/dimitris_sb)\ **Replies:** 4\ **Last updated:** [June 17, 2021, 12:48pm UTC](https://discuss.elastic.co/t/index-date-math-with-seconds/276161 "2021-06-17T12:48:59Z")
Hi All, When I try to create an index using date math expression PUT /%3Cdata-index-%7Bnow%2Fm%7Byyyy-MM-dd-HH-mm-ss%7D%7D%3E which produces an index as data-index-2021-06-16-12-41-00 Why seconds are always 00 (if yo… --- ## [How to Query the data between 2 different timestamp](https://discuss.elastic.co/t/how-to-query-the-data-between-2-different-timestamp/276150)
**Author:** [@Kannan\_V](https://discuss.elastic.co/u/Kannan_V)\ **Replies:** 2\ **Last updated:** [June 17, 2021, 11:40am UTC](https://discuss.elastic.co/t/how-to-query-the-data-between-2-different-timestamp/276150 "2021-06-17T11:40:49Z")
Hi, How to query the data between 2 different timestamps? We have a data. I am able to query through Kibana Discover tab. But i am not able to query through devTools or Curl command. Following is my devtool command G… --- ## [Adding a new node to a cluster with passwords already set](https://discuss.elastic.co/t/adding-a-new-node-to-a-cluster-with-passwords-already-set/276237)
**Author:** [@Timm\_Lehmberg](https://discuss.elastic.co/u/Timm_Lehmberg)\ **Replies:** 1\ **Last updated:** [June 17, 2021, 10:55am UTC](https://discuss.elastic.co/t/adding-a-new-node-to-a-cluster-with-passwords-already-set/276237 "2021-06-17T10:55:56Z")
Apologies if my approach in the described in the following is stupid. set up elasticsearch 7.13 on node-1 as a single node cluster, enabled TLS and ran bin/elasticsearch-setup-passwords interactive set up elasticsear… --- ## [Transform API](https://discuss.elastic.co/t/transform-api/276256)
**Author:** [@Iliya\_Zukerman](https://discuss.elastic.co/u/Iliya_Zukerman)\ **Replies:** 0\ **Last updated:** [June 17, 2021, 10:54am UTC](https://discuss.elastic.co/t/transform-api/276256 "2021-06-17T10:54:01Z")
hI I am able to create Transform but after it has been created and started there is no corresponding IndexPattern so I can't see it in Kiban when I create the same transform from UI the indexpattern is created automatic… --- ## [Network in bout traffic rollup](https://discuss.elastic.co/t/network-in-bout-traffic-rollup/276244)
**Author:** [@ghaithTK](https://discuss.elastic.co/u/ghaithTK)\ **Replies:** 0\ **Last updated:** [June 17, 2021, 9:36am UTC](https://discuss.elastic.co/t/network-in-bout-traffic-rollup/276244 "2021-06-17T09:36:56Z")
Hi I am trying to rollup (daily) network inbound traffic using field system.network.in.bytes. but when i use inbound visualization with rollup index i got this(image) what the problem and is there another way to ro… --- ## [How to use cutom geoip database in cloud elastic?](https://discuss.elastic.co/t/how-to-use-cutom-geoip-database-in-cloud-elastic/276249)
**Author:** [@tonik](https://discuss.elastic.co/u/tonik)\ **Replies:** 0\ **Last updated:** [June 17, 2021, 10:13am UTC](https://discuss.elastic.co/t/how-to-use-cutom-geoip-database-in-cloud-elastic/276249 "2021-06-17T10:13:34Z")
Hi. I'm trying to convert ipv4 into geo location and I want to change database, coz it's setting incorrect location now. I cannot understand how to use/upload custom geoip database in cloud elastic cluster. Because docu… --- ## [Missing logs](https://discuss.elastic.co/t/missing-logs/276234)
**Author:** [@Shaked](https://discuss.elastic.co/u/Shaked)\ **Replies:** 6\ **Last updated:** [June 17, 2021, 9:50am UTC](https://discuss.elastic.co/t/missing-logs/276234 "2021-06-17T09:50:54Z")
Hi everyone, I would be happy to get your help with a critical issue we have. We run AWS ElasticSearch service (v7.10) with Logstash as a Docker container on ECS Fargate. All of our environments are running the servic… --- ## [Best practices for fine tuning performance when it comes to Elasticsearch, Logstash and Kibana?](https://discuss.elastic.co/t/best-practices-for-fine-tuning-performance-when-it-comes-to-elasticsearch-logstash-and-kibana/273913)
**Author:** [@riahc3](https://discuss.elastic.co/u/riahc3)\ **Replies:** 21\ **Last updated:** [June 17, 2021, 8:22am UTC](https://discuss.elastic.co/t/best-practices-for-fine-tuning-performance-when-it-comes-to-elasticsearch-logstash-and-kibana/273913 "2021-06-17T08:22:01Z")
Hello We have a Elastic Stack setup. Our basic architecture is based on this: Beats/source/etc -\> Logstash -\> Elasticsearch. Meaning, all incoming data always passes thru Logstash first. We have created various Logst… --- ## [Configuration for master node in YAML](https://discuss.elastic.co/t/configuration-for-master-node-in-yaml/275975)
**Author:** [@krish0608](https://discuss.elastic.co/u/krish0608)\ **Replies:** 5\ **Last updated:** [June 17, 2021, 8:15am UTC](https://discuss.elastic.co/t/configuration-for-master-node-in-yaml/275975 "2021-06-17T08:15:45Z")
Hi Team, I have configured big cluster in my production env. just wanted to confirm do we need to allocate half of memory in master node also. Suppose i have 16G node and do i need to allocate 8G in jvm options file wha… --- ## [.async\_search Index Problem](https://discuss.elastic.co/t/async-search-index-problem/275628)
**Author:** [@Anabella\_Cristaldi](https://discuss.elastic.co/u/Anabella_Cristaldi)\ **Replies:** 1\ **Last updated:** [June 17, 2021, 8:15am UTC](https://discuss.elastic.co/t/async-search-index-problem/275628 "2021-06-17T08:15:23Z")
Hi, Today we had a big crash in our Netapp cabinet and our elastic cluster went down After starting up all our indices appeared to be ok with the exception of this internal's elasticsearch index .async-search which is … --- ## [Optimizing shard placement for indexing](https://discuss.elastic.co/t/optimizing-shard-placement-for-indexing/276227)
**Author:** [@Timur\_Makarchuk](https://discuss.elastic.co/u/Timur_Makarchuk)\ **Replies:** 0\ **Last updated:** [June 17, 2021, 7:49am UTC](https://discuss.elastic.co/t/optimizing-shard-placement-for-indexing/276227 "2021-06-17T07:49:20Z")
Good day, everyone! I'm currently working on a tool that would spread indices in our cluster to spread indexing load more optimally, as inspired by this article (Optimal Shard Placement in a Petabyte Scale Elasticsearch… --- ## [Is field type "wildcard" supported in elasticsearch-spark?](https://discuss.elastic.co/t/is-field-type-wildcard-supported-in-elasticsearch-spark/275983)
**Author:** [@jrxs](https://discuss.elastic.co/u/jrxs)\ **Replies:** 1\ **Last updated:** [June 17, 2021, 7:41am UTC](https://discuss.elastic.co/t/is-field-type-wildcard-supported-in-elasticsearch-spark/275983 "2021-06-17T07:41:09Z")
Hi, I am currently doing some tests to see if I can use Apache Spark and the elasticsearch-spark (elasticsearch-hadoop) to analyse data that I have in elasticsearch. I am testing using the following versions in a docke… --- ## [No cached mapping for important monitoring fields](https://discuss.elastic.co/t/no-cached-mapping-for-important-monitoring-fields/276225)
**Author:** [@kodka](https://discuss.elastic.co/u/kodka)\ **Replies:** 0\ **Last updated:** [June 17, 2021, 7:28am UTC](https://discuss.elastic.co/t/no-cached-mapping-for-important-monitoring-fields/276225 "2021-06-17T07:28:33Z")
(I tried to refresh cached mapping in the index pattern page, it didn't help.) I have two clusters with very similar architecture, one of them have this problem, but the other one is fine, differences between them are t… --- ## [Problem in connecting to Elasticsearch using Python script](https://discuss.elastic.co/t/problem-in-connecting-to-elasticsearch-using-python-script/276130)
**Author:** [@ravi-shanker](https://discuss.elastic.co/u/ravi-shanker)\ **Replies:** 4\ **Last updated:** [June 17, 2021, 6:17am UTC](https://discuss.elastic.co/t/problem-in-connecting-to-elasticsearch-using-python-script/276130 "2021-06-17T06:17:42Z")
Hello All, I have a 3 node elastic cluster setup on EC2. I am trying to connect to my cluster and index some sample data using python script. Below is my python script: - from elasticsearch import Elasticsearch es=Ela… --- ## [Elasticsearch 7.13 2 nodes cluster](https://discuss.elastic.co/t/elasticsearch-7-13-2-nodes-cluster/276079)
**Author:** [@Dilip\_Kumar](https://discuss.elastic.co/u/Dilip_Kumar)\ **Replies:** 6\ **Last updated:** [June 17, 2021, 5:29am UTC](https://discuss.elastic.co/t/elasticsearch-7-13-2-nodes-cluster/276079 "2021-06-17T05:29:37Z")
Hi I have two nodes(xnode1, xnode2) cluster on elasticsearch 7.13. I made cluster succesfully, it showing 2 nodes in cluster. For testing i stop xnode2, it showing 1 node cluster. but when stop xnode1 , then try curl w… --- ## [Wrong fields are comimg](https://discuss.elastic.co/t/wrong-fields-are-comimg/276136)
**Author:** [@stark](https://discuss.elastic.co/u/stark)\ **Replies:** 4\ **Last updated:** [June 17, 2021, 4:50am UTC](https://discuss.elastic.co/t/wrong-fields-are-comimg/276136 "2021-06-17T04:50:18Z")
boosting terms have higher precedence than keyword i search for eg if i search keyword 'index" top fields contain this word in description and lower fields contain keyword in title but i boost title field why this issue … --- ## [Search both parent and child , but not duplicate result of chil](https://discuss.elastic.co/t/search-both-parent-and-child-but-not-duplicate-result-of-chil/276214)
**Author:** [@DuyNguyen](https://discuss.elastic.co/u/DuyNguyen)\ **Replies:** 0\ **Last updated:** [June 17, 2021, 4:11am UTC](https://discuss.elastic.co/t/search-both-parent-and-child-but-not-duplicate-result-of-chil/276214 "2021-06-17T04:11:05Z")
Hi everyone, I'm new with ELK and developing social app. I using ELK to query post and comment all of group social. Desired result: If match text of post just show post. If match text of comment show that comment an… --- ## [Master not discovered yet, this node has not previously joined a bootstrapped (v7+) cluster version 7.13.2](https://discuss.elastic.co/t/master-not-discovered-yet-this-node-has-not-previously-joined-a-bootstrapped-v7-cluster-version-7-13-2/276211)
**Author:** [@Senshuken\_GG](https://discuss.elastic.co/u/Senshuken_GG)\ **Replies:** 0\ **Last updated:** [June 17, 2021, 3:00am UTC](https://discuss.elastic.co/t/master-not-discovered-yet-this-node-has-not-previously-joined-a-bootstrapped-v7-cluster-version-7-13-2/276211 "2021-06-17T03:00:49Z")
Node 1 172.24.10.103 Node 1 172.24.10.101 Description: 1.Elasticsearch version 7.13 Elasticsearch cluster 2 Node issue is master\_not\_discovered\_exception Node 1 Config elasticsearch.yml cluster.name: POWER-CLUS… --- ## [Elasticsearch ILM Deleting an index is just a logical drop, but the index can still be used. Will it eventually be physically deleted](https://discuss.elastic.co/t/elasticsearch-ilm-deleting-an-index-is-just-a-logical-drop-but-the-index-can-still-be-used-will-it-eventually-be-physically-deleted/276071)
**Author:** [@liuliugang](https://discuss.elastic.co/u/liuliugang)\ **Replies:** 16\ **Last updated:** [June 17, 2021, 3:16am UTC](https://discuss.elastic.co/t/elasticsearch-ilm-deleting-an-index-is-just-a-logical-drop-but-the-index-can-still-be-used-will-it-eventually-be-physically-deleted/276071 "2021-06-17T03:16:23Z")
View index lifecycle management in Kibana The current phase is Delete and the current action is Complete thanks --- ## [High CPU usage because lucene merge thread](https://discuss.elastic.co/t/high-cpu-usage-because-lucene-merge-thread/276209)
**Author:** [@yeziblo](https://discuss.elastic.co/u/yeziblo)\ **Replies:** 5\ **Last updated:** [June 17, 2021, 3:01am UTC](https://discuss.elastic.co/t/high-cpu-usage-because-lucene-merge-thread/276209 "2021-06-17T03:01:36Z")
My operation process is as follows: At 3 am everyday, program try to index data to ES, that usually takes 3 hours. During the indexing process, I will set the number\_of\_replicas parameter to 0, and when data indexing is… --- ## [Enabling http & https connections to elastic](https://discuss.elastic.co/t/enabling-http-https-connections-to-elastic/276141)
**Author:** [@jdswifty](https://discuss.elastic.co/u/jdswifty)\ **Replies:** 2\ **Last updated:** [June 17, 2021, 1:17am UTC](https://discuss.elastic.co/t/enabling-http-https-connections-to-elastic/276141 "2021-06-17T01:17:36Z")
Running Elasticsearch 7.11 & getting towards the end of a piece of work to enable TLS across the platform I'm now at the point i need to enable tls on the http connections for the ingest nodes but I need to be able to s… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=624) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=626)