# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=657 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 658 --- ## [Results are not changed after index updating](https://discuss.elastic.co/t/results-are-not-changed-after-index-updating/271119)
**Author:** [@guilherme\_maranhao](https://discuss.elastic.co/u/guilherme_maranhao)\ **Replies:** 2\ **Last updated:** [April 27, 2021, 1:59pm UTC](https://discuss.elastic.co/t/results-are-not-changed-after-index-updating/271119 "2021-04-27T13:59:41Z")
Hi everyone, I have a bool query: from: 0, size: 10, query: { bool: { must: \[ { term: { boolean\_field: false } }, { term: { integer\_field: \*something\* } }, … --- ## [Forward Logs from Elasticsearch to external destination application](https://discuss.elastic.co/t/forward-logs-from-elasticsearch-to-external-destination-application/271021)
**Author:** [@vishakh](https://discuss.elastic.co/u/vishakh)\ **Replies:** 7\ **Last updated:** [April 27, 2021, 1:59pm UTC](https://discuss.elastic.co/t/forward-logs-from-elasticsearch-to-external-destination-application/271021 "2021-04-27T13:59:34Z")
I'm looking to forward already stored logs from Elasticsearch to an external application-source. We're quite aware that we could leverage Logstash to distribute/split the new future-incoming logs between Elasticsearch a… --- ## [How can I set new shard and replica number with re-index?](https://discuss.elastic.co/t/how-can-i-set-new-shard-and-replica-number-with-re-index/271337)
**Author:** [@RusseL](https://discuss.elastic.co/u/RusseL)\ **Replies:** 1\ **Last updated:** [April 27, 2021, 1:53pm UTC](https://discuss.elastic.co/t/how-can-i-set-new-shard-and-replica-number-with-re-index/271337 "2021-04-27T13:53:51Z")
I have an index consisting of 40 shards and I want to make 50 shards with reindex. How can I determine the new shard and replica number with the reindex? --- ## [Pushing Distinct values from an index to another index](https://discuss.elastic.co/t/pushing-distinct-values-from-an-index-to-another-index/271318)
**Author:** [@CSehra](https://discuss.elastic.co/u/CSehra)\ **Replies:** 3\ **Last updated:** [April 27, 2021, 1:51pm UTC](https://discuss.elastic.co/t/pushing-distinct-values-from-an-index-to-another-index/271318 "2021-04-27T13:51:25Z")
Is there a way to push distinct values of a field from indexA to a new indexB on a regular basis(daily or monthly)? Use Case: I want to create indexB from one of the fields of indexA, and on a daily basis do an update o… --- ## [Field analyzer ignored on query string regex - 7.10.2](https://discuss.elastic.co/t/field-analyzer-ignored-on-query-string-regex-7-10-2/271375)
**Author:** [@korali](https://discuss.elastic.co/u/korali)\ **Replies:** 0\ **Last updated:** [April 27, 2021, 12:45pm UTC](https://discuss.elastic.co/t/field-analyzer-ignored-on-query-string-regex-7-10-2/271375 "2021-04-27T12:45:39Z")
Hey, I search with query of type query\_string with regex and when I try to run the same code in elasticsearch 7.1.1 and elasticsearch 7.10.2 I get different results Index Mapping&Settings PUT index\_name … --- ## [Failed to start Elasticsearch](https://discuss.elastic.co/t/failed-to-start-elasticsearch/271251)
**Author:** [@Rizky\_Hudha](https://discuss.elastic.co/u/Rizky_Hudha)\ **Replies:** 9\ **Last updated:** [April 27, 2021, 12:11pm UTC](https://discuss.elastic.co/t/failed-to-start-elasticsearch/271251 "2021-04-27T12:11:16Z")
hello, I have a problem regarding elasticsearch, where to start, the error "Failed to start Elasticsearch" always appears, please help to solve my error, thank you Apr 27 02:48:09 bigdata systemd\[1\]: Unit elasticsearch.… --- ## [Big mapping and few fields on index](https://discuss.elastic.co/t/big-mapping-and-few-fields-on-index/270999)
**Author:** [@pereyrdi](https://discuss.elastic.co/u/pereyrdi)\ **Replies:** 2\ **Last updated:** [April 27, 2021, 12:03pm UTC](https://discuss.elastic.co/t/big-mapping-and-few-fields-on-index/270999 "2021-04-27T12:03:06Z")
Hello folks! A question about index template, because Im creating a template for many indexs and not in alls indexs, all fields available in template are used. In some case less than ten, and in template are available a… --- ## [Two-node graylog+elasticsearch failover cluster](https://discuss.elastic.co/t/two-node-graylog-elasticsearch-failover-cluster/271355)
**Author:** [@dunhillers](https://discuss.elastic.co/u/dunhillers)\ **Replies:** 5\ **Last updated:** [April 27, 2021, 11:29am UTC](https://discuss.elastic.co/t/two-node-graylog-elasticsearch-failover-cluster/271355 "2021-04-27T11:29:17Z")
Hi, I have deployed graylog+elastic on two servers (Centos 7.8). The goal: to create a failover cluster of two nodes with support for index replication. So that if one of the nodes falls, the indexes continue to be writt… --- ## [Elasticsearch terms aggregation with partition does not honor the “size” value](https://discuss.elastic.co/t/elasticsearch-terms-aggregation-with-partition-does-not-honor-the-size-value/271294)
**Author:** [@sayali\_hinge](https://discuss.elastic.co/u/sayali_hinge)\ **Replies:** 4\ **Last updated:** [April 27, 2021, 11:26am UTC](https://discuss.elastic.co/t/elasticsearch-terms-aggregation-with-partition-does-not-honor-the-size-value/271294 "2021-04-27T11:26:55Z")
I have a nested field in the ES index. I used the cardinality aggregation to get the total number of buckets and then came up with num\_partitions, and size values to fetch the buckets. E.g. the total number of term buck… --- ## [Very often FileSystemException : Operation not permitted](https://discuss.elastic.co/t/very-often-filesystemexception-operation-not-permitted/271079)
**Author:** [@rzrucher](https://discuss.elastic.co/u/rzrucher)\ **Replies:** 12\ **Last updated:** [April 27, 2021, 11:17am UTC](https://discuss.elastic.co/t/very-often-filesystemexception-operation-not-permitted/271079 "2021-04-27T11:17:48Z")
Hello, I've a cluster of elasticsearch 6.1.2 and very often in the elasticsearch log I've : \[2021-04-15T01:03:38,388\]\[WARN \]\[o.e.c.a.s.ShardStateAction\] \[ELK1\] \[events-202104\]\[2\] received shard failed for shard… --- ## [Master not discovered yet, this node has not previously joined a bootstrapped (v7+) cluster](https://discuss.elastic.co/t/master-not-discovered-yet-this-node-has-not-previously-joined-a-bootstrapped-v7-cluster/270797)
**Author:** [@overbid](https://discuss.elastic.co/u/overbid)\ **Replies:** 3\ **Last updated:** [April 27, 2021, 11:13am UTC](https://discuss.elastic.co/t/master-not-discovered-yet-this-node-has-not-previously-joined-a-bootstrapped-v7-cluster/270797 "2021-04-27T11:13:42Z")
I'm trying to install via podman compose in 3 machines version: "3" services: es01: image: docker.elastic.co/elasticsearch/elasticsearch:7.12.0 container\_name: es01 environment: … --- ## [Sort aggregation based on TopHits (ie top 10) average score](https://discuss.elastic.co/t/sort-aggregation-based-on-tophits-ie-top-10-average-score/271358)
**Author:** [@JF2018](https://discuss.elastic.co/u/JF2018)\ **Replies:** 1\ **Last updated:** [April 27, 2021, 10:31am UTC](https://discuss.elastic.co/t/sort-aggregation-based-on-tophits-ie-top-10-average-score/271358 "2021-04-27T10:31:02Z")
Hi I wish to be able to sort my buckets from a termAggregation, based on the scores of the top N documents in each bucket. I know how to sort by min/max/avg/sum score for all documents in a bucket (See example I furthe… --- ## [New warm nodes are getting filled fast](https://discuss.elastic.co/t/new-warm-nodes-are-getting-filled-fast/269417)
**Author:** [@prajwalgmpp](https://discuss.elastic.co/u/prajwalgmpp)\ **Replies:** 12\ **Last updated:** [April 27, 2021, 9:35am UTC](https://discuss.elastic.co/t/new-warm-nodes-are-getting-filled-fast/269417 "2021-04-27T09:35:28Z")
Hi All, In the beginning, we had 4 data nodes. Two were ilm designated hot nodes and the other two were warm nodes. Newly created indices would be in the hot nodes under the hot phase and after 4 weeks of retention, wou… --- ## [.kibana index template](https://discuss.elastic.co/t/kibana-index-template/271096)
**Author:** [@bentleg1](https://discuss.elastic.co/u/bentleg1)\ **Replies:** 4\ **Last updated:** [April 27, 2021, 7:08am UTC](https://discuss.elastic.co/t/kibana-index-template/271096 "2021-04-27T07:08:55Z")
Hello. I want to add several replicas for system .kibana index. I have created template. PUT \_template/kibana { "index\_patterns": ".kibana\*", "settings": { "number\_of\_replicas": "5" } } … --- ## [Shard allocation on cluster](https://discuss.elastic.co/t/shard-allocation-on-cluster/271323)
**Author:** [@bentleg1](https://discuss.elastic.co/u/bentleg1)\ **Replies:** 2\ **Last updated:** [April 27, 2021, 6:59am UTC](https://discuss.elastic.co/t/shard-allocation-on-cluster/271323 "2021-04-27T06:59:17Z")
Hi to all. Imagine that we have 4 data nodes. N1 and N2 placed on main data center and N3 and N4 placed in backup data center. How to configure shard allocation to place all primary shards on N1 and N2 nodes and all re… --- ## [Elasticsearch error license is not available](https://discuss.elastic.co/t/elasticsearch-error-license-is-not-available/271039)
**Author:** [@charles97](https://discuss.elastic.co/u/charles97)\ **Replies:** 2\ **Last updated:** [April 27, 2021, 6:08am UTC](https://discuss.elastic.co/t/elasticsearch-error-license-is-not-available/271039 "2021-04-27T06:08:34Z")
es: 7.12 os:CentOS7 java : java-1.8.0-openjdk.x86\_64 (/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.282.b08-1.el7\_9.x86\_64/jre/bin/java) My cluster used to had 2 node, this node as : master another node as : data-1. I deci… --- ## [Fetch Agent Status](https://discuss.elastic.co/t/fetch-agent-status/271313)
**Author:** [@Sathish22](https://discuss.elastic.co/u/Sathish22)\ **Replies:** 4\ **Last updated:** [April 27, 2021, 5:04am UTC](https://discuss.elastic.co/t/fetch-agent-status/271313 "2021-04-27T05:04:49Z")
Dear Team, Currently, we have a requirement to fetch the agent status from all servers, is there any way to fetch the agent status from all servers (Windows & Linux) and save it in elasticsearch. Please help me.!!! Th… --- ## [How to create a rollover policy in ILM which automatically moves historical indices into warm node and keeps last 2 quarter indices in hot nodes](https://discuss.elastic.co/t/how-to-create-a-rollover-policy-in-ilm-which-automatically-moves-historical-indices-into-warm-node-and-keeps-last-2-quarter-indices-in-hot-nodes/270957)
**Author:** [@sagar7645](https://discuss.elastic.co/u/sagar7645)\ **Replies:** 1\ **Last updated:** [April 27, 2021, 4:49am UTC](https://discuss.elastic.co/t/how-to-create-a-rollover-policy-in-ilm-which-automatically-moves-historical-indices-into-warm-node-and-keeps-last-2-quarter-indices-in-hot-nodes/270957 "2021-04-27T04:49:53Z")
Hi Team, I am using elasticsearch 7.9 need to create a rollover ILM policy to keep historical indices in warm node and last 2 quarter indices on hot node. Can you please suggest me how to do that in a ILM policy. Is it… --- ## [How to speed up the segment merging at night?](https://discuss.elastic.co/t/how-to-speed-up-the-segment-merging-at-night/271267)
**Author:** [@wangxr1985](https://discuss.elastic.co/u/wangxr1985)\ **Replies:** 2\ **Last updated:** [April 27, 2021, 3:22am UTC](https://discuss.elastic.co/t/how-to-speed-up-the-segment-merging-at-night/271267 "2021-04-27T03:22:16Z")
The ES version is 7.11.1 I use ilm to manage my log indices hot phase: rollover warm phase (12 hours from rollover): forcemerge、read only、data allocation cold phase (5 days from rollover): freeze delete phase(10 day… --- ## [Last query date for an index](https://discuss.elastic.co/t/last-query-date-for-an-index/270861)
**Author:** [@danielibars](https://discuss.elastic.co/u/danielibars)\ **Replies:** 1\ **Last updated:** [April 27, 2021, 2:56am UTC](https://discuss.elastic.co/t/last-query-date-for-an-index/270861 "2021-04-27T02:56:48Z")
Hi There! I'm trying to create a rule either ILM or programmatically to remove unused indices I'm interested on deleting an index that hasn't been queried in more than 30 days, the index contains static data (html page… --- ## [Issue with elasticsearch backup using GCS](https://discuss.elastic.co/t/issue-with-elasticsearch-backup-using-gcs/271239)
**Author:** [@722826c085cfc824006d](https://discuss.elastic.co/u/722826c085cfc824006d)\ **Replies:** 0\ **Last updated:** [April 26, 2021, 10:01am UTC](https://discuss.elastic.co/t/issue-with-elasticsearch-backup-using-gcs/271239 "2021-04-26T10:01:12Z")
We are running ES cluster as kuberntes pods in google cloud environment. We are planning to trigger the snapshots and need to store the data GCS bucket. As part of snapshot, we are creating the rep0, but the repo creat… --- ## [Replication of shards with more nodes vs parallel cluster](https://discuss.elastic.co/t/replication-of-shards-with-more-nodes-vs-parallel-cluster/271035)
**Author:** [@nchalise](https://discuss.elastic.co/u/nchalise)\ **Replies:** 1\ **Last updated:** [April 27, 2021, 1:35am UTC](https://discuss.elastic.co/t/replication-of-shards-with-more-nodes-vs-parallel-cluster/271035 "2021-04-27T01:35:36Z")
To reduce/mitigate downtime which approach is better and why? doubling the data/client nodes and having replication on the shards OR is it worth considering parallel clusters with a load balancer on the client nodes. Pl… --- ## [Deleted field, result is successfull, but field is still there](https://discuss.elastic.co/t/deleted-field-result-is-successfull-but-field-is-still-there/271287)
**Author:** [@NLSVTN](https://discuss.elastic.co/u/NLSVTN)\ **Replies:** 1\ **Last updated:** [April 27, 2021, 12:53am UTC](https://discuss.elastic.co/t/deleted-field-result-is-successfull-but-field-is-still-there/271287 "2021-04-27T00:53:45Z")
Hi, I am using Kibana for interacting with my indices. I have a field in \_source: '\_nisc\_AC' which I am trying to delete in the following way: POST grch38\_test\_\_wes\_\_grch38/\_update\_by\_query?conflicts=proceed { "scr… --- ## [Unable To Connect To theRemote Cluster](https://discuss.elastic.co/t/unable-to-connect-to-theremote-cluster/271210)
**Author:** [@yahooljy](https://discuss.elastic.co/u/yahooljy)\ **Replies:** 2\ **Last updated:** [April 27, 2021, 12:41am UTC](https://discuss.elastic.co/t/unable-to-connect-to-theremote-cluster/271210 "2021-04-27T00:41:00Z")
Hi there ! I Set up basic security for the Elastic Stack plus secured HTTPS traffic . and then my kibana can connect to the local cluster successfully . But there is something wrong with the connection between the localc… --- ## [\[Docker\] Using old data folder not working](https://discuss.elastic.co/t/docker-using-old-data-folder-not-working/271280)
**Author:** [@Bo-Wyatt](https://discuss.elastic.co/u/Bo-Wyatt)\ **Replies:** 3\ **Last updated:** [April 26, 2021, 4:59pm UTC](https://discuss.elastic.co/t/docker-using-old-data-folder-not-working/271280 "2021-04-26T16:59:38Z")
Hello, for some issues my Docker container with Elasticsearch has been re-created, this came with the lost of all my indexes (i have two nodes in my cluster and since the container was recreated, the cluster ID was gener… --- ## [Difference between results of two queries](https://discuss.elastic.co/t/difference-between-results-of-two-queries/270991)
**Author:** [@Askia\_Mohamed\_Kadri](https://discuss.elastic.co/u/Askia_Mohamed_Kadri)\ **Replies:** 4\ **Last updated:** [April 26, 2021, 2:40pm UTC](https://discuss.elastic.co/t/difference-between-results-of-two-queries/270991 "2021-04-26T14:40:26Z")
Hi! I'm stuck and I really need help. Here is my use case: I would like to perform two queries and get as final result the difference between those two queries based on a specific field. Let's assume that I have these … --- ## [Calculate time difference in scripted field](https://discuss.elastic.co/t/calculate-time-difference-in-scripted-field/271213)
**Author:** [@mangeshmj1992](https://discuss.elastic.co/u/mangeshmj1992)\ **Replies:** 18\ **Last updated:** [April 26, 2021, 2:22pm UTC](https://discuss.elastic.co/t/calculate-time-difference-in-scripted-field/271213 "2021-04-26T14:22:57Z")
The question is how to get the difference from following date format in a second? For example, if date1 = 4/21/2021 7:53:50 and date2 = 6/21/2021 7:54:10, the answer should 20 . I am trying below code but it is providi… --- ## [Relocation in loop on Elasticsearch 7.7](https://discuss.elastic.co/t/relocation-in-loop-on-elasticsearch-7-7/270486)
**Author:** [@dextermorgan](https://discuss.elastic.co/u/dextermorgan)\ **Replies:** 1\ **Last updated:** [April 26, 2021, 1:25pm UTC](https://discuss.elastic.co/t/relocation-in-loop-on-elasticsearch-7-7/270486 "2021-04-26T13:25:18Z")
We recently upgraded from ES 5.4 to ES 7.7 and are facing this weird issue in production where relocation goes in a loop. Have noticed majorly on large clusters and having hot/cold config. e.g. following is cluster confi… --- ## [Query to calculate login success and failure rates](https://discuss.elastic.co/t/query-to-calculate-login-success-and-failure-rates/270787)
**Author:** [@Venkatesh\_Sridharan](https://discuss.elastic.co/u/Venkatesh_Sridharan)\ **Replies:** 1\ **Last updated:** [April 26, 2021, 12:45pm UTC](https://discuss.elastic.co/t/query-to-calculate-login-success-and-failure-rates/270787 "2021-04-26T12:45:21Z")
Hello All, I have a list of login events on the index which has the following fields. ip\_address: \ login\_success: \ Now I want to query the logs and get a count of number of success and failed logins from e… --- ## [Elasticsearch snapshot struck in inprogress state](https://discuss.elastic.co/t/elasticsearch-snapshot-struck-in-inprogress-state/271240)
**Author:** [@722826c085cfc824006d](https://discuss.elastic.co/u/722826c085cfc824006d)\ **Replies:** 1\ **Last updated:** [April 26, 2021, 11:01am UTC](https://discuss.elastic.co/t/elasticsearch-snapshot-struck-in-inprogress-state/271240 "2021-04-26T11:01:55Z")
we are using opensource elasticsearch version 5.6.10. In one of my ES cluster, the elasticsearch snapshot was struck in inprogress state from few days. I tried below options, but it didn't work out. ElasticSearch Versi… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=656) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=658)