# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=635 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 636 --- ## [How to control/limit ELK disk usage](https://discuss.elastic.co/t/how-to-control-limit-elk-disk-usage/274755)
**Author:** [@ManuelF](https://discuss.elastic.co/u/ManuelF)\ **Replies:** 0\ **Last updated:** [June 2, 2021, 1:20pm UTC](https://discuss.elastic.co/t/how-to-control-limit-elk-disk-usage/274755 "2021-06-02T13:20:05Z")
Hi, Running ELK 7.11.2 Standalone on Debian 10 My ELK machine has 500 GB of disk space. This is the second time the machine runs out of disk space (100% usage). When this happens, I am not able to log into Kibana, as E… --- ## [Search not adhering to time limits - searching many indexes](https://discuss.elastic.co/t/search-not-adhering-to-time-limits-searching-many-indexes/274665)
**Author:** [@P\_Larsen](https://discuss.elastic.co/u/P_Larsen)\ **Replies:** 3\ **Last updated:** [June 2, 2021, 11:14pm UTC](https://discuss.elastic.co/t/search-not-adhering-to-time-limits-searching-many-indexes/274665 "2021-06-02T23:14:53Z")
We have a search that we see running that has a time limit what appears to be 4 mins set but it is accessing indexes from way back in the past. What could be the issue? Grabbed from listing running tasks indices:data/… --- ## [Drop events if regex does not match in ElasticSearch](https://discuss.elastic.co/t/drop-events-if-regex-does-not-match-in-elasticsearch/274803)
**Author:** [@pbreda](https://discuss.elastic.co/u/pbreda)\ **Replies:** 0\ **Last updated:** [June 2, 2021, 10:31pm UTC](https://discuss.elastic.co/t/drop-events-if-regex-does-not-match-in-elasticsearch/274803 "2021-06-02T22:31:49Z")
I'm getting events from Filebeat directly to ElasticSearch for metrics live viewing in the Observability menu, however I can't drop out the events I'm not interested like I would be able to using Logstash. I'm receiving … --- ## [Big amount of search operations for use in percolator](https://discuss.elastic.co/t/big-amount-of-search-operations-for-use-in-percolator/274786)
**Author:** [@sanoj85](https://discuss.elastic.co/u/sanoj85)\ **Replies:** 0\ **Last updated:** [June 2, 2021, 5:23pm UTC](https://discuss.elastic.co/t/big-amount-of-search-operations-for-use-in-percolator/274786 "2021-06-02T17:23:41Z")
Hi, We are running an index with a field type percolator, which will take a big amount of incoming searches containing documents. I have seen the example (rally-tracks/default.json at master · elastic/rally-tracks · Git… --- ## [Dynamic value in index mappings override dynamic value setted in dynamic template \[ES 7.6.2\]](https://discuss.elastic.co/t/dynamic-value-in-index-mappings-override-dynamic-value-setted-in-dynamic-template-es-7-6-2/274752)
**Author:** [@Saief](https://discuss.elastic.co/u/Saief)\ **Replies:** 0\ **Last updated:** [June 2, 2021, 12:46pm UTC](https://discuss.elastic.co/t/dynamic-value-in-index-mappings-override-dynamic-value-setted-in-dynamic-template-es-7-6-2/274752 "2021-06-02T12:46:13Z")
Hello, I created a dynamic template to avoid adding specific new fields that have object type ( that match a particular pattern ) in the index mapping ( without touching the \_source ). This is the body of my query : \> … --- ## [Merge data on field bases](https://discuss.elastic.co/t/merge-data-on-field-bases/274745)
**Author:** [@Abdoul\_Kande](https://discuss.elastic.co/u/Abdoul_Kande)\ **Replies:** 1\ **Last updated:** [June 2, 2021, 12:12pm UTC](https://discuss.elastic.co/t/merge-data-on-field-bases/274745 "2021-06-02T12:12:25Z")
Hello, I would like to do the join of two indexes based on an id column. can i have an example ? --- ## [\_template vs \_index\_template](https://discuss.elastic.co/t/template-vs-index-template/274730)
**Author:** [@Jordi\_Cabre1](https://discuss.elastic.co/u/Jordi_Cabre1)\ **Replies:** 1\ **Last updated:** [June 2, 2021, 12:10pm UTC](https://discuss.elastic.co/t/template-vs-index-template/274730 "2021-06-02T12:10:09Z")
I've just realized that ES has a \_/\_template and a \_/\_index\_template. What are they for? I was using code: PutIndexTemplateRequest ngramTemplate = new PutIndexTemplateRequest("ngram-template") .patterns(Arrays.asList… --- ## [Query for email address within a text field](https://discuss.elastic.co/t/query-for-email-address-within-a-text-field/274742)
**Author:** [@saif3r](https://discuss.elastic.co/u/saif3r)\ **Replies:** 0\ **Last updated:** [June 2, 2021, 11:39am UTC](https://discuss.elastic.co/t/query-for-email-address-within-a-text-field/274742 "2021-06-02T11:39:39Z")
Hello, I'm trying to query my index that contains text field with an email address. As of now, if query for a specific domain (eg gmail), like below and it gives me the results: GET index\*/\_search { "query": { "… --- ## [Security index is unavailable](https://discuss.elastic.co/t/security-index-is-unavailable/274731)
**Author:** [@smm](https://discuss.elastic.co/u/smm)\ **Replies:** 2\ **Last updated:** [June 2, 2021, 10:42am UTC](https://discuss.elastic.co/t/security-index-is-unavailable/274731 "2021-06-02T10:42:51Z")
Hi there, I have installed a single node node on linux (role: monitoring node) (v. 7.8.1 // elastisearch + Kibana + redis) If in the elasticsearch.yml I give this: xpack.security.enabled: false then for example a cur… --- ## [Index Policies Error](https://discuss.elastic.co/t/index-policies-error/274722)
**Author:** [@Martin\_perez](https://discuss.elastic.co/u/Martin_perez)\ **Replies:** 4\ **Last updated:** [June 2, 2021, 10:31am UTC](https://discuss.elastic.co/t/index-policies-error/274722 "2021-06-02T10:31:43Z")
Hi, I have a problem with ILM, index life management, since I have followed the steps that appear in this guide Configure a lifecycle policy | Elasticsearch Guide \[master\] | Elastic My current index pattern is called fi… --- ## [Can I register snapshot repo without path.repo property in elasticsearch.yml?](https://discuss.elastic.co/t/can-i-register-snapshot-repo-without-path-repo-property-in-elasticsearch-yml/274427)
**Author:** [@Prabaharan\_Kathiresa](https://discuss.elastic.co/u/Prabaharan_Kathiresa)\ **Replies:** 3\ **Last updated:** [June 2, 2021, 7:24am UTC](https://discuss.elastic.co/t/can-i-register-snapshot-repo-without-path-repo-property-in-elasticsearch-yml/274427 "2021-06-02T07:24:08Z")
Hi Team, We are using elasticsearch 6.8.5 version in production with 3 Master and 8 data nodes. There is no path.repo property present in the production. I can't update elasticsearch.yml and restart nodes in production. … --- ## [Cross Cluster search, switching to an empty backup cluster](https://discuss.elastic.co/t/cross-cluster-search-switching-to-an-empty-backup-cluster/274601)
**Author:** [@driveirk](https://discuss.elastic.co/u/driveirk)\ **Replies:** 7\ **Last updated:** [June 2, 2021, 4:59am UTC](https://discuss.elastic.co/t/cross-cluster-search-switching-to-an-empty-backup-cluster/274601 "2021-06-02T04:59:37Z")
Hello, I want to make a backup cluster for Cross Cluster search. I selected proxy\_mod, I use Haproxy as a proxy Haproxy configuration example: server work 1.1.1.1:9300 check on-marked-up shutdown-backup-sessions on-m… --- ## [Date in runtime fields](https://discuss.elastic.co/t/date-in-runtime-fields/274692)
**Author:** [@IGB042](https://discuss.elastic.co/u/IGB042)\ **Replies:** 0\ **Last updated:** [June 2, 2021, 1:16am UTC](https://discuss.elastic.co/t/date-in-runtime-fields/274692 "2021-06-02T01:16:34Z")
I currently have an issue with calculating the day of week in a runtime field. My time field is stored in UTC "isotimestamp": \["2021-06-01T23:55:38.726Z"\] and displays correctly according to my TZ (UTC+10) isotimesta… --- ## [How to join two index](https://discuss.elastic.co/t/how-to-join-two-index/274572)
**Author:** [@jium](https://discuss.elastic.co/u/jium)\ **Replies:** 3\ **Last updated:** [June 2, 2021, 2:21am UTC](https://discuss.elastic.co/t/how-to-join-two-index/274572 "2021-06-02T02:21:34Z")
Hi, I want to join two indexes or merge them into one index. One index is being collected from the apache log and the other from mysql. I have to join the data through common key in two indexes and visualize it thro… --- ## [Watcher alerts issue with weekly date histogram](https://discuss.elastic.co/t/watcher-alerts-issue-with-weekly-date-histogram/274642)
**Author:** [@Roy\_Levy](https://discuss.elastic.co/u/Roy_Levy)\ **Replies:** 0\ **Last updated:** [June 1, 2021, 2:05pm UTC](https://discuss.elastic.co/t/watcher-alerts-issue-with-weekly-date-histogram/274642 "2021-06-01T14:05:57Z")
Hey, I'm trying to simulate a custom watcher alert on an index - it creates index with some aggregations on the given index in order to add only those that pass some threshold. The watcher uses date histogram on the key… --- ## [Is it ok to have a more then one tie breaker node for less then couple of hours](https://discuss.elastic.co/t/is-it-ok-to-have-a-more-then-one-tie-breaker-node-for-less-then-couple-of-hours/274685)
**Author:** [@Sanjay1](https://discuss.elastic.co/u/Sanjay1)\ **Replies:** 0\ **Last updated:** [June 1, 2021, 9:10pm UTC](https://discuss.elastic.co/t/is-it-ok-to-have-a-more-then-one-tie-breaker-node-for-less-then-couple-of-hours/274685 "2021-06-01T21:10:09Z")
We like to add 2nd tie breaker node along with our existing tiebreaker node. Once the new tie breaker node start working then like to decommission the existing tiebreaker node. For some time less the couple of hours it… --- ## [Sort by array values](https://discuss.elastic.co/t/sort-by-array-values/274681)
**Author:** [@romina](https://discuss.elastic.co/u/romina)\ **Replies:** 0\ **Last updated:** [June 1, 2021, 7:29pm UTC](https://discuss.elastic.co/t/sort-by-array-values/274681 "2021-06-01T19:29:36Z")
Hi! I need help with this use case Documents { "values": \["value1", "value3"\], "price": 3 } { "values": \["value1", "value2", "value3"\], "price": 1 } { "values": \["value3"\], … --- ## [Comparing Two Aggregate Buckets](https://discuss.elastic.co/t/comparing-two-aggregate-buckets/274663)
**Author:** [@gshanklin](https://discuss.elastic.co/u/gshanklin)\ **Replies:** 0\ **Last updated:** [June 1, 2021, 3:59pm UTC](https://discuss.elastic.co/t/comparing-two-aggregate-buckets/274663 "2021-06-01T15:59:42Z")
Hello, I am having a difficult time trying to compare the results of two aggerates. More specifically, I want to find unique "keys" between two aggerate buckets. For example, I have the two aggregates on the sample web … --- ## [How to call a filter/report in a watcher?](https://discuss.elastic.co/t/how-to-call-a-filter-report-in-a-watcher/274513)
**Author:** [@houjil](https://discuss.elastic.co/u/houjil)\ **Replies:** 5\ **Last updated:** [June 1, 2021, 3:49pm UTC](https://discuss.elastic.co/t/how-to-call-a-filter-report-in-a-watcher/274513 "2021-06-01T15:49:27Z")
Hi, Be indulgent plz this is my first watcher :slight\_smile: I'm trying to create a watcher in where I can: call and fetch a filter/report for a specific index (stream). The idea is to catch from received logs, of a… --- ## [Phrase/ multi-worlds search](https://discuss.elastic.co/t/phrase-multi-worlds-search/274661)
**Author:** [@lalitesh](https://discuss.elastic.co/u/lalitesh)\ **Replies:** 0\ **Last updated:** [June 1, 2021, 3:43pm UTC](https://discuss.elastic.co/t/phrase-multi-worlds-search/274661 "2021-06-01T15:43:01Z")
I am trying to implement a use case wherein a user can make a multi-words/ phrase search for 'product\_name' field. Assuming someone is searching for 'Richest Man', the following results should come: The Richest Man in… --- ## [Elasticsearch C# Nest unit tests with Moq : fail to mock concrete class](https://discuss.elastic.co/t/elasticsearch-c-nest-unit-tests-with-moq-fail-to-mock-concrete-class/274657)
**Author:** [@Nicolas\_Rey](https://discuss.elastic.co/u/Nicolas_Rey)\ **Replies:** 0\ **Last updated:** [June 1, 2021, 3:06pm UTC](https://discuss.elastic.co/t/elasticsearch-c-nest-unit-tests-with-moq-fail-to-mock-concrete-class/274657 "2021-06-01T15:06:16Z")
Hi, I need to mock some methods and properties in Nest.IElasticClient interface that is used in my repo. As example I need to stub the Indices.Exists() method to return an ExistsResponse having an Exists property return… --- ## [Elasticsearch 7.13 | Error deleting field mapping script, cluster return red state](https://discuss.elastic.co/t/elasticsearch-7-13-error-deleting-field-mapping-script-cluster-return-red-state/274655)
**Author:** [@joao](https://discuss.elastic.co/u/joao)\ **Replies:** 0\ **Last updated:** [June 1, 2021, 2:48pm UTC](https://discuss.elastic.co/t/elasticsearch-7-13-error-deleting-field-mapping-script-cluster-return-red-state/274655 "2021-06-01T14:48:33Z")
Hi, I've been testing the new features in the Elasticsearch 7.13, and I have a problem to deleting a field mapping script. This is my mapping: PUT runtime\_2\_indexed\_field { "mappings": { "propert… --- ## [Json data ingested contains unicode data (xml)](https://discuss.elastic.co/t/json-data-ingested-contains-unicode-data-xml/274647)
**Author:** [@justroll](https://discuss.elastic.co/u/justroll)\ **Replies:** 0\ **Last updated:** [June 1, 2021, 2:20pm UTC](https://discuss.elastic.co/t/json-data-ingested-contains-unicode-data-xml/274647 "2021-06-01T14:20:15Z")
Hi I'm a little bit puzzled .. We got logging coming from a k8s , it is logging in json to our elastic , the logging exposes a xml file in the message field, this is encoded in unicode like \ \ \ **Author:** [@riccardo\_centropaghe](https://discuss.elastic.co/u/riccardo_centropaghe)\ **Replies:** 0\ **Last updated:** [June 1, 2021, 2:10pm UTC](https://discuss.elastic.co/t/unable-to-find-valid-certification-path-to-requested-target-while-trying-to-implement-https/274644 "2021-06-01T14:10:44Z") Hi, I am using a ELK stack in docker for pfSense, from here GitHub - pfelk/docker: Deploy pfelk with docker-compose All went fine, I even implement https with my own domain certificate. Navigating on the KIBANA dashboar… --- ## [How to update the GeoIP Databases for Elastic Ingest Pipelines](https://discuss.elastic.co/t/how-to-update-the-geoip-databases-for-elastic-ingest-pipelines/274259)
**Author:** [@nverrill](https://discuss.elastic.co/u/nverrill)\ **Replies:** 4\ **Last updated:** [June 1, 2021, 2:05pm UTC](https://discuss.elastic.co/t/how-to-update-the-geoip-databases-for-elastic-ingest-pipelines/274259 "2021-06-01T14:05:44Z")
I've read up on the docs and current topics and haven't found how to properly update the GeoIP Databases that come with Elasticsearch for the Ingest Pipelines. I have downloaded the latest GeoLite2-Country.mmdb from Ma… --- ## [Ingest plugin context data](https://discuss.elastic.co/t/ingest-plugin-context-data/273788)
**Author:** [@nmalocic](https://discuss.elastic.co/u/nmalocic)\ **Replies:** 7\ **Last updated:** [June 1, 2021, 1:29pm UTC](https://discuss.elastic.co/t/ingest-plugin-context-data/273788 "2021-06-01T13:29:16Z")
Hi everyone, I am building ingest plugin, and I was wondering if there is any way to know index, or pipeline name from plugin? My idea is to enable users to have multiple configurations so this seems like easy solution… --- ## [Prefix field with specific index name while searching on multiple indices](https://discuss.elastic.co/t/prefix-field-with-specific-index-name-while-searching-on-multiple-indices/274628)
**Author:** [@Dgame](https://discuss.elastic.co/u/Dgame)\ **Replies:** 0\ **Last updated:** [June 1, 2021, 12:14pm UTC](https://discuss.elastic.co/t/prefix-field-with-specific-index-name-while-searching-on-multiple-indices/274628 "2021-06-01T12:14:39Z")
Let's say I have two different indices (index\_a and index\_b) which both have different fields. For example index\_a has the field title and body and index\_b has only the field body. Now I'm searching like this: { "quer… --- ## [Splunk data to elasticsearch migration](https://discuss.elastic.co/t/splunk-data-to-elasticsearch-migration/274623)
**Author:** [@mruthyu](https://discuss.elastic.co/u/mruthyu)\ **Replies:** 2\ **Last updated:** [June 1, 2021, 12:08pm UTC](https://discuss.elastic.co/t/splunk-data-to-elasticsearch-migration/274623 "2021-06-01T12:08:54Z")
Is there a way data from Splunk can be indexed into elasticserach considering few tens of TB of data? Is there any utility program which can be used to export data from splunk? Thanks. --- ## [Upgrade hardware size - Any downtime?](https://discuss.elastic.co/t/upgrade-hardware-size-any-downtime/274613)
**Author:** [@Cesidio\_DiBenedetto](https://discuss.elastic.co/u/Cesidio_DiBenedetto)\ **Replies:** 5\ **Last updated:** [June 1, 2021, 12:03pm UTC](https://discuss.elastic.co/t/upgrade-hardware-size-any-downtime/274613 "2021-06-01T12:03:38Z")
Will an upgrade in hardware size cause any downtime? --- ## [ILM: index not showing in Cold phase and Delete phase](https://discuss.elastic.co/t/ilm-index-not-showing-in-cold-phase-and-delete-phase/272289)
**Author:** [@neko](https://discuss.elastic.co/u/neko)\ **Replies:** 4\ **Last updated:** [June 1, 2021, 11:42am UTC](https://discuss.elastic.co/t/ilm-index-not-showing-in-cold-phase-and-delete-phase/272289 "2021-06-01T11:42:48Z")
Hi, I'm using Winlogbeat and i've defined a lifecycle with the following phases: Hot, Warm, Cold and Delete. In Index Management i have indices only for Hot and Warm phases. Could someone tell me what is wrong? Any he… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=634) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=636)