# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=656 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 657 --- ## [Logstash Ouptut to Elasticsearch when one node is down](https://discuss.elastic.co/t/logstash-ouptut-to-elasticsearch-when-one-node-is-down/270876)
**Author:** [@linfordwoode](https://discuss.elastic.co/u/linfordwoode)\ **Replies:** 6\ **Last updated:** [April 28, 2021, 1:52pm UTC](https://discuss.elastic.co/t/logstash-ouptut-to-elasticsearch-when-one-node-is-down/270876 "2021-04-28T13:52:52Z")
Logstash sending output to three ES nodes. When one ES node is down, Logstash doesn't forward specific outputs to other nodes, probably because the dead node was receiving the output. For example, in the Logstash conf be… --- ## [ES index goes read-only without the node reaching the disk watermark](https://discuss.elastic.co/t/es-index-goes-read-only-without-the-node-reaching-the-disk-watermark/271502)
**Author:** [@Bence\_Ver](https://discuss.elastic.co/u/Bence_Ver)\ **Replies:** 0\ **Last updated:** [April 28, 2021, 11:24am UTC](https://discuss.elastic.co/t/es-index-goes-read-only-without-the-node-reaching-the-disk-watermark/271502 "2021-04-28T11:24:30Z")
We are running an ELK cluster (v7.11.2) in kubernetes, and we noticed that the cluster went read-only without the underlying node reaching the disk watermark. We don't see any trace of error in the ES logs, and neither a… --- ## [Elasticsearch 7.12 cluster 3 node installation](https://discuss.elastic.co/t/elasticsearch-7-12-cluster-3-node-installation/271480)
**Author:** [@cuongnp](https://discuss.elastic.co/u/cuongnp)\ **Replies:** 2\ **Last updated:** [April 28, 2021, 10:37am UTC](https://discuss.elastic.co/t/elasticsearch-7-12-cluster-3-node-installation/271480 "2021-04-28T10:37:49Z")
Hi all, I tried to setup 3 Elasticsearch nodes with configuration below file /etc/hosts (on 3 nodes) elasticsearch.yml NODE 1 (master-1) cluster.name: es-cluster node.name: "master-1" node.master: true node.d… --- ## [Esrally test results, I want to see the test results about the query, thank you](https://discuss.elastic.co/t/esrally-test-results-i-want-to-see-the-test-results-about-the-query-thank-you/271496)
**Author:** [@rui.chen](https://discuss.elastic.co/u/rui.chen)\ **Replies:** 0\ **Last updated:** [April 28, 2021, 10:19am UTC](https://discuss.elastic.co/t/esrally-test-results-i-want-to-see-the-test-results-about-the-query-thank-you/271496 "2021-04-28T10:19:29Z")
this is test command esrally race --track=geonames --challenge=append-no-conflicts --offline --pipeline=benchmark-only --target-hosts=172.31.1.21:9200,172.31.1.30:9200,172.31.1.249:9200 test result | … --- ## [Version conflict while restarting cluster node](https://discuss.elastic.co/t/version-conflict-while-restarting-cluster-node/271484)
**Author:** [@thomasixo](https://discuss.elastic.co/u/thomasixo)\ **Replies:** 0\ **Last updated:** [April 28, 2021, 8:44am UTC](https://discuss.elastic.co/t/version-conflict-while-restarting-cluster-node/271484 "2021-04-28T08:44:20Z")
Hi, i have an elasticsearch cluster with 4 nodes. I have a datastream with the name "log\_data", which have configured 2 shards and 1 replica. I have a test script, which creates in an endless loop new documents to thi… --- ## [Ilm in elstic cloud does not move the indexes from hot nodes to warm nodes](https://discuss.elastic.co/t/ilm-in-elstic-cloud-does-not-move-the-indexes-from-hot-nodes-to-warm-nodes/271076)
**Author:** [@zozo6015](https://discuss.elastic.co/u/zozo6015)\ **Replies:** 3\ **Last updated:** [April 28, 2021, 8:50am UTC](https://discuss.elastic.co/t/ilm-in-elstic-cloud-does-not-move-the-indexes-from-hot-nodes-to-warm-nodes/271076 "2021-04-28T08:50:28Z")
Hello, I have set ilm rules to move hot indexes to warm indexes and move them into warm node. Now all my indexes are located on the hot nodes and eate up all my disk while the warm node are free and not doing anything h… --- ## [Avoid index ballooning by updates and deletes](https://discuss.elastic.co/t/avoid-index-ballooning-by-updates-and-deletes/271233)
**Author:** [@YvorL](https://discuss.elastic.co/u/YvorL)\ **Replies:** 6\ **Last updated:** [April 28, 2021, 8:43am UTC](https://discuss.elastic.co/t/avoid-index-ballooning-by-updates-and-deletes/271233 "2021-04-28T08:43:48Z")
Hi, I'm struggling with having an index that has some fields that are frequently updated and documents that are deleted. I want to avoid ballooning the index for obvious reasons. I tried to go with freezing the index a… --- ## [Reindex from 2.x to elastic 5.x](https://discuss.elastic.co/t/reindex-from-2-x-to-elastic-5-x/271333)
**Author:** [@lmrc](https://discuss.elastic.co/u/lmrc)\ **Replies:** 2\ **Last updated:** [April 28, 2021, 8:24am UTC](https://discuss.elastic.co/t/reindex-from-2-x-to-elastic-5-x/271333 "2021-04-28T08:24:36Z")
Good morning everyone, I am trying to upgrade elasticsearch with graylog to the newest version. Currently I have the elasticsearch indexes in version 1.7, I can read them from elasticsearch 2.x but I need to reindex to … --- ## [Is GCE Discovery still a thing?](https://discuss.elastic.co/t/is-gce-discovery-still-a-thing/271363)
**Author:** [@ppuschmann](https://discuss.elastic.co/u/ppuschmann)\ **Replies:** 7\ **Last updated:** [April 28, 2021, 8:06am UTC](https://discuss.elastic.co/t/is-gce-discovery-still-a-thing/271363 "2021-04-28T08:06:37Z")
Hi there, currently I'm investigating if it was sensible to enable the GCE-discovery in Elasticsearch. According to this (older) thread, there are some hints about documentation and possibly implementation being outdat… --- ## [Unable setup password for 3 nodes cluster](https://discuss.elastic.co/t/unable-setup-password-for-3-nodes-cluster/271481)
**Author:** [@overbid](https://discuss.elastic.co/u/overbid)\ **Replies:** 0\ **Last updated:** [April 28, 2021, 8:04am UTC](https://discuss.elastic.co/t/unable-setup-password-for-3-nodes-cluster/271481 "2021-04-28T08:04:44Z")
I use podman to deploy 3 nodes cluster in 3 machines. version: "3" services: es01: image: docker.elastic.co/elasticsearch/elasticsearch:7.12.0 container\_name: es01 environment: - node.name=es01 … --- ## [Completed handshake with but follow up connection failed](https://discuss.elastic.co/t/completed-handshake-with-but-follow-up-connection-failed/271353)
**Author:** [@overbid](https://discuss.elastic.co/u/overbid)\ **Replies:** 3\ **Last updated:** [April 27, 2021, 11:15am UTC](https://discuss.elastic.co/t/completed-handshake-with-but-follow-up-connection-failed/271353 "2021-04-27T11:15:57Z")
I'm trying to install via podman compose in 3 machines on AWS EC2 version: "3" services: es01: image: docker.elastic.co/elasticsearch/elasticsearch:7.12.0 container\_name: es01 environment: - node.nam… --- ## [Conditional with chinese character in ingest issue](https://discuss.elastic.co/t/conditional-with-chinese-character-in-ingest-issue/271475)
**Author:** [@tbs575](https://discuss.elastic.co/u/tbs575)\ **Replies:** 0\ **Last updated:** [April 28, 2021, 7:40am UTC](https://discuss.elastic.co/t/conditional-with-chinese-character-in-ingest-issue/271475 "2021-04-28T07:40:02Z")
Elasticsearch 7.12, filebeat get log message then send to elasticsearch. messages with keyword '上报请求信息' include json data, I created ingest with condition try to get these json data, the following is my ingest content. … --- ## [JVM heap spikes on data node](https://discuss.elastic.co/t/jvm-heap-spikes-on-data-node/270870)
**Author:** [@radovan](https://discuss.elastic.co/u/radovan)\ **Replies:** 10\ **Last updated:** [April 28, 2021, 7:39am UTC](https://discuss.elastic.co/t/jvm-heap-spikes-on-data-node/270870 "2021-04-28T07:39:56Z")
Hello, I'm not really educated in this topic, but when I first saw this log in our logstash: \[2021-04-15T14:11:47,605\]\[INFO \]\[logstash.outputs.elasticsearch\]\[beats-monitoring-crypto\]\[3228c43cca49b666651ceb4c7945f188f5… --- ## [Most optimal ElasticSearch](https://discuss.elastic.co/t/most-optimal-elasticsearch/271445)
**Author:** [@ekrx](https://discuss.elastic.co/u/ekrx)\ **Replies:** 6\ **Last updated:** [April 28, 2021, 5:16am UTC](https://discuss.elastic.co/t/most-optimal-elasticsearch/271445 "2021-04-28T05:16:12Z")
This is a very ambiguous question since I don't know exactly where to start. We require the most optimized ES performance for a mission critical system. Currently our ES queries are taking somewhere around 100-200 ms to … --- ## [Unable to create very simple runtime mapping](https://discuss.elastic.co/t/unable-to-create-very-simple-runtime-mapping/271307)
**Author:** [@Sam\_Critchley](https://discuss.elastic.co/u/Sam_Critchley)\ **Replies:** 1\ **Last updated:** [April 28, 2021, 4:48am UTC](https://discuss.elastic.co/t/unable-to-create-very-simple-runtime-mapping/271307 "2021-04-28T04:48:04Z")
Hi. I'm trying to define a mapping for a transform. But any attempt to read the field I want to examine results in "Bad Request: \[script\_exception\] runtime error". { "target\_id": { "type": "keywo… --- ## [Moving From ES 5.x to 7.x and OS Upgrade](https://discuss.elastic.co/t/moving-from-es-5-x-to-7-x-and-os-upgrade/270979)
**Author:** [@cis4life](https://discuss.elastic.co/u/cis4life)\ **Replies:** 6\ **Last updated:** [April 28, 2021, 3:32am UTC](https://discuss.elastic.co/t/moving-from-es-5-x-to-7-x-and-os-upgrade/270979 "2021-04-28T03:32:39Z")
Good Morning, I have a clustered ES 5.x environment that I need to do a few things. 1.) Upgrade the Server OS from Ubuntu 16.04 to 18.04 possibly 20.04. When we attempted this last week, we tried to upgrade by using..… --- ## [Marking index location in read only mode](https://discuss.elastic.co/t/marking-index-location-in-read-only-mode/271416)
**Author:** [@Abhishek\_Shinde](https://discuss.elastic.co/u/Abhishek_Shinde)\ **Replies:** 5\ **Last updated:** [April 28, 2021, 3:29am UTC](https://discuss.elastic.co/t/marking-index-location-in-read-only-mode/271416 "2021-04-28T03:29:38Z")
I wanted to know, how to close existing index location (ready-only mode) and open new index location for writing the index data? Consider a use case that, I want to chage my storage type in which old data will remain on … --- ## [TCP connection limit of Elasticsearch](https://discuss.elastic.co/t/tcp-connection-limit-of-elasticsearch/271454)
**Author:** [@iammanmale](https://discuss.elastic.co/u/iammanmale)\ **Replies:** 0\ **Last updated:** [April 28, 2021, 3:28am UTC](https://discuss.elastic.co/t/tcp-connection-limit-of-elasticsearch/271454 "2021-04-28T03:28:26Z")
We harvest logs on aws machines by filebeat. Filebeat on each machine push those log to local logstash nodes and then logstash nodes push the data to local Elasticsearch nodes. It seems to me that both logstash node and… --- ## [Missing Authentication Credentials for REST Request](https://discuss.elastic.co/t/missing-authentication-credentials-for-rest-request/271158)
**Author:** [@hussshe](https://discuss.elastic.co/u/hussshe)\ **Replies:** 1\ **Last updated:** [April 28, 2021, 1:40am UTC](https://discuss.elastic.co/t/missing-authentication-credentials-for-rest-request/271158 "2021-04-28T01:40:25Z")
Hello Elastic Users, I am trying to check if my Elasticsearch is working fine or not by running the following command in WindowsPowershell. Invoke-RestMethod http://localhost:9200 But it threw an 401-Authentication er… --- ## [Master not discovered or elected yet, an election requires 2 nodes with ids](https://discuss.elastic.co/t/master-not-discovered-or-elected-yet-an-election-requires-2-nodes-with-ids/271435)
**Author:** [@spartin07](https://discuss.elastic.co/u/spartin07)\ **Replies:** 1\ **Last updated:** [April 28, 2021, 1:22am UTC](https://discuss.elastic.co/t/master-not-discovered-or-elected-yet-an-election-requires-2-nodes-with-ids/271435 "2021-04-28T01:22:48Z")
I am trying to enable SSL/TLS for my elasticsearch cluster using docker and docker-compose. My setup is 3 seperate machines all with a single elasticsearch node running on them. For the certificates I created them on a s… --- ## [Elastic Search 7.12 Java CPU useage](https://discuss.elastic.co/t/elastic-search-7-12-java-cpu-useage/270996)
**Author:** [@PublicName](https://discuss.elastic.co/u/PublicName)\ **Replies:** 4\ **Last updated:** [April 28, 2021, 12:29am UTC](https://discuss.elastic.co/t/elastic-search-7-12-java-cpu-useage/270996 "2021-04-28T00:29:16Z")
1 x3 node cluster 2 stand alone nodes all showing the same signs. Elastic+ Java process is running at 100% CPU. CentOS 8. Anyone else running into the issue. The same machines have been fine with the CPU and memory sin… --- ## [Minimum nodes for elasticsearch 7.11.2 cluster?](https://discuss.elastic.co/t/minimum-nodes-for-elasticsearch-7-11-2-cluster/271023)
**Author:** [@webfr](https://discuss.elastic.co/u/webfr)\ **Replies:** 15\ **Last updated:** [April 27, 2021, 9:31pm UTC](https://discuss.elastic.co/t/minimum-nodes-for-elasticsearch-7-11-2-cluster/271023 "2021-04-27T21:31:33Z")
Hello, I'm using standalone ES node at the moment. I would like to add another node in another datacenter to increase data resilience and use cluster functions. Is it possible with just another node? Any documentation … --- ## [In house testing for cloud vs self hosted before self hosted release](https://discuss.elastic.co/t/in-house-testing-for-cloud-vs-self-hosted-before-self-hosted-release/271429)
**Author:** [@cealliance](https://discuss.elastic.co/u/cealliance)\ **Replies:** 1\ **Last updated:** [April 27, 2021, 8:15pm UTC](https://discuss.elastic.co/t/in-house-testing-for-cloud-vs-self-hosted-before-self-hosted-release/271429 "2021-04-27T20:15:48Z")
I am looking to test integration with keycloak, and other features that require a higher tier license. Cloud licenses are cheaper. Can I get away with testing/developing on a cloud server and applying my findings to th… --- ## [Date Histogram Aggregation with Empty Days](https://discuss.elastic.co/t/date-histogram-aggregation-with-empty-days/271436)
**Author:** [@TomTom](https://discuss.elastic.co/u/TomTom)\ **Replies:** 2\ **Last updated:** [April 27, 2021, 8:10pm UTC](https://discuss.elastic.co/t/date-histogram-aggregation-with-empty-days/271436 "2021-04-27T20:10:12Z")
With the Date Histogram Aggregation is it possible to return a complete list of days, even if none of them have found results? I am using a query to look for sales that occurred in a range of days, but in some cases the… --- ## [Filter by count of inner\_hits?](https://discuss.elastic.co/t/filter-by-count-of-inner-hits/271298)
**Author:** [@bkazez](https://discuss.elastic.co/u/bkazez)\ **Replies:** 1\ **Last updated:** [April 27, 2021, 7:16pm UTC](https://discuss.elastic.co/t/filter-by-count-of-inner-hits/271298 "2021-04-27T19:16:36Z")
I'm using ES to search movements of baroque music, so someone can find e.g. music for flute, violin, and soprano or for 2 violins and soprano. The following works: Multilingual instrument names flûte à bec should find… --- ## [Need help aggregating strings from logs](https://discuss.elastic.co/t/need-help-aggregating-strings-from-logs/271428)
**Author:** [@nitishj](https://discuss.elastic.co/u/nitishj)\ **Replies:** 0\ **Last updated:** [April 27, 2021, 6:12pm UTC](https://discuss.elastic.co/t/need-help-aggregating-strings-from-logs/271428 "2021-04-27T18:12:03Z")
I wish to create a dashboard with a dataset consisting of 3 variables out of which I want to see average values of 2 (after theyr're grouped the third variable). For example, I would like to see the solverObjVal and Solv… --- ## [Can Elasticsearch on Kubernetes safely reuse data from PVs that were detached after a node went down?](https://discuss.elastic.co/t/can-elasticsearch-on-kubernetes-safely-reuse-data-from-pvs-that-were-detached-after-a-node-went-down/271207)
**Author:** [@mattwelke](https://discuss.elastic.co/u/mattwelke)\ **Replies:** 3\ **Last updated:** [April 27, 2021, 3:52pm UTC](https://discuss.elastic.co/t/can-elasticsearch-on-kubernetes-safely-reuse-data-from-pvs-that-were-detached-after-a-node-went-down/271207 "2021-04-27T15:52:51Z")
I'm looking into different ways to deploy Elasticsearch on Kubernetes. My understanding so far is that it's normal to use the ECK operator pattern to deploy if you're deploying to Kubernetes, and that this causes Statef… --- ## [Can I trust a PIT id once it has been replaced by a new PIT id?](https://discuss.elastic.co/t/can-i-trust-a-pit-id-once-it-has-been-replaced-by-a-new-pit-id/271054)
**Author:** [@Snav](https://discuss.elastic.co/u/Snav)\ **Replies:** 4\ **Last updated:** [April 27, 2021, 3:39pm UTC](https://discuss.elastic.co/t/can-i-trust-a-pit-id-once-it-has-been-replaced-by-a-new-pit-id/271054 "2021-04-27T15:39:06Z")
Hello there, I was wondering how the Point In Time works internally and if it is trustable for parallelization. Context Given this implementation: I have a search request to retrieve a list of offers. It may return … --- ## [Mapping template field with keyword suffix](https://discuss.elastic.co/t/mapping-template-field-with-keyword-suffix/270989)
**Author:** [@benschiefer](https://discuss.elastic.co/u/benschiefer)\ **Replies:** 2\ **Last updated:** [April 27, 2021, 2:55pm UTC](https://discuss.elastic.co/t/mapping-template-field-with-keyword-suffix/270989 "2021-04-27T14:55:55Z")
Hello, I am currently running into an issue where I am hitting the max fields for an index. In order to address this issue, I am defining mapping types for the different fields in my index. Many of the fields in my cu… --- ## [Rollup Error](https://discuss.elastic.co/t/rollup-error/271109)
**Author:** [@hsalim](https://discuss.elastic.co/u/hsalim)\ **Replies:** 3\ **Last updated:** [April 27, 2021, 2:26pm UTC](https://discuss.elastic.co/t/rollup-error/271109 "2021-04-27T14:26:22Z")
Hello, I am using rollups, and now encountering following error. Any help is appreciated. Thanks. ' Rollup job failed with an exception: java.lang.NullPointerException: Cannot invoke "org.elasticsearch.search.aggreg… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=655) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=657)