# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=631 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 632 --- ## [How to set default value while using env in elasticsearch.yml config file?](https://discuss.elastic.co/t/how-to-set-default-value-while-using-env-in-elasticsearch-yml-config-file/275440)
**Author:** [@kamolhasan](https://discuss.elastic.co/u/kamolhasan)\ **Replies:** 0\ **Last updated:** [June 9, 2021, 1:12pm UTC](https://discuss.elastic.co/t/how-to-set-default-value-while-using-env-in-elasticsearch-yml-config-file/275440 "2021-06-09T13:12:31Z")
I'm using environment variable in config file (ie. elasticsearch.yml) to configure node roles. For example: elasticsearch.yml: node.roles: '${NODE\_ROLES}' When, I set NODE\_ROLES="master", NODE\_ROLES="ml, remote\_clus… --- ## [Rally dump existing cluster data while 429 occur](https://discuss.elastic.co/t/rally-dump-existing-cluster-data-while-429-occur/275385)
**Author:** [@JohnPhilip](https://discuss.elastic.co/u/JohnPhilip)\ **Replies:** 4\ **Last updated:** [June 9, 2021, 1:06pm UTC](https://discuss.elastic.co/t/rally-dump-existing-cluster-data-while-429-occur/275385 "2021-06-09T13:06:54Z")
when I try to create a track from data in an existing cluster, I found that error occurred like following Extracting documents for index \[compress\_ratio\_ac... 1650000/50000001 docs \[3.3% done\]\[ERROR\] Cannot create-t… --- ## [Is there are max number of operators in a query?](https://discuss.elastic.co/t/is-there-are-max-number-of-operators-in-a-query/275291)
**Author:** [@Sandra\_Schlichting](https://discuss.elastic.co/u/Sandra_Schlichting)\ **Replies:** 1\ **Last updated:** [June 9, 2021, 12:27pm UTC](https://discuss.elastic.co/t/is-there-are-max-number-of-operators-in-a-query/275291 "2021-06-09T12:27:53Z")
Dear all =) Ideally would I like to make a search query that contains approx 100 OR operators and 1 AND NOT like so (logLevel:error OR logLevel:fatal) AND NOT (searchString1 OR searchString2 OR searchString3 OR ... O… --- ## [How to index custom json with C# object using NEST](https://discuss.elastic.co/t/how-to-index-custom-json-with-c-object-using-nest/275431)
**Author:** [@Lilan\_Silva](https://discuss.elastic.co/u/Lilan_Silva)\ **Replies:** 0\ **Last updated:** [June 9, 2021, 11:56am UTC](https://discuss.elastic.co/t/how-to-index-custom-json-with-c-object-using-nest/275431 "2021-06-09T11:56:55Z")
I am new to elastic search and we need to migrate from mongodb to elastic. we used public class Book { \[BsonId\] public string Id { get; set; } public string ApplicationId { get; set; } … --- ## [Get value from ctx.payload.results](https://discuss.elastic.co/t/get-value-from-ctx-payload-results/275423)
**Author:** [@A\_Mightiev](https://discuss.elastic.co/u/A_Mightiev)\ **Replies:** 1\ **Last updated:** [June 9, 2021, 11:32am UTC](https://discuss.elastic.co/t/get-value-from-ctx-payload-results/275423 "2021-06-09T11:32:25Z")
I'm trying to extract the results from the payload to display in a message for a watcher The value is in "payload": { "results": \[ { "value": 1644, "key": "foo" … --- ## [How many Filebeat containers can connect to an ES node?](https://discuss.elastic.co/t/how-many-filebeat-containers-can-connect-to-an-es-node/275323)
**Author:** [@valhalla](https://discuss.elastic.co/u/valhalla)\ **Replies:** 4\ **Last updated:** [June 9, 2021, 10:56am UTC](https://discuss.elastic.co/t/how-many-filebeat-containers-can-connect-to-an-es-node/275323 "2021-06-09T10:56:31Z")
Hello, Would like to know if there is a limitation on the number of different filebeat containers that can save data into one ES node? Which is the actual Filebeat number that one can have in order to ship data to ES? … --- ## [JVM heap recommandation](https://discuss.elastic.co/t/jvm-heap-recommandation/275416)
**Author:** [@rebug](https://discuss.elastic.co/u/rebug)\ **Replies:** 2\ **Last updated:** [June 9, 2021, 10:07am UTC](https://discuss.elastic.co/t/jvm-heap-recommandation/275416 "2021-06-09T10:07:30Z")
Hi, I would like to know what is you recommendation for the JVM heap size of a elastic node ? I run the elastic stack on docker, I will have approximatively 200 indices (200 shards) of 25gb. --- ## [Reindexing was in progress on master node but after rebooting cluster it is halted](https://discuss.elastic.co/t/reindexing-was-in-progress-on-master-node-but-after-rebooting-cluster-it-is-halted/275413)
**Author:** [@krish0608](https://discuss.elastic.co/u/krish0608)\ **Replies:** 2\ **Last updated:** [June 9, 2021, 10:01am UTC](https://discuss.elastic.co/t/reindexing-was-in-progress-on-master-node-but-after-rebooting-cluster-it-is-halted/275413 "2021-06-09T10:01:12Z")
Reindexing was in progress on master node but after rebooting cluster it is halted. We have 3 master nodes and multiple data nodes and we have rebooted all one by one. Everything is up and running but reindexing is not … --- ## [Multi field search criteria results to include all input or either words](https://discuss.elastic.co/t/multi-field-search-criteria-results-to-include-all-input-or-either-words/275408)
**Author:** [@Mithoon](https://discuss.elastic.co/u/Mithoon)\ **Replies:** 0\ **Last updated:** [June 9, 2021, 8:58am UTC](https://discuss.elastic.co/t/multi-field-search-criteria-results-to-include-all-input-or-either-words/275408 "2021-06-09T08:58:48Z")
Currently using Elastic Search for inventory search feature implementation and trying to build query logic. Search requirements: User shall be able to search for words in ProductName, BrandName and description fields … --- ## [Rally offline with my own tracks](https://discuss.elastic.co/t/rally-offline-with-my-own-tracks/275252)
**Author:** [@Lasse\_Nedergaard](https://discuss.elastic.co/u/Lasse_Nedergaard)\ **Replies:** 4\ **Last updated:** [June 9, 2021, 8:53am UTC](https://discuss.elastic.co/t/rally-offline-with-my-own-tracks/275252 "2021-06-09T08:53:05Z")
Hi I want to test our internal cluster and don’t have internet access and running on windows is it possible to use the rally container instead off offline install package as it’s for Linux/Mac and change rally.ini to po… --- ## [Hi, I want to ask a thing in Elasticsearch. If I want to ignore a document based on a certain field value, how can I do that in the flatmap function of javascript](https://discuss.elastic.co/t/hi-i-want-to-ask-a-thing-in-elasticsearch-if-i-want-to-ignore-a-document-based-on-a-certain-field-value-how-can-i-do-that-in-the-flatmap-function-of-javascript/275401)
**Author:** [@appydam](https://discuss.elastic.co/u/appydam)\ **Replies:** 0\ **Last updated:** [June 9, 2021, 8:43am UTC](https://discuss.elastic.co/t/hi-i-want-to-ask-a-thing-in-elasticsearch-if-i-want-to-ignore-a-document-based-on-a-certain-field-value-how-can-i-do-that-in-the-flatmap-function-of-javascript/275401 "2021-06-09T08:43:47Z")
Hi, I want to ask a thing in Elasticsearch. If I want to ignore a document based on a certain field value, how can I do that in the flatmap function of javascript const body = datajson.flatMap((doc: Resource) =\> \[ … --- ## [How searching over multiple indices using alias work internally, is it faster that having one index having all the documents](https://discuss.elastic.co/t/how-searching-over-multiple-indices-using-alias-work-internally-is-it-faster-that-having-one-index-having-all-the-documents/275372)
**Author:** [@code\_merchant](https://discuss.elastic.co/u/code_merchant)\ **Replies:** 1\ **Last updated:** [June 9, 2021, 7:56am UTC](https://discuss.elastic.co/t/how-searching-over-multiple-indices-using-alias-work-internally-is-it-faster-that-having-one-index-having-all-the-documents/275372 "2021-06-09T07:56:37Z")
I have 2 clusters. Cluster A: have 1 big index storing 500 GB of data Cluster B: have monthly indices of 30GB for 15 months There is a search query which search over a single index in cluster A and over read-alias \[im… --- ## [Document and field level security not supported in trial license](https://discuss.elastic.co/t/document-and-field-level-security-not-supported-in-trial-license/275248)
**Author:** [@boskjoett](https://discuss.elastic.co/u/boskjoett)\ **Replies:** 7\ **Last updated:** [June 9, 2021, 6:58am UTC](https://discuss.elastic.co/t/document-and-field-level-security-not-supported-in-trial-license/275248 "2021-06-09T06:58:57Z")
I have just made a trial installation of the Elastic Cloud to test out document level security. But when I configure document level security via the Elasticsearch API I get an error message saying that "Document and fiel… --- ## [ILM action status - Waiting for all shard copies to be active](https://discuss.elastic.co/t/ilm-action-status-waiting-for-all-shard-copies-to-be-active/274209)
**Author:** [@braham](https://discuss.elastic.co/u/braham)\ **Replies:** 8\ **Last updated:** [June 9, 2021, 5:27am UTC](https://discuss.elastic.co/t/ilm-action-status-waiting-for-all-shard-copies-to-be-active/274209 "2021-06-09T05:27:19Z")
Hello, We have configured ILM policy but it's changing the phase "hot" to "warm" but after that not changing further phases like "cold" and "delete". We see action status "Waiting for all shard copies to be active". I… --- ## [How to give cluster IP in fluentd/kibana for 3 node Elasticsearch cluster](https://discuss.elastic.co/t/how-to-give-cluster-ip-in-fluentd-kibana-for-3-node-elasticsearch-cluster/275289)
**Author:** [@khgupta3](https://discuss.elastic.co/u/khgupta3)\ **Replies:** 5\ **Last updated:** [June 9, 2021, 5:13am UTC](https://discuss.elastic.co/t/how-to-give-cluster-ip-in-fluentd-kibana-for-3-node-elasticsearch-cluster/275289 "2021-06-09T05:13:13Z")
Hi All, I have 3 node cluster (3 VM with different IPs) . After going thru some documentations and other community questions, I read that in small cluster like if 3, to have redundancy it is good to make all Master as w… --- ## [Behaviour of searchable snapshot](https://discuss.elastic.co/t/behaviour-of-searchable-snapshot/275364)
**Author:** [@pk.241011](https://discuss.elastic.co/u/pk.241011)\ **Replies:** 0\ **Last updated:** [June 9, 2021, 3:25am UTC](https://discuss.elastic.co/t/behaviour-of-searchable-snapshot/275364 "2021-06-09T03:25:21Z")
Hi, I configured a index lifecycle policy. And at the end of the hot phase I configured a Searchable snapshot backed on a repository hosted on our S3 bucket. I have chosen the convert to fully mounted index option. T… --- ## [Losing logs in ELK](https://discuss.elastic.co/t/losing-logs-in-elk/275356)
**Author:** [@devopscanada](https://discuss.elastic.co/u/devopscanada)\ **Replies:** 2\ **Last updated:** [June 9, 2021, 2:08am UTC](https://discuss.elastic.co/t/losing-logs-in-elk/275356 "2021-06-09T02:08:24Z")
Setup: Kubernetes cluster with filebeat-7.12.0 -\> logstash-7.9. -\> elasticsearch-7.9.1 -\> kibana-7.9.1 Problem: we lose many logs often and sometimes in a massive way, as in we stop seeing logs from one or more pods… --- ## [Auto Delete old indices based on size (on hitting the low watermark setting)](https://discuss.elastic.co/t/auto-delete-old-indices-based-on-size-on-hitting-the-low-watermark-setting/275353)
**Author:** [@rakeshr](https://discuss.elastic.co/u/rakeshr)\ **Replies:** 2\ **Last updated:** [June 9, 2021, 2:04am UTC](https://discuss.elastic.co/t/auto-delete-old-indices-based-on-size-on-hitting-the-low-watermark-setting/275353 "2021-06-09T02:04:46Z")
Hi, Is there any setting which would auto Delete old indices on hitting the lower watermark setting? I could not find much information from the documentation regarding such a setting. If not, how can this be done ? --- ## [Is moving kibana indices to hot node ok?](https://discuss.elastic.co/t/is-moving-kibana-indices-to-hot-node-ok/275305)
**Author:** [@roh](https://discuss.elastic.co/u/roh)\ **Replies:** 1\ **Last updated:** [June 9, 2021, 12:31am UTC](https://discuss.elastic.co/t/is-moving-kibana-indices-to-hot-node-ok/275305 "2021-06-09T00:31:09Z")
Hi all My team is using hot to cold tier architecture for recent projects. There was an interesting opinion about kibana internal system indices. One of my teammates thought that if kibana indices are moved to cold tie… --- ## [Search documents by unmapped fields for debugging](https://discuss.elastic.co/t/search-documents-by-unmapped-fields-for-debugging/275055)
**Author:** [@Metheny](https://discuss.elastic.co/u/Metheny)\ **Replies:** 3\ **Last updated:** [June 8, 2021, 10:07pm UTC](https://discuss.elastic.co/t/search-documents-by-unmapped-fields-for-debugging/275055 "2021-06-08T22:07:29Z")
We are using fixed (non dynamic) mapping in our indices in order to improve performance. The mapping contains a subset of our document fields, and the rest of the fields are unmapped. However, for debugging purposes we… --- ## [Non destructive way of clearing all indices](https://discuss.elastic.co/t/non-destructive-way-of-clearing-all-indices/275256)
**Author:** [@eeijlar](https://discuss.elastic.co/u/eeijlar)\ **Replies:** 1\ **Last updated:** [June 8, 2021, 8:10pm UTC](https://discuss.elastic.co/t/non-destructive-way-of-clearing-all-indices/275256 "2021-06-08T20:10:52Z")
I have been using: curl -X DELETE "https://localhost:9200/\_all to delete all indices. I am doing this in a kubernetes ECK environment. It seems to break things though and kibana pod gets into trouble. Am I right in say… --- ## [Cannot link my title to permalink after adding result view](https://discuss.elastic.co/t/cannot-link-my-title-to-permalink-after-adding-result-view/275346)
**Author:** [@Sanjida](https://discuss.elastic.co/u/Sanjida)\ **Replies:** 0\ **Last updated:** [June 8, 2021, 8:09pm UTC](https://discuss.elastic.co/t/cannot-link-my-title-to-permalink-after-adding-result-view/275346 "2021-06-08T20:09:50Z")
I am new at react.js and elastic search. I am trying to custom the UI of reference UI. But after adding the resultview in Results according to the video games tutorial the hyperlink added to the title disappears. I want … --- ## [Query configuration returns to many hits](https://discuss.elastic.co/t/query-configuration-returns-to-many-hits/275325)
**Author:** [@Rammi22](https://discuss.elastic.co/u/Rammi22)\ **Replies:** 0\ **Last updated:** [June 8, 2021, 4:53pm UTC](https://discuss.elastic.co/t/query-configuration-returns-to-many-hits/275325 "2021-06-08T16:53:30Z")
Hi, i have 1000 index-documents with following structure: // #1 { "\_index": "my\_index\_2008", "\_type": "\_doc", "\_version": 1, "\_seq\_no": 1, "\_primary\_term": 1, "found": true, "\_source": { "meta": { ... }, … --- ## [How to clean up curator messages about system indices being queried](https://discuss.elastic.co/t/how-to-clean-up-curator-messages-about-system-indices-being-queried/275233)
**Author:** [@cknz](https://discuss.elastic.co/u/cknz)\ **Replies:** 1\ **Last updated:** [June 8, 2021, 2:04pm UTC](https://discuss.elastic.co/t/how-to-clean-up-curator-messages-about-system-indices-being-queried/275233 "2021-06-08T14:04:02Z")
I'm using curator to manage my indices currently. I'm suffering from cron spam due to the following: /usr/local/lib/curator/venv/lib64/python3.8/site-packages/elasticsearch/connection/base.py:200: ElasticsearchWarning:… --- ## [Force token filter to output just one token](https://discuss.elastic.co/t/force-token-filter-to-output-just-one-token/275304)
**Author:** [@grad1](https://discuss.elastic.co/u/grad1)\ **Replies:** 0\ **Last updated:** [June 8, 2021, 1:17pm UTC](https://discuss.elastic.co/t/force-token-filter-to-output-just-one-token/275304 "2021-06-08T13:17:01Z")
Hi, I am working on the devlopment of the search solution based on Elasticsearch for Polish language. Initially, I used the recommended analysis-stempel plugin to stem Polish words but after some experiments I found it … --- ## [Extra fields created for event](https://discuss.elastic.co/t/extra-fields-created-for-event/275295)
**Author:** [@gyterpena](https://discuss.elastic.co/u/gyterpena)\ **Replies:** 0\ **Last updated:** [June 8, 2021, 12:18pm UTC](https://discuss.elastic.co/t/extra-fields-created-for-event/275295 "2021-06-08T12:18:50Z")
Hello We have this strange situation where logs that have certain fields like source.ip,source.port etc(see attached) get extra fields created eg. event.module:iis OR nginx will show fields named suricata.eve.dest\_ip … --- ## [All indices with yellow status have at least 1 unassigned shard whereas greens have zero, is my analysis correct?](https://discuss.elastic.co/t/all-indices-with-yellow-status-have-at-least-1-unassigned-shard-whereas-greens-have-zero-is-my-analysis-correct/275267)
**Author:** [@devashishsingh](https://discuss.elastic.co/u/devashishsingh)\ **Replies:** 1\ **Last updated:** [June 8, 2021, 12:03pm UTC](https://discuss.elastic.co/t/all-indices-with-yellow-status-have-at-least-1-unassigned-shard-whereas-greens-have-zero-is-my-analysis-correct/275267 "2021-06-08T12:03:43Z")
Hi there! Since all with Yellow status are having trouble processing the data, I have noticed that all indices with yellow status have at least 1 shard unassigned. How can we fix this allocation? Thank you … --- ## [How to convert the output into json in watcher body](https://discuss.elastic.co/t/how-to-convert-the-output-into-json-in-watcher-body/275293)
**Author:** [@Mojahid\_Ahmad](https://discuss.elastic.co/u/Mojahid_Ahmad)\ **Replies:** 0\ **Last updated:** [June 8, 2021, 11:44am UTC](https://discuss.elastic.co/t/how-to-convert-the-output-into-json-in-watcher-body/275293 "2021-06-08T11:44:23Z")
Hi, I want to convert the output into JSON format in the watcher body. I tried {{#toJson}}. But I couldn't get success. Please guide me through how to resolve this issue? "body": """{{#toJson}}{{#ctx.payload.hits.hits}}… --- ## [Match phrase prefix query stopped working for multiple terms after 7.10.2](https://discuss.elastic.co/t/match-phrase-prefix-query-stopped-working-for-multiple-terms-after-7-10-2/272293)
**Author:** [@Sleepy\_Panda](https://discuss.elastic.co/u/Sleepy_Panda)\ **Replies:** 3\ **Last updated:** [June 8, 2021, 10:44am UTC](https://discuss.elastic.co/t/match-phrase-prefix-query-stopped-working-for-multiple-terms-after-7-10-2/272293 "2021-06-08T10:44:29Z")
Issue: search using match\_phrase\_prefix does not return results for queries which consist of multiple terms, e.g. "Additional HTTP". ElasticSearch 7.10.2: document is returned when searching "Additional HTTP" ElasticSe… --- ## [Is jars used in modules can be reused?](https://discuss.elastic.co/t/is-jars-used-in-modules-can-be-reused/275281)
**Author:** [@mohammed\_rizwan](https://discuss.elastic.co/u/mohammed_rizwan)\ **Replies:** 0\ **Last updated:** [June 8, 2021, 9:59am UTC](https://discuss.elastic.co/t/is-jars-used-in-modules-can-be-reused/275281 "2021-06-08T09:59:44Z")
Hi team, We are using the elastic search 7.13.0. We observed that the same jars are available (repeated) in multiple module folders, say httpclient-4.5.10.jar is available in 5 modules. Is it possible to have this jar… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=630) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=632)