# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=643 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 644 --- ## [Nested query with must clause and second nested query](https://discuss.elastic.co/t/nested-query-with-must-clause-and-second-nested-query/273380)
**Author:** [@hastinc](https://discuss.elastic.co/u/hastinc)\ **Replies:** 0\ **Last updated:** [May 19, 2021, 9:52am UTC](https://discuss.elastic.co/t/nested-query-with-must-clause-and-second-nested-query/273380 "2021-05-19T09:52:11Z")
Hi All, First of all sorry for the long post. I'm wondering if somebody can confirm if the query I've constructed is correct. Basically, I have a User mapping that has Transaction nested within the user and I'm lookin… --- ## [Elasticsearch & Kibana monitoring visualization only goes back 1 week](https://discuss.elastic.co/t/elasticsearch-kibana-monitoring-visualization-only-goes-back-1-week/273388)
**Author:** [@vkatsikaros](https://discuss.elastic.co/u/vkatsikaros)\ **Replies:** 0\ **Last updated:** [May 19, 2021, 10:33am UTC](https://discuss.elastic.co/t/elasticsearch-kibana-monitoring-visualization-only-goes-back-1-week/273388 "2021-05-19T10:33:42Z")
Hi I am not sure if this is the correct subforum/tags for the issue. If it's not please let me know where to post it. I monitor ES & Kibana with metricbeat (all 7.10.1). I see there are indices from the last 3 months b… --- ## [Version compatibility issue](https://discuss.elastic.co/t/version-compatibility-issue/273374)
**Author:** [@danushkalakmina](https://discuss.elastic.co/u/danushkalakmina)\ **Replies:** 3\ **Last updated:** [May 19, 2021, 9:52am UTC](https://discuss.elastic.co/t/version-compatibility-issue/273374 "2021-05-19T09:52:49Z")
Hi I have used Logstash version 6.2 ,(Elasticsearch version 6.2 and Kibana version 6.2)AWS EK previously. Previously with the above versions it was working perfectly.But i upgrade my Elastic search and Kibana 6.2 AWS ve… --- ## [Elasticsearch crashes with PEM certificate error when using pfx split into separate certificate and key](https://discuss.elastic.co/t/elasticsearch-crashes-with-pem-certificate-error-when-using-pfx-split-into-separate-certificate-and-key/273247)
**Author:** [@keacw](https://discuss.elastic.co/u/keacw)\ **Replies:** 4\ **Last updated:** [May 19, 2021, 9:49am UTC](https://discuss.elastic.co/t/elasticsearch-crashes-with-pem-certificate-error-when-using-pfx-split-into-separate-certificate-and-key/273247 "2021-05-19T09:49:08Z")
\[ERROR\]\[c.a.o.s.s.DefaultOpenDistroSecurityKeyStore\] \[example.com\] Your keystore or PEM does not contain a key. If you specified a key password, try removing it. If you did not specify a key password, perhaps you need t… --- ## [Convert cluster to single node](https://discuss.elastic.co/t/convert-cluster-to-single-node/273368)
**Author:** [@macho](https://discuss.elastic.co/u/macho)\ **Replies:** 5\ **Last updated:** [May 19, 2021, 8:44am UTC](https://discuss.elastic.co/t/convert-cluster-to-single-node/273368 "2021-05-19T08:44:29Z")
Sorry for probably a stupid question, but I am relatively new to elasticsearch. My Problem is, I have a running cluster on three different machines. As this machines were never on the limit we want to use (at least) on… --- ## [ILM Policies Disappear](https://discuss.elastic.co/t/ilm-policies-disappear/273181)
**Author:** [@SKRYMr](https://discuss.elastic.co/u/SKRYMr)\ **Replies:** 4\ **Last updated:** [May 19, 2021, 8:04am UTC](https://discuss.elastic.co/t/ilm-policies-disappear/273181 "2021-05-19T08:04:24Z")
Hello, this is a weird one because there's no way for us to tie this to any specific event but it seems that a custom ILM policy and also the relative index template that we define for some of our indices disappear after… --- ## [Secure Elasticsearch with LDAP/Active Directory and built-in/internal users](https://discuss.elastic.co/t/secure-elasticsearch-with-ldap-active-directory-and-built-in-internal-users/273366)
**Author:** [@d.silwon](https://discuss.elastic.co/u/d.silwon)\ **Replies:** 2\ **Last updated:** [May 19, 2021, 8:04am UTC](https://discuss.elastic.co/t/secure-elasticsearch-with-ldap-active-directory-and-built-in-internal-users/273366 "2021-05-19T08:04:04Z")
Dears, We plan to connect the ELK cluster with LDAP / Active Directory for user authentication. What about built-in/internal accounts like logstash user? Will these accounts continue to work after establishing the conn… --- ## [Elasticsearch Create Wrong time based Index](https://discuss.elastic.co/t/elasticsearch-create-wrong-time-based-index/272785)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 6\ **Last updated:** [May 13, 2021, 4:51pm UTC](https://discuss.elastic.co/t/elasticsearch-create-wrong-time-based-index/272785 "2021-05-13T16:51:59Z")
Using ELK 7.11 we have 11 index out of these we have one index called log-wlb-sysmon.It created its first index on 2021.04.06(log-wlb-sysmon-2021.04.06-000001) , we are using ILM policy for all the indexes It created t… --- ## [Index name doesn't reset every day](https://discuss.elastic.co/t/index-name-doesnt-reset-every-day/273315)
**Author:** [@Downer](https://discuss.elastic.co/u/Downer)\ **Replies:** 2\ **Last updated:** [May 19, 2021, 7:31am UTC](https://discuss.elastic.co/t/index-name-doesnt-reset-every-day/273315 "2021-05-19T07:31:44Z")
Hello, I have an index named "metricbeat-7.10.1-2021.04.18-000324" but tomorrow it will be "metricbeat-7.10.1-2021.04.19-000325". The date math working perfectly but the indice (325) keep growing and don't reset every d… --- ## [Exporting GCP stackdriver log to elasticsearch on premise](https://discuss.elastic.co/t/exporting-gcp-stackdriver-log-to-elasticsearch-on-premise/273343)
**Author:** [@soufiane\_adn](https://discuss.elastic.co/u/soufiane_adn)\ **Replies:** 5\ **Last updated:** [May 19, 2021, 7:45am UTC](https://discuss.elastic.co/t/exporting-gcp-stackdriver-log-to-elasticsearch-on-premise/273343 "2021-05-19T07:45:29Z")
Hello team, can we export logs from google cloud GCP (stackdriver) to an elasticsearch on premise? I found the link below, but they assume that elasticsearch is established on elastic cloud, on my case I have a local c… --- ## [Performance Issues in Multi-Level Terms Aggregation](https://discuss.elastic.co/t/performance-issues-in-multi-level-terms-aggregation/273369)
**Author:** [@Prasiddha](https://discuss.elastic.co/u/Prasiddha)\ **Replies:** 0\ **Last updated:** [May 19, 2021, 7:11am UTC](https://discuss.elastic.co/t/performance-issues-in-multi-level-terms-aggregation/273369 "2021-05-19T07:11:23Z")
For the introduction, we are running into a performance issues when multi-level terms aggregation is being applied. We’re trying to implement multi-level Terms aggregation, up-to 5 levels and running into performance is… --- ## [How to confirm audit logging is enabled](https://discuss.elastic.co/t/how-to-confirm-audit-logging-is-enabled/272888)
**Author:** [@knagasri](https://discuss.elastic.co/u/knagasri)\ **Replies:** 3\ **Last updated:** [May 19, 2021, 6:40am UTC](https://discuss.elastic.co/t/how-to-confirm-audit-logging-is-enabled/272888 "2021-05-19T06:40:56Z")
I had deployed elasticsearch-operator(1.3.0) with elasticsearch 7.9.0 in GKE. I have used below line in my elasticsearch.yaml to enable audit logging: xpack.security.audit.enabled: true As per the documentation(Enabli… --- ## [Custom Realm create roles dynamically using an external microservice for document level security](https://discuss.elastic.co/t/custom-realm-create-roles-dynamically-using-an-external-microservice-for-document-level-security/273190)
**Author:** [@pablomartinez](https://discuss.elastic.co/u/pablomartinez)\ **Replies:** 3\ **Last updated:** [May 19, 2021, 4:19am UTC](https://discuss.elastic.co/t/custom-realm-create-roles-dynamically-using-an-external-microservice-for-document-level-security/273190 "2021-05-19T04:19:37Z")
Hello everyone. I'm trying to implement a custom role provider that each time the user is logged in, I can be able to create the role(s) for this particular user using an external http microservice that based on the use… --- ## [Can we send a query with ignorable field to Elasticsearch?](https://discuss.elastic.co/t/can-we-send-a-query-with-ignorable-field-to-elasticsearch/272975)
**Author:** [@Anonymous\_Soul](https://discuss.elastic.co/u/Anonymous_Soul)\ **Replies:** 4\ **Last updated:** [May 19, 2021, 2:18am UTC](https://discuss.elastic.co/t/can-we-send-a-query-with-ignorable-field-to-elasticsearch/272975 "2021-05-19T02:18:44Z")
Hi Team, Suppose we are a team with 100 other teams querying our cluster, either through Kibana or Elasticsearch APIs Can we identify those with a special field like a uniqueID specific to one team but those fields are… --- ## [Problem upgrading to 7.12.1](https://discuss.elastic.co/t/problem-upgrading-to-7-12-1/273353)
**Author:** [@Jerry\_Hoffmeister](https://discuss.elastic.co/u/Jerry_Hoffmeister)\ **Replies:** 4\ **Last updated:** [May 19, 2021, 2:14am UTC](https://discuss.elastic.co/t/problem-upgrading-to-7-12-1/273353 "2021-05-19T02:14:24Z")
Hi, I'm upgrading a single node, dev instance of elasticsearch running 6.4.2 to 7.12.1 as the first step in getting ready to upgrade our prod cluster. I was able to upgrade from 6.4.2 -\> 6.8.15 without issue but on upg… --- ## [ES Index Insert-Update Issues](https://discuss.elastic.co/t/es-index-insert-update-issues/272989)
**Author:** [@vikramnr](https://discuss.elastic.co/u/vikramnr)\ **Replies:** 2\ **Last updated:** [May 19, 2021, 1:30am UTC](https://discuss.elastic.co/t/es-index-insert-update-issues/272989 "2021-05-19T01:30:05Z")
We have an index which updated every 5th minutes and at that 5th min the same index is updated six times for different sets of columns.We are using upsert to update and insert, if the value is not present. We also have \_… --- ## [Regarding the security of the ELK stack docker images](https://discuss.elastic.co/t/regarding-the-security-of-the-elk-stack-docker-images/272895)
**Author:** [@signum](https://discuss.elastic.co/u/signum)\ **Replies:** 2\ **Last updated:** [May 19, 2021, 1:14am UTC](https://discuss.elastic.co/t/regarding-the-security-of-the-elk-stack-docker-images/272895 "2021-05-19T01:14:06Z")
Hi, I am trying out the docker version of the ELK stack, and have noted that when I scan it using trivy / "docker scan", it is showing some OS related vulnerabilities for libraries such curl etc. Can I understand if thes… --- ## [Specifying endpoint for performing reading/writing operations](https://discuss.elastic.co/t/specifying-endpoint-for-performing-reading-writing-operations/273304)
**Author:** [@pkaramol](https://discuss.elastic.co/u/pkaramol)\ **Replies:** 1\ **Last updated:** [May 19, 2021, 1:13am UTC](https://discuss.elastic.co/t/specifying-endpoint-for-performing-reading-writing-operations/273304 "2021-05-19T01:13:07Z")
Assuming we are trying to perform a read and/or a write operation on an es cluster reachable at https://my-es-cluster Assuming this cluster is deployed on kubernetes and we have a way to directly reach a master service… --- ## [Kibana Watcher - Using it to calculate a percentage of two result values](https://discuss.elastic.co/t/kibana-watcher-using-it-to-calculate-a-percentage-of-two-result-values/273305)
**Author:** [@Zooka94](https://discuss.elastic.co/u/Zooka94)\ **Replies:** 0\ **Last updated:** [May 18, 2021, 2:45pm UTC](https://discuss.elastic.co/t/kibana-watcher-using-it-to-calculate-a-percentage-of-two-result-values/273305 "2021-05-18T14:45:19Z")
I am trying to use a watcher to parse email event data, we have a field that will state if the email delivery is successful/delayed/ failed. I want to know if it is possible to calculate the percentage of failed message… --- ## [A little confused about JAVA requirement to install ES 6.8.15 in a clean Ubuntu 18.04 server](https://discuss.elastic.co/t/a-little-confused-about-java-requirement-to-install-es-6-8-15-in-a-clean-ubuntu-18-04-server/273306)
**Author:** [@cis4life](https://discuss.elastic.co/u/cis4life)\ **Replies:** 2\ **Last updated:** [May 19, 2021, 1:11am UTC](https://discuss.elastic.co/t/a-little-confused-about-java-requirement-to-install-es-6-8-15-in-a-clean-ubuntu-18-04-server/273306 "2021-05-19T01:11:45Z")
I'm about to install ES 6.8.15 on a CLEAN ubuntu 18.04 server. I know I need JAVA, the question is when i stood up a clean VM with Ubuntu 18.04, It DOES NOT have any JAVA installed at all. So I'm going to have to insta… --- ## [ProblemChild Getting Started question](https://discuss.elastic.co/t/problemchild-getting-started-question/273338)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 1\ **Last updated:** [May 18, 2021, 9:51pm UTC](https://discuss.elastic.co/t/problemchild-getting-started-question/273338 "2021-05-18T21:51:32Z")
Hello, Just read through ProblemChild: Detecting living-off-the-land attacks using the Elastic Stack | Elastic Blog which all seems super interesting. So.. Forgive me for my noobish questions.. But I was wondering how… --- ## [How to fit data from unchangeable source into ECS?](https://discuss.elastic.co/t/how-to-fit-data-from-unchangeable-source-into-ecs/273126)
**Author:** [@TheGerd](https://discuss.elastic.co/u/TheGerd)\ **Replies:** 3\ **Last updated:** [May 18, 2021, 8:07pm UTC](https://discuss.elastic.co/t/how-to-fit-data-from-unchangeable-source-into-ecs/273126 "2021-05-18T20:07:27Z")
Hello. I am used to the very basic concepts of Elasticsearch but now facing an issue where I don't know how to proceed. I am indexing data in a fixed format and I am not able to change the format at the source. Now I wa… --- ## [Multi\_terms aggregation gives me an error](https://discuss.elastic.co/t/multi-terms-aggregation-gives-me-an-error/272328)
**Author:** [@pmsearcher](https://discuss.elastic.co/u/pmsearcher)\ **Replies:** 3\ **Last updated:** [May 18, 2021, 4:13pm UTC](https://discuss.elastic.co/t/multi-terms-aggregation-gives-me-an-error/272328 "2021-05-18T16:13:31Z")
Hello ! I'm trying to use ElasticSearch v. 7.11.1 on Windows 10. I don't know how to make multi\_terms aggregation work. This query: { "aggs": { "test\_agg": { "multi\_terms": { "terms": \[{ "… --- ## [Sorting a percentile aggregation](https://discuss.elastic.co/t/sorting-a-percentile-aggregation/273298)
**Author:** [@chapmantrain](https://discuss.elastic.co/u/chapmantrain)\ **Replies:** 0\ **Last updated:** [May 18, 2021, 1:58pm UTC](https://discuss.elastic.co/t/sorting-a-percentile-aggregation/273298 "2021-05-18T13:58:33Z")
Is it possible to sort a percentile aggregation? The query is: "size": 0, "query": { "bool": { "must": \[ { "range": { "dttm": { "gte": "now-24h", "… --- ## [Elasticsearch won't start with Ansible service module](https://discuss.elastic.co/t/elasticsearch-wont-start-with-ansible-service-module/273297)
**Author:** [@Ferencz](https://discuss.elastic.co/u/Ferencz)\ **Replies:** 0\ **Last updated:** [May 18, 2021, 1:51pm UTC](https://discuss.elastic.co/t/elasticsearch-wont-start-with-ansible-service-module/273297 "2021-05-18T13:51:48Z")
Hi all, I'm using Ansible to install Elasticsearch and when I want to start the Elasticsearch with service module it won't start but when I execute "service elasticsearch start" manually it is working normally. Ansible… --- ## [Unassigned\_shards":1](https://discuss.elastic.co/t/unassigned-shards-1/273083)
**Author:** [@jeyasingh\_t](https://discuss.elastic.co/u/jeyasingh_t)\ **Replies:** 3\ **Last updated:** [May 18, 2021, 1:40pm UTC](https://discuss.elastic.co/t/unassigned-shards-1/273083 "2021-05-18T13:40:01Z")
Hi, We use 6.8.1 with 3 cluster and got into this situation due to one of the hosts ran out of storage. I used the below command to address the read-only index. curl -X PUT 'http://xxxxxxxxxxxxx:9200/\_all/\_settings -H … --- ## [Local install with ansible role](https://discuss.elastic.co/t/local-install-with-ansible-role/273274)
**Author:** [@uysalnet\_io](https://discuss.elastic.co/u/uysalnet_io)\ **Replies:** 0\ **Last updated:** [May 18, 2021, 11:47am UTC](https://discuss.elastic.co/t/local-install-with-ansible-role/273274 "2021-05-18T11:47:06Z")
Hi, I am using official ansible role to deploy cluster but I didn't understand if this role supports local installation of elasticsearch packages. By default this role using official elasticsearch repos to download pack… --- ## [Error xpack monitoring elasticsearch password hasn't been registered and elastalert-kibana-plugin.serverHost and serverPort" settings were not applied](https://discuss.elastic.co/t/error-xpack-monitoring-elasticsearch-password-hasnt-been-registered-and-elastalert-kibana-plugin-serverhost-and-serverport-settings-were-not-applied/273214)
**Author:** [@MdRashid](https://discuss.elastic.co/u/MdRashid)\ **Replies:** 2\ **Last updated:** [May 18, 2021, 11:38am UTC](https://discuss.elastic.co/t/error-xpack-monitoring-elasticsearch-password-hasnt-been-registered-and-elastalert-kibana-plugin-serverhost-and-serverport-settings-were-not-applied/273214 "2021-05-18T11:38:59Z")
Hi All, I have all the yaml file and config file with me but i want to deploy through docker stack like docker stack deploy -c docker-compose.yaml test After deploy only elasticsearch container is working and logstash… --- ## [Elastic search duplicate document with same Id and different routing](https://discuss.elastic.co/t/elastic-search-duplicate-document-with-same-id-and-different-routing/273242)
**Author:** [@Mohanapriya\_Gopal1](https://discuss.elastic.co/u/Mohanapriya_Gopal1)\ **Replies:** 2\ **Last updated:** [May 18, 2021, 10:39am UTC](https://discuss.elastic.co/t/elastic-search-duplicate-document-with-same-id-and-different-routing/273242 "2021-05-18T10:39:55Z")
While indexing using logstash from db to elastic, we got duplicate documents with same Id and different routing.how canwe fix this --- ## [Influence of Master Nodes and Large Cluster State on Search](https://discuss.elastic.co/t/influence-of-master-nodes-and-large-cluster-state-on-search/273103)
**Author:** [@itays](https://discuss.elastic.co/u/itays)\ **Replies:** 7\ **Last updated:** [May 18, 2021, 10:35am UTC](https://discuss.elastic.co/t/influence-of-master-nodes-and-large-cluster-state-on-search/273103 "2021-05-18T10:35:06Z")
Hey, We are running in production an elasticsearch cluster. The setup is: 10 data nodes - 8 cpus and 64G ram, half is heap 3 master nodes - 4 cpus and 16g ram, half is heap In our cluster we have large number of indi… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=642) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=644)