# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=632 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 633 --- ## ["\[term\] query malformed, no start\_object after query name"](https://discuss.elastic.co/t/term-query-malformed-no-start-object-after-query-name/275275)
**Author:** [@SeanO95](https://discuss.elastic.co/u/SeanO95)\ **Replies:** 0\ **Last updated:** [June 8, 2021, 9:38am UTC](https://discuss.elastic.co/t/term-query-malformed-no-start-object-after-query-name/275275 "2021-06-08T09:38:44Z")
Hey guys, seeing 'query malformed' no matter what field I try to use. I am trying to use postman to input data for my GET to pull back but seeing this issue. If I use postman to input data into my POST using the same m… --- ## [InputStream must have \> 0 bytes](https://discuss.elastic.co/t/inputstream-must-have-0-bytes/275265)
**Author:** [@Mohammed\_Shamran](https://discuss.elastic.co/u/Mohammed_Shamran)\ **Replies:** 0\ **Last updated:** [June 8, 2021, 8:52am UTC](https://discuss.elastic.co/t/inputstream-must-have-0-bytes/275265 "2021-06-08T08:52:59Z")
Hi Im getting following error when my Elasticsearch reindexing content. Any idea why Im getting this error and how can I configure elasticsearch to ignore this error? 2021-06-08 08:00:10.592 ERROR 38 --- \[deployment-3\]… --- ## [\_flush/synced command shows failures after being clean - indexing stopped](https://discuss.elastic.co/t/flush-synced-command-shows-failures-after-being-clean-indexing-stopped/274964)
**Author:** [@kredfern](https://discuss.elastic.co/u/kredfern)\ **Replies:** 2\ **Last updated:** [June 8, 2021, 8:37am UTC](https://discuss.elastic.co/t/flush-synced-command-shows-failures-after-being-clean-indexing-stopped/274964 "2021-06-08T08:37:17Z")
Just wondering if the following behavior can be explained so that we have confidence to continue the rolling restart procedure. We are using v7.4 cluster. We have stopped all indexing into the cluster before these step… --- ## [Cluster Red, many shards Unassigned](https://discuss.elastic.co/t/cluster-red-many-shards-unassigned/275236)
**Author:** [@sakrayaami](https://discuss.elastic.co/u/sakrayaami)\ **Replies:** 2\ **Last updated:** [June 8, 2021, 7:04am UTC](https://discuss.elastic.co/t/cluster-red-many-shards-unassigned/275236 "2021-06-08T07:04:56Z")
Hello, I'm very new to the community and here I am after some months of reading and configuring :slight\_smile: Ok I'm trying to work out a problem with my new cluster, I have the following setup: Elastic 7.13 2 Maste… --- ## [Recommended workflow for indexing many binary docs](https://discuss.elastic.co/t/recommended-workflow-for-indexing-many-binary-docs/275142)
**Author:** [@ottadini](https://discuss.elastic.co/u/ottadini)\ **Replies:** 3\ **Last updated:** [June 8, 2021, 6:50am UTC](https://discuss.elastic.co/t/recommended-workflow-for-indexing-many-binary-docs/275142 "2021-06-08T06:50:30Z")
I have two options in front of me - use fscrawler to crawl my directory, use the setting fs:store\_source (Base64-encoded document) to add the file as a field to the message, send that message to a pipeline on ES that h… --- ## [Cannot get failed shard back online](https://discuss.elastic.co/t/cannot-get-failed-shard-back-online/275003)
**Author:** [@agKaspar](https://discuss.elastic.co/u/agKaspar)\ **Replies:** 2\ **Last updated:** [June 8, 2021, 6:33am UTC](https://discuss.elastic.co/t/cannot-get-failed-shard-back-online/275003 "2021-06-08T06:33:17Z")
Hi, I'm trying to get failed shard in a single node cluster back online. The cluster is a single docker container running the docker.elastic.co/elasticsearch/elasticsearch:7.9.2 image. It has 10 indices and somewhere thi… --- ## [Get not running a cluster with 1 node on 3 hosts](https://discuss.elastic.co/t/get-not-running-a-cluster-with-1-node-on-3-hosts/275069)
**Author:** [@andreas.bader](https://discuss.elastic.co/u/andreas.bader)\ **Replies:** 2\ **Last updated:** [June 8, 2021, 6:18am UTC](https://discuss.elastic.co/t/get-not-running-a-cluster-with-1-node-on-3-hosts/275069 "2021-06-08T06:18:45Z")
I spent a lot of time to get a cluster running with one node on 3 different hosts, but all the configuration tips I found didn't fix the problem. I'm using Version 7.9. This is what I have configured: cluster.name: elk… --- ## [What’s the sort score difference between elasticsearch7.9.3 and elasticsearch6.8.0?](https://discuss.elastic.co/t/what-s-the-sort-score-difference-between-elasticsearch7-9-3-and-elasticsearch6-8-0/275225)
**Author:** [@sunweiconfidence](https://discuss.elastic.co/u/sunweiconfidence)\ **Replies:** 1\ **Last updated:** [June 8, 2021, 3:40am UTC](https://discuss.elastic.co/t/what-s-the-sort-score-difference-between-elasticsearch7-9-3-and-elasticsearch6-8-0/275225 "2021-06-08T03:40:44Z")
i test in the elasticsearch7.9.3 using below query clause: URL: https://elastic:password@MACHINENAME:9500/indexname/\_search query post body: { "explain": true, "from": 0, "size": 130, "query": { "bool": { "… --- ## [Extending Platinum trial license](https://discuss.elastic.co/t/extending-platinum-trial-license/275150)
**Author:** [@dani\_pulido](https://discuss.elastic.co/u/dani_pulido)\ **Replies:** 1\ **Last updated:** [June 8, 2021, 1:04am UTC](https://discuss.elastic.co/t/extending-platinum-trial-license/275150 "2021-06-08T01:04:29Z")
Hi, I am trying to extend my platinum trial license for 30 additional days. I've filled the form but I haven't received the license by mail. I've already put two different emails, the personal one and the company one but… --- ## [ELK to Qradar API](https://discuss.elastic.co/t/elk-to-qradar-api/275180)
**Author:** [@mohamed\_el\_mannouti](https://discuss.elastic.co/u/mohamed_el_mannouti)\ **Replies:** 1\ **Last updated:** [June 8, 2021, 1:03am UTC](https://discuss.elastic.co/t/elk-to-qradar-api/275180 "2021-06-08T01:03:30Z")
How i can tied ELK with Qradar API --- ## [Connect to Eleasticsearch with Vscode](https://discuss.elastic.co/t/connect-to-eleasticsearch-with-vscode/275215)
**Author:** [@s-ho](https://discuss.elastic.co/u/s-ho)\ **Replies:** 0\ **Last updated:** [June 8, 2021, 12:30am UTC](https://discuss.elastic.co/t/connect-to-eleasticsearch-with-vscode/275215 "2021-06-08T00:30:28Z")
Does anyone try to connect to the elastic cloud using the "elastic search for VScode" plugin? or Do you use other IDEs connect to the elastic cloud? Just wish to do all the coding on my preferable interface. Thx --- ## [Updating index with new field, based on the values of existing fields](https://discuss.elastic.co/t/updating-index-with-new-field-based-on-the-values-of-existing-fields/275144)
**Author:** [@saif3r](https://discuss.elastic.co/u/saif3r)\ **Replies:** 1\ **Last updated:** [June 7, 2021, 11:44pm UTC](https://discuss.elastic.co/t/updating-index-with-new-field-based-on-the-values-of-existing-fields/275144 "2021-06-07T23:44:50Z")
Hello, I have an index with two fields: City\_1 and City\_2. I would like to create a new field and update all existing documents based on the outcome of the following logical test: If City\_1 = City\_2 Then Match Else No … --- ## [Index lifecycle error - index.lifecycle.rollover\_alias syntax](https://discuss.elastic.co/t/index-lifecycle-error-index-lifecycle-rollover-alias-syntax/274933)
**Author:** [@AClerk](https://discuss.elastic.co/u/AClerk)\ **Replies:** 4\ **Last updated:** [June 7, 2021, 11:30pm UTC](https://discuss.elastic.co/t/index-lifecycle-error-index-lifecycle-rollover-alias-syntax/274933 "2021-06-07T23:30:19Z")
Hey All, Can someone help me with the syntax required? Or maybe I am missing something else? I got this error on the indices. This is my ILM policy below. How should I add the alias part? PUT \_ilm/policy/ilm-36-h… --- ## [Python bulk insert error](https://discuss.elastic.co/t/python-bulk-insert-error/275044)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 1\ **Last updated:** [June 7, 2021, 9:33pm UTC](https://discuss.elastic.co/t/python-bulk-insert-error/275044 "2021-06-07T21:33:28Z")
Using python code I am getting this error. if I use same code same data and just change index name it works. Is something wrong with existing index? how do I find this out? raise BulkIndexError("%i document(s) failed… --- ## [Recurring errors when backing up to GCS - FileAlreadyExistsException](https://discuss.elastic.co/t/recurring-errors-when-backing-up-to-gcs-filealreadyexistsexception/275205)
**Author:** [@hub](https://discuss.elastic.co/u/hub)\ **Replies:** 0\ **Last updated:** [June 7, 2021, 9:07pm UTC](https://discuss.elastic.co/t/recurring-errors-when-backing-up-to-gcs-filealreadyexistsexception/275205 "2021-06-07T21:07:18Z")
Hello, I have a recurring errors when Im doing snapshot to GCS bucket: {\\"type\\":\\"index\_shard\_snapshot\_failed\_exception\\",\\"reason\\":\\"IndexShardSnapshotFailedException\[Failed to perform snapshot (index files)\]; nested… --- ## [Elasticsearch error: Validation Failed: 1: parent histogram of moving\_avg aggregation \[3\] must have min\_doc\_count of 0;](https://discuss.elastic.co/t/elasticsearch-error-validation-failed-1-parent-histogram-of-moving-avg-aggregation-3-must-have-min-doc-count-of-0/274033)
**Author:** [@Isekai](https://discuss.elastic.co/u/Isekai)\ **Replies:** 2\ **Last updated:** [June 7, 2021, 8:54pm UTC](https://discuss.elastic.co/t/elasticsearch-error-validation-failed-1-parent-histogram-of-moving-avg-aggregation-3-must-have-min-doc-count-of-0/274033 "2021-06-07T20:54:24Z")
Greetings everyone Yesterday we updated elastic from 7.4.x to 7.10.1 and some of our grafana dashboards broke with the following error: Elasticsearch error: Validation Failed: 1: parent histogram of moving\_avg aggrega… --- ## [Create HTTPS Enabled Elasticsearch API](https://discuss.elastic.co/t/create-https-enabled-elasticsearch-api/274881)
**Author:** [@ankitdevnalkar](https://discuss.elastic.co/u/ankitdevnalkar)\ **Replies:** 3\ **Last updated:** [June 7, 2021, 7:51pm UTC](https://discuss.elastic.co/t/create-https-enabled-elasticsearch-api/274881 "2021-06-07T19:51:37Z")
While going through the document of creating an Elasticsearch API, there is a note for http.ssl.enabled node. It is asking to specify https while creating API key, but I am bit confused that where I need to mention about… --- ## [Having a hard time writing a query to exclude results](https://discuss.elastic.co/t/having-a-hard-time-writing-a-query-to-exclude-results/275186)
**Author:** [@ccvanilla](https://discuss.elastic.co/u/ccvanilla)\ **Replies:** 0\ **Last updated:** [June 7, 2021, 6:25pm UTC](https://discuss.elastic.co/t/having-a-hard-time-writing-a-query-to-exclude-results/275186 "2021-06-07T18:25:00Z")
Hello! I'm having a hard time writing a query to exclude certain results. I want to be able to search the index for one or many job titles, but also exclude one or many job titles from the results. For example, I want … --- ## [Sql Query to get data from more than one Indices](https://discuss.elastic.co/t/sql-query-to-get-data-from-more-than-one-indices/275147)
**Author:** [@Resington\_R](https://discuss.elastic.co/u/Resington_R)\ **Replies:** 5\ **Last updated:** [June 7, 2021, 5:03pm UTC](https://discuss.elastic.co/t/sql-query-to-get-data-from-more-than-one-indices/275147 "2021-06-07T17:03:54Z")
Hi... I am using the below query to get the data from 2 Indices, but I am getting this error "Queries with multiple indices are not supported". myindex1 and myindex2 structures are identical. I am using Elasticsearch V… --- ## [Filter aggregation buckets by top hits scripted field](https://discuss.elastic.co/t/filter-aggregation-buckets-by-top-hits-scripted-field/275181)
**Author:** [@mouse\_clicker](https://discuss.elastic.co/u/mouse_clicker)\ **Replies:** 0\ **Last updated:** [June 7, 2021, 5:03pm UTC](https://discuss.elastic.co/t/filter-aggregation-buckets-by-top-hits-scripted-field/275181 "2021-06-07T17:03:41Z")
Hello everyone. Let me start by explaining the end goal of the query I'm trying to build. We have a document with the following (relative to the question) mapping: { "analysis-results" : { "mappings" : { "pr… --- ## [Highest value possible for boosted fields](https://discuss.elastic.co/t/highest-value-possible-for-boosted-fields/275175)
**Author:** [@jlarroque](https://discuss.elastic.co/u/jlarroque)\ **Replies:** 0\ **Last updated:** [June 7, 2021, 3:49pm UTC](https://discuss.elastic.co/t/highest-value-possible-for-boosted-fields/275175 "2021-06-07T15:49:14Z")
Hi Elastic team, I would like to know what are the limits for boosting for boosted fields on a query, can I use 2000 ? Can I use 1M ? All examples I have seen are between 0 and 2, but I would like to know in advance what… --- ## [Time\_zone parameter](https://discuss.elastic.co/t/time-zone-parameter/275161)
**Author:** [@qwerty123](https://discuss.elastic.co/u/qwerty123)\ **Replies:** 3\ **Last updated:** [June 7, 2021, 2:41pm UTC](https://discuss.elastic.co/t/time-zone-parameter/275161 "2021-06-07T14:41:34Z")
hi !! does elasticsearch range query always work based on UTC time zone ?? if so, is it possible to change this and make it work according to user required time zone ?? even when i use time\_zone parameter in my query, t… --- ## [Value does not exist](https://discuss.elastic.co/t/value-does-not-exist/274833)
**Author:** [@kehers](https://discuss.elastic.co/u/kehers)\ **Replies:** 2\ **Last updated:** [June 7, 2021, 2:04pm UTC](https://discuss.elastic.co/t/value-does-not-exist/274833 "2021-06-07T14:04:05Z")
I am familiar with checking if a field exists using the exists query. I am wondering if there is a way to check if a value does not exist instead; something like this: GET /\_search { "query": { "bool": { "m… --- ## [Data Path per-Index Basis](https://discuss.elastic.co/t/data-path-per-index-basis/275157)
**Author:** [@tepus](https://discuss.elastic.co/u/tepus)\ **Replies:** 2\ **Last updated:** [June 7, 2021, 2:00pm UTC](https://discuss.elastic.co/t/data-path-per-index-basis/275157 "2021-06-07T14:00:57Z")
Hi Elastic Community, I'm running a three node cluster. I've defined the directory for storing indices with data.path in elasticsearch.yml. Is it possible to change the storing directory for a specific index? Personall… --- ## ["Latest" transform new feature - does it reduce load compared to a scripted metric?](https://discuss.elastic.co/t/latest-transform-new-feature-does-it-reduce-load-compared-to-a-scripted-metric/274888)
**Author:** [@Mark\_Duncan](https://discuss.elastic.co/u/Mark_Duncan)\ **Replies:** 2\ **Last updated:** [June 7, 2021, 1:20pm UTC](https://discuss.elastic.co/t/latest-transform-new-feature-does-it-reduce-load-compared-to-a-scripted-metric/274888 "2021-06-07T13:20:28Z")
I have been making use of scripted metrics to find the latest document inside a traditional transform. The new "Latest" document transform offering works to work really well and is dead simple to use! Question - would … --- ## [Unable to update mappings for Date fields in order to prepare for migration from 6.x to 7.x](https://discuss.elastic.co/t/unable-to-update-mappings-for-date-fields-in-order-to-prepare-for-migration-from-6-x-to-7-x/275138)
**Author:** [@Raja\_Kolluri](https://discuss.elastic.co/u/Raja_Kolluri)\ **Replies:** 0\ **Last updated:** [June 7, 2021, 11:04am UTC](https://discuss.elastic.co/t/unable-to-update-mappings-for-date-fields-in-order-to-prepare-for-migration-from-6-x-to-7-x/275138 "2021-06-07T11:04:32Z")
Hi, i am trying to migrate Elasticsearch from 6.x to 7.x version. "Indices" Tab in Upgrade Assistant 7.0 page in Kibana shows below warning message for most of my indices, This index has date fields with deprecated f… --- ## [Create scripted field showing time differences](https://discuss.elastic.co/t/create-scripted-field-showing-time-differences/275134)
**Author:** [@Elaak](https://discuss.elastic.co/u/Elaak)\ **Replies:** 0\ **Last updated:** [June 7, 2021, 10:36am UTC](https://discuss.elastic.co/t/create-scripted-field-showing-time-differences/275134 "2021-06-07T10:36:02Z")
Hi everyone, I am running Elastic Stack 7.9 with a basic license. In my data I have two date fields and I want to create a scripted field that writes the difference in a nice format. I easily get the difference by just … --- ## [Performance of 'Update by query' for frequent runs with at most 1 object returned](https://discuss.elastic.co/t/performance-of-update-by-query-for-frequent-runs-with-at-most-1-object-returned/275122)
**Author:** [@hariso](https://discuss.elastic.co/u/hariso)\ **Replies:** 1\ **Last updated:** [June 7, 2021, 10:06am UTC](https://discuss.elastic.co/t/performance-of-update-by-query-for-frequent-runs-with-at-most-1-object-returned/275122 "2021-06-07T10:06:51Z")
How does UBQ perform when it's being run frequently, and where at most one object will be updated? I have a cluster with a significant number of indexes and quite some documents (a few billions in total). In certain proc… --- ## [Transform api gives unsupported aggregation type \[multi\_terms\]](https://discuss.elastic.co/t/transform-api-gives-unsupported-aggregation-type-multi-terms/274616)
**Author:** [@rknd](https://discuss.elastic.co/u/rknd)\ **Replies:** 1\ **Last updated:** [June 7, 2021, 9:25am UTC](https://discuss.elastic.co/t/transform-api-gives-unsupported-aggregation-type-multi-terms/274616 "2021-06-07T09:25:58Z")
Below is my query for getting distinct values of the fields. { "size": 0, "aggs": { "unique\_pair": { "multi\_terms": { "terms": \[ { "field": "username" }, {… --- ## [Unusual disk read spike during ES migration](https://discuss.elastic.co/t/unusual-disk-read-spike-during-es-migration/273625)
**Author:** [@suryart](https://discuss.elastic.co/u/suryart)\ **Replies:** 2\ **Last updated:** [June 7, 2021, 9:07am UTC](https://discuss.elastic.co/t/unusual-disk-read-spike-during-es-migration/273625 "2021-06-07T09:07:10Z")
We have 4 ES machines running on AWS under a VPC behind an LB which are currently working without any issues. We wanted to migrate these 4 ES machines from this older VPC to the newer VPC behind a new LB. So, we followe… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=631) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=633)