# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=649 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 650 --- ## [\_component\_template APT got error](https://discuss.elastic.co/t/component-template-apt-got-error/271731)
**Author:** [@carpeDiem](https://discuss.elastic.co/u/carpeDiem)\ **Replies:** 6\ **Last updated:** [May 10, 2021, 9:36am UTC](https://discuss.elastic.co/t/component-template-apt-got-error/271731 "2021-05-10T09:36:42Z")
Hello experts, We are doing features about data-stream,ilm....I use GET /\_component\_template/template\_1,template\_2API to get more templates for once,but I got an error: resource\_not\_found\_exception,I had see the guide,I… --- ## [Need help with watcher](https://discuss.elastic.co/t/need-help-with-watcher/271755)
**Author:** [@Tatamata](https://discuss.elastic.co/u/Tatamata)\ **Replies:** 1\ **Last updated:** [May 10, 2021, 9:31am UTC](https://discuss.elastic.co/t/need-help-with-watcher/271755 "2021-05-10T09:31:13Z")
I need some help with watcher below. It is working but in email that is send to me I receive 10 cases of connection that receive code 503. I’d like instead to get a total number of calls with 503 for each IP. For instanc… --- ## [Changed the field type after adding in elasticsearch](https://discuss.elastic.co/t/changed-the-field-type-after-adding-in-elasticsearch/272558)
**Author:** [@Dhiraj](https://discuss.elastic.co/u/Dhiraj)\ **Replies:** 2\ **Last updated:** [May 10, 2021, 9:30am UTC](https://discuss.elastic.co/t/changed-the-field-type-after-adding-in-elasticsearch/272558 "2021-05-10T09:30:46Z")
Hello, I have created one index. in which I send one field name as "elapsed\_time" as float. for that, I use logstash filter for converting data types. but it is added as a string into elasticsearch instead of float. I … --- ## [Redundant should block or query\_string in query?](https://discuss.elastic.co/t/redundant-should-block-or-query-string-in-query/270602)
**Author:** [@rschirin](https://discuss.elastic.co/u/rschirin)\ **Replies:** 2\ **Last updated:** [May 10, 2021, 9:27am UTC](https://discuss.elastic.co/t/redundant-should-block-or-query-string-in-query/270602 "2021-05-10T09:27:56Z")
hey there, I can get the same result using two different approach for a specific query. The first one uses several should terms "should": \[ { "terms": { "fieldname": \["valu… --- ## [Product title autocompletion/suggestions](https://discuss.elastic.co/t/product-title-autocompletion-suggestions/271949)
**Author:** [@corlee](https://discuss.elastic.co/u/corlee)\ **Replies:** 1\ **Last updated:** [May 10, 2021, 9:26am UTC](https://discuss.elastic.co/t/product-title-autocompletion-suggestions/271949 "2021-05-10T09:26:34Z")
Hi there, I'm currently struggling with autocompletion/suggestions. I've got a product database with a title, description, price, etc. What i want to achieve is for example: Example: When i search for "ipad", I want t… --- ## [Named Query Confusion](https://discuss.elastic.co/t/named-query-confusion/271997)
**Author:** [@bsmith](https://discuss.elastic.co/u/bsmith)\ **Replies:** 1\ **Last updated:** [May 10, 2021, 9:25am UTC](https://discuss.elastic.co/t/named-query-confusion/271997 "2021-05-10T09:25:37Z")
I understand that named queries add the matched\_queries property to the response, but is there any way to access documents that match the named queries in aggregations? The goal is to be able to use the "%dashboard\_cont… --- ## [Multiple date format failes](https://discuss.elastic.co/t/multiple-date-format-failes/272100)
**Author:** [@telebh](https://discuss.elastic.co/u/telebh)\ **Replies:** 1\ **Last updated:** [May 10, 2021, 9:23am UTC](https://discuss.elastic.co/t/multiple-date-format-failes/272100 "2021-05-10T09:23:49Z")
Hi .. I have mapping for a date field set as follows. ES version used 7.9 "itemtransactionid": { "type": "date", "format": "yyyy-MM-dd'T'HH:mm:ss:SSZ||strict\_date\_optional\_time||yyyy-MM-dd'T… --- ## [Grouping similar buckets](https://discuss.elastic.co/t/grouping-similar-buckets/272068)
**Author:** [@Gregorkosmina](https://discuss.elastic.co/u/Gregorkosmina)\ **Replies:** 1\ **Last updated:** [May 10, 2021, 9:14am UTC](https://discuss.elastic.co/t/grouping-similar-buckets/272068 "2021-05-10T09:14:57Z")
My aggregations buckets are sorted by doc\_count at the moment. I would like to group them by similar buckets (e.g 40 km/h, 50 km/h, 60 km/h) even if doc\_count is different. Is this even possible? --- ## [How do I extend the default analyzer?](https://discuss.elastic.co/t/how-do-i-extend-the-default-analyzer/272390)
**Author:** [@jongpyo.lee](https://discuss.elastic.co/u/jongpyo.lee)\ **Replies:** 1\ **Last updated:** [May 10, 2021, 9:10am UTC](https://discuss.elastic.co/t/how-do-i-extend-the-default-analyzer/272390 "2021-05-10T09:10:08Z")
This is example data. POST coding/\_bulk {"index":{"\_id":"1"}} {"language":"xyz\_foo@abc"} I confirmed that the defulat analyzer distinguishes @ but not the \_ (underscore)symbol through \_termvectors. GET coding/\_termve… --- ## [Elastic ignoring cold\_role](https://discuss.elastic.co/t/elastic-ignoring-cold-role/272262)
**Author:** [@mverbeek](https://discuss.elastic.co/u/mverbeek)\ **Replies:** 9\ **Last updated:** [May 10, 2021, 8:00am UTC](https://discuss.elastic.co/t/elastic-ignoring-cold-role/272262 "2021-05-10T08:00:36Z")
We have an Elastic stack on 7.6.1 that we upgrades to 7.10.2. Then we introduced new nodes with slower bigger storage to it with cold\_node role and set the others to data\_warm, data\_hot and data\_content. During the inst… --- ## [Elastic Cloud Elasticsearch 7.11.x node tier index allocation](https://discuss.elastic.co/t/elastic-cloud-elasticsearch-7-11-x-node-tier-index-allocation/272185)
**Author:** [@dimitris\_sb](https://discuss.elastic.co/u/dimitris_sb)\ **Replies:** 3\ **Last updated:** [May 10, 2021, 7:54am UTC](https://discuss.elastic.co/t/elastic-cloud-elasticsearch-7-11-x-node-tier-index-allocation/272185 "2021-05-10T07:54:30Z")
Hi All, I noticed that when I started restoring backups in my Elastic Cloud cluster, except for the hot nodes the warm nodes started being populated automatically with data. Is there any documentation about this behavi… --- ## [Elasticsearch exporter metrics from Elastic Cloud](https://discuss.elastic.co/t/elasticsearch-exporter-metrics-from-elastic-cloud/272546)
**Author:** [@dimitris\_sb](https://discuss.elastic.co/u/dimitris_sb)\ **Replies:** 0\ **Last updated:** [May 10, 2021, 7:47am UTC](https://discuss.elastic.co/t/elasticsearch-exporter-metrics-from-elastic-cloud/272546 "2021-05-10T07:47:07Z")
Hi All, We noticed that when using elasticsearch exporter for prometheus only the hot nodes in Elastic Cloud clusters report their metrics. How can we target the warm and cold (etc.) nodes? Thank you in advance! --- ## [Reimporting data at the start of a project](https://discuss.elastic.co/t/reimporting-data-at-the-start-of-a-project/272541)
**Author:** [@lachlan.simpson](https://discuss.elastic.co/u/lachlan.simpson)\ **Replies:** 1\ **Last updated:** [May 10, 2021, 6:54am UTC](https://discuss.elastic.co/t/reimporting-data-at-the-start-of-a-project/272541 "2021-05-10T06:54:41Z")
Have just finished the proof of concept (and learning) stage of ELK 7.12.1 installation. At the moment we are using a relatively simple filebeat-\>logstash-\>elasticsearch-\>kibana set up. During that process, I made some… --- ## [Restrict the fields from being updated](https://discuss.elastic.co/t/restrict-the-fields-from-being-updated/272264)
**Author:** [@Deepti](https://discuss.elastic.co/u/Deepti)\ **Replies:** 9\ **Last updated:** [May 10, 2021, 6:21am UTC](https://discuss.elastic.co/t/restrict-the-fields-from-being-updated/272264 "2021-05-10T06:21:35Z")
Hi , Is there a way to restrict the updation of a particular field while indexing a document. For example I have a field 'name' which is of type text and I index a document , next time I try to change this 'name' eithe… --- ## [Google Cloud Traffic Filters](https://discuss.elastic.co/t/google-cloud-traffic-filters/272323)
**Author:** [@Alfredo1](https://discuss.elastic.co/u/Alfredo1)\ **Replies:** 2\ **Last updated:** [May 10, 2021, 3:39am UTC](https://discuss.elastic.co/t/google-cloud-traffic-filters/272323 "2021-05-10T03:39:48Z")
Hi. I see Google Cloud regions in the traffic filter private link endpoint setup section of my Elastic Cloud console. From docs, it appears that Google Cloud is not supported for traffic filter private links, but I want… --- ## [How to change the \_routing field](https://discuss.elastic.co/t/how-to-change-the-routing-field/272488)
**Author:** [@Anyzm](https://discuss.elastic.co/u/Anyzm)\ **Replies:** 3\ **Last updated:** [May 10, 2021, 2:28am UTC](https://discuss.elastic.co/t/how-to-change-the-routing-field/272488 "2021-05-10T02:28:09Z")
i create the index： PUT mobile\_info/?pretty { "settings": { "number\_of\_shards": 5, "number\_of\_replicas": 1 }, "mappings": { "info": { "\_routing":{ "required":"true" }, "properties": { "cust\_no": { "type": "… --- ## [\[Suggestion\] Runtime fields and enriching](https://discuss.elastic.co/t/suggestion-runtime-fields-and-enriching/272402)
**Author:** [@nemhods](https://discuss.elastic.co/u/nemhods)\ **Replies:** 1\ **Last updated:** [May 10, 2021, 1:03am UTC](https://discuss.elastic.co/t/suggestion-runtime-fields-and-enriching/272402 "2021-05-10T01:03:26Z")
Hey, I've been playing around with runtime fields, and the feature is looking promising. Something that's not possible right now, but I think would be very helpful: The ability to use enrich policies with runtime fiel… --- ## [Elasticsearch Query Alert](https://discuss.elastic.co/t/elasticsearch-query-alert/272524)
**Author:** [@111387](https://discuss.elastic.co/u/111387)\ **Replies:** 0\ **Last updated:** [May 10, 2021, 12:56am UTC](https://discuss.elastic.co/t/elasticsearch-query-alert/272524 "2021-05-10T00:56:22Z")
I want to create an Alert for a Surikata event. What I want is to generate an alert according to correlation for multiple documents. The problem is that elastalert, KQL, and DSL also seem impossible to query this way. … --- ## [Running elasticsearch 6.x with arm64 architecture](https://discuss.elastic.co/t/running-elasticsearch-6-x-with-arm64-architecture/272287)
**Author:** [@Yugansh\_Marwah](https://discuss.elastic.co/u/Yugansh_Marwah)\ **Replies:** 1\ **Last updated:** [May 10, 2021, 12:46am UTC](https://discuss.elastic.co/t/running-elasticsearch-6-x-with-arm64-architecture/272287 "2021-05-10T00:46:13Z")
We have our application built on elastic 6.x (to be precise 6.8.15), for local development how can we support Elastic 6.x in docker for arm64 architecture, as migration to 7.x and respective library currently is not a fe… --- ## [ES does not push logs to customized \_type . it push logs for \_doc](https://discuss.elastic.co/t/es-does-not-push-logs-to-customized-type-it-push-logs-for-doc/272320)
**Author:** [@Dhiraj](https://discuss.elastic.co/u/Dhiraj)\ **Replies:** 1\ **Last updated:** [May 10, 2021, 12:39am UTC](https://discuss.elastic.co/t/es-does-not-push-logs-to-customized-type-it-push-logs-for-doc/272320 "2021-05-10T00:39:34Z")
we have lots of indexes. some have "\_type" : "logs" & some have "\_type" : "log event" . It pushes logs every month after creating an index with the required \_type. but suddenly it was stopped pushing logs to customized … --- ## [Any Gotcha's I should be aware of when upgrading Docker Cluster Installs](https://discuss.elastic.co/t/any-gotchas-i-should-be-aware-of-when-upgrading-docker-cluster-installs/272371)
**Author:** [@cis4life](https://discuss.elastic.co/u/cis4life)\ **Replies:** 0\ **Last updated:** [May 7, 2021, 6:17am UTC](https://discuss.elastic.co/t/any-gotchas-i-should-be-aware-of-when-upgrading-docker-cluster-installs/272371 "2021-05-07T06:17:26Z")
Hello, I currently have 2 Docker Clusters that are running ES 6.5.1 There are some newer features the team wants to use that in the later / latest version of ES. We have our compose files working and our ES 6.5.1 Dock… --- ## [Recommendation for number of master nodes in a large cluster having 250 data nodes](https://discuss.elastic.co/t/recommendation-for-number-of-master-nodes-in-a-large-cluster-having-250-data-nodes/272510)
**Author:** [@Praveen\_Atluri](https://discuss.elastic.co/u/Praveen_Atluri)\ **Replies:** 4\ **Last updated:** [May 10, 2021, 12:15am UTC](https://discuss.elastic.co/t/recommendation-for-number-of-master-nodes-in-a-large-cluster-having-250-data-nodes/272510 "2021-05-10T00:15:20Z")
Hi All, Is there any recommendation for how many master nodes must be there for a large cluster containing 250 data nodes? When we monitor the thread pool of each data node in the cluster, I see some tasks that are re… --- ## [Elasticsearch node stats write threadpool](https://discuss.elastic.co/t/elasticsearch-node-stats-write-threadpool/272516)
**Author:** [@Praveen\_Atluri](https://discuss.elastic.co/u/Praveen_Atluri)\ **Replies:** 1\ **Last updated:** [May 9, 2021, 6:49pm UTC](https://discuss.elastic.co/t/elasticsearch-node-stats-write-threadpool/272516 "2021-05-09T18:49:55Z")
When I checked the node stats for some of my nodes, I see below for write thread pool. "write" : { "threads" : 8, "queue" : 13, "active" : 8, "rejected" : 19958, "large… --- ## [Index lifecycle error](https://discuss.elastic.co/t/index-lifecycle-error/271200)
**Author:** [@alfredo.deluca](https://discuss.elastic.co/u/alfredo.deluca)\ **Replies:** 4\ **Last updated:** [May 9, 2021, 5:52pm UTC](https://discuss.elastic.co/t/index-lifecycle-error/271200 "2021-05-09T17:52:27Z")
Hi all. We have elastic cloud 7.12 I am getting the following errors on the lifecycle for all the new policy I ve put in place. Any idea? illegal\_argument\_exception: setting \[index.lifecycle.rollover\_alias\] for index … --- ## [How to do log rotation in Elastic Search](https://discuss.elastic.co/t/how-to-do-log-rotation-in-elastic-search/272442)
**Author:** [@german\_83](https://discuss.elastic.co/u/german_83)\ **Replies:** 1\ **Last updated:** [May 9, 2021, 2:34pm UTC](https://discuss.elastic.co/t/how-to-do-log-rotation-in-elastic-search/272442 "2021-05-09T14:34:07Z")
Hi all, I have setup a deployment for elasticsearch and I been able to make it work with winlogbeat to capture specific events, But I'm not sure how to rotate the logs with the index lifecycle management policies I'm no… --- ## [Patterns, Best Practices.... for Ingesting large SQL multi-table/multi-relationship data into ES](https://discuss.elastic.co/t/patterns-best-practices-for-ingesting-large-sql-multi-table-multi-relationship-data-into-es/272498)
**Author:** [@lbi2000](https://discuss.elastic.co/u/lbi2000)\ **Replies:** 0\ **Last updated:** [May 9, 2021, 11:55am UTC](https://discuss.elastic.co/t/patterns-best-practices-for-ingesting-large-sql-multi-table-multi-relationship-data-into-es/272498 "2021-05-09T11:55:44Z")
Hi All. Great product. Keep up the great work please and continue to "push" into use cases not just for focus of log analysis...but please push the envelope for those like my project that have dumped SQL databases for … --- ## [How to add data\_hot node type to es cluster using helm?](https://discuss.elastic.co/t/how-to-add-data-hot-node-type-to-es-cluster-using-helm/272495)
**Author:** [@fahem](https://discuss.elastic.co/u/fahem)\ **Replies:** 0\ **Last updated:** [May 9, 2021, 10:11am UTC](https://discuss.elastic.co/t/how-to-add-data-hot-node-type-to-es-cluster-using-helm/272495 "2021-05-09T10:11:50Z")
Hello, I would like to add data\_hot node type to my es cluster (not just data node), i saw https://github.com/elastic/helm-charts/blob/master/elasticsearch/examples/multi/data.yaml page but it implements data node onl… --- ## [Kibana Slow Response After Enabling ELK Security](https://discuss.elastic.co/t/kibana-slow-response-after-enabling-elk-security/271182)
**Author:** [@k.karami](https://discuss.elastic.co/u/k.karami)\ **Replies:** 1\ **Last updated:** [May 9, 2021, 5:37am UTC](https://discuss.elastic.co/t/kibana-slow-response-after-enabling-elk-security/271182 "2021-05-09T05:37:53Z")
Hi, We have a basic license single node cluster (elastic 7.12.0 and kibana 7.12.0 ) on premise running on docker in a Linux node using http ( http://localhost:9200 and http://localhost:5601 ). Couple of weeks ago I en… --- ## [Kibana Monitoring Issue and Sharding Problem](https://discuss.elastic.co/t/kibana-monitoring-issue-and-sharding-problem/271219)
**Author:** [@Farid\_N](https://discuss.elastic.co/u/Farid_N)\ **Replies:** 13\ **Last updated:** [May 8, 2021, 8:36am UTC](https://discuss.elastic.co/t/kibana-monitoring-issue-and-sharding-problem/271219 "2021-05-08T08:36:37Z")
Hi there I have 2 problems which is probably related to each other: I have a basic cluster with 2 nodes of data. But my status is always "Yellow" and these 2nodes can not divide the primary shards and replicas: So I … --- ## [Dynamically add keyword field to text field](https://discuss.elastic.co/t/dynamically-add-keyword-field-to-text-field/272427)
**Author:** [@peterol](https://discuss.elastic.co/u/peterol)\ **Replies:** 1\ **Last updated:** [May 8, 2021, 6:47pm UTC](https://discuss.elastic.co/t/dynamically-add-keyword-field-to-text-field/272427 "2021-05-08T18:47:47Z")
Hello everyone, I have various fields i want to index as text and keyword from Logstash. I'm using an index template with static mappings to define data types and analyzers for my fields that look like these: "field.n… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=648) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=650)