# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=661 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 662 --- ## [Group by that returns only groups that match a condition inside each group](https://discuss.elastic.co/t/group-by-that-returns-only-groups-that-match-a-condition-inside-each-group/270674)
**Author:** [@nvano](https://discuss.elastic.co/u/nvano)\ **Replies:** 0\ **Last updated:** [April 20, 2021, 8:59am UTC](https://discuss.elastic.co/t/group-by-that-returns-only-groups-that-match-a-condition-inside-each-group/270674 "2021-04-20T08:59:17Z")
Hello, My project has an elasticsearch dataset with lots of products that contain a group id, a price and a flag that indicates if the product is original or not: \[ { id: 456, group\_id: 1000, is\_original: true, … --- ## [Reindexing time series index:](https://discuss.elastic.co/t/reindexing-time-series-index/270662)
**Author:** [@Kalpa](https://discuss.elastic.co/u/Kalpa)\ **Replies:** 2\ **Last updated:** [April 20, 2021, 8:03am UTC](https://discuss.elastic.co/t/reindexing-time-series-index/270662 "2021-04-20T08:03:10Z")
Hi all, Here is the scenarios, I need help, I have weekly based indices. for months time filter, I refer last 5 indices. for example, topic\_2021\_1, topic\_2021\_2, topic\_2021\_3, topic\_2021\_4, topic\_2021\_5. Suppose in t… --- ## [Equality shard index distribution](https://discuss.elastic.co/t/equality-shard-index-distribution/270568)
**Author:** [@sysadmin93](https://discuss.elastic.co/u/sysadmin93)\ **Replies:** 3\ **Last updated:** [April 20, 2021, 7:57am UTC](https://discuss.elastic.co/t/equality-shard-index-distribution/270568 "2021-04-20T07:57:55Z")
Hello, I have a 6 nodes clúster with indexs 3 primary shards and 3 replica shards. I'm reading documentation and not found how to force 1 shard from each index per node. It this possible? Thank you --- ## [How to get the data with concept in SQL "Group by"](https://discuss.elastic.co/t/how-to-get-the-data-with-concept-in-sql-group-by/270529)
**Author:** [@Phoebe\_Wong](https://discuss.elastic.co/u/Phoebe_Wong)\ **Replies:** 1\ **Last updated:** [April 20, 2021, 7:48am UTC](https://discuss.elastic.co/t/how-to-get-the-data-with-concept-in-sql-group-by/270529 "2021-04-20T07:48:53Z")
Hi every one, I would like to query the data by using the concept in SQL "Group by" like below "SELECT user, DATE(timestamp), EXTRACT(HOUR FROM timestamp), floor\_name FROM location WHERE DATE(timestamp) BETWEEN "(d1) … --- ## [API call from watcher using webhook, certificate error](https://discuss.elastic.co/t/api-call-from-watcher-using-webhook-certificate-error/270363)
**Author:** [@avy](https://discuss.elastic.co/u/avy)\ **Replies:** 2\ **Last updated:** [April 20, 2021, 7:44am UTC](https://discuss.elastic.co/t/api-call-from-watcher-using-webhook-certificate-error/270363 "2021-04-20T07:44:20Z")
Hi, We are trying to make API call as part of watcher action, using webhook to 3rd party application. When we do that we are getting below error: "type": "s\_s\_l\_handshake\_exception", "reason": "PKIX path… --- ## [Unable to automatically index nested json as nested type elastic search](https://discuss.elastic.co/t/unable-to-automatically-index-nested-json-as-nested-type-elastic-search/270627)
**Author:** [@schawla](https://discuss.elastic.co/u/schawla)\ **Replies:** 5\ **Last updated:** [April 20, 2021, 7:20am UTC](https://discuss.elastic.co/t/unable-to-automatically-index-nested-json-as-nested-type-elastic-search/270627 "2021-04-20T07:20:05Z")
I am trying to index a nested json into elastic search using the bulk api. When i pass a nested json to the bulk api method, es was able to automatically identify the nested structure. Here is the json i passed - em… --- ## [Sort aggregation by string](https://discuss.elastic.co/t/sort-aggregation-by-string/270579)
**Author:** [@Giovanni\_Di\_Lembo](https://discuss.elastic.co/u/Giovanni_Di_Lembo)\ **Replies:** 2\ **Last updated:** [April 20, 2021, 7:06am UTC](https://discuss.elastic.co/t/sort-aggregation-by-string/270579 "2021-04-20T07:06:59Z")
Hi all and sorry for my poor english. I'd like to sort by creation (string) field this query GET /profiles/\_search { "aggs": { "filtered": { "filter": { "bool": { "must": \[ … --- ## [Check each node memory](https://discuss.elastic.co/t/check-each-node-memory/270658)
**Author:** [@Anshumanabhishek](https://discuss.elastic.co/u/Anshumanabhishek)\ **Replies:** 1\ **Last updated:** [April 20, 2021, 6:49am UTC](https://discuss.elastic.co/t/check-each-node-memory/270658 "2021-04-20T06:49:40Z")
I am able to get "os.mem.used\_percent" by this way curl -GET "http://localhost:9200/\_nodes/stats/os". But I need to get all nodes percent only. So, that I make automation script which check if percentage not goes beyond… --- ## [Date difference columns adding an additional one hour in enhanced data table](https://discuss.elastic.co/t/date-difference-columns-adding-an-additional-one-hour-in-enhanced-data-table/270657)
**Author:** [@anjilinga](https://discuss.elastic.co/u/anjilinga)\ **Replies:** 0\ **Last updated:** [April 20, 2021, 6:24am UTC](https://discuss.elastic.co/t/date-difference-columns-adding-an-additional-one-hour-in-enhanced-data-table/270657 "2021-04-20T06:24:01Z")
Hi I am having two columns, with login time and logout time, i have used computed column in enhanced tabel, The column is adding one hour day light saving time after difference. how to solve this please --- ## [Implement stemmer on search-as-you-type field](https://discuss.elastic.co/t/implement-stemmer-on-search-as-you-type-field/270656)
**Author:** [@sb8244](https://discuss.elastic.co/u/sb8244)\ **Replies:** 0\ **Last updated:** [April 20, 2021, 6:21am UTC](https://discuss.elastic.co/t/implement-stemmer-on-search-as-you-type-field/270656 "2021-04-20T06:21:34Z")
Is it possible to easily add an additional sub-field under search-as-you-type (SAYT) to use a stemmer analyzer? Ideally, I want to keep the normal SAYT without a stemmer analyzer, and then have a single stemmed field tha… --- ## [Where can I find the pagination document for es7.3.1?](https://discuss.elastic.co/t/where-can-i-find-the-pagination-document-for-es7-3-1/270294)
**Author:** [@major](https://discuss.elastic.co/u/major)\ **Replies:** 1\ **Last updated:** [April 20, 2021, 2:32am UTC](https://discuss.elastic.co/t/where-can-i-find-the-pagination-document-for-es7-3-1/270294 "2021-04-20T02:32:03Z")
I can only find the pagination doc from v7.8 at Paginate search results | Elasticsearch Guide \[7.8\] | Elastic. But for the version before it, the document is missing. I need the doc of version 7.3.1 and want to confirm i… --- ## [Metricbeat query in Kibana](https://discuss.elastic.co/t/metricbeat-query-in-kibana/270398)
**Author:** [@rckvanwijk](https://discuss.elastic.co/u/rckvanwijk)\ **Replies:** 5\ **Last updated:** [April 20, 2021, 2:15am UTC](https://discuss.elastic.co/t/metricbeat-query-in-kibana/270398 "2021-04-20T02:15:21Z")
Hi there, I'm creating customer portals within the Kibana interface, this is working nicely. The purpose of this is, is that the customer can check the up-time of their own application without consulting us. Now i can c… --- ## [Configuring SSL/TLS for elasticsearch cluster](https://discuss.elastic.co/t/configuring-ssl-tls-for-elasticsearch-cluster/270638)
**Author:** [@spartin07](https://discuss.elastic.co/u/spartin07)\ **Replies:** 1\ **Last updated:** [April 19, 2021, 11:30pm UTC](https://discuss.elastic.co/t/configuring-ssl-tls-for-elasticsearch-cluster/270638 "2021-04-19T23:30:45Z")
I'm trying to enable elastic search security for my es cluster and am following this page Encrypting communications in an Elasticsearch Docker Container | Elasticsearch Guide \[7.12\] | Elastic However, unlike in the exam… --- ## [Hands-on Verbatim Query Usage in elasticsearch using NEST.Net client](https://discuss.elastic.co/t/hands-on-verbatim-query-usage-in-elasticsearch-using-nest-net-client/270442)
**Author:** [@kartheek91](https://discuss.elastic.co/u/kartheek91)\ **Replies:** 1\ **Last updated:** [April 19, 2021, 11:38pm UTC](https://discuss.elastic.co/t/hands-on-verbatim-query-usage-in-elasticsearch-using-nest-net-client/270442 "2021-04-19T23:38:13Z")
--- ## [ElasticsearchError error=“400 - Rejected by Elasticsearch](https://discuss.elastic.co/t/elasticsearcherror-error-400-rejected-by-elasticsearch/270361)
**Author:** [@Julien\_BRUNET\_BTWIN](https://discuss.elastic.co/u/Julien_BRUNET_BTWIN)\ **Replies:** 1\ **Last updated:** [April 19, 2021, 11:34pm UTC](https://discuss.elastic.co/t/elasticsearcherror-error-400-rejected-by-elasticsearch/270361 "2021-04-19T23:34:33Z")
Hello i am using EFK stack in my GKE cluster and recently i observed below errors in my fluentd logs. 2021-04-15 14:39:25 +0000 \[warn\]: dump an error event: error\_class=Fluent::Plugin::ElasticsearchErrorHandler::Elasti… --- ## [Search in wrong Index](https://discuss.elastic.co/t/search-in-wrong-index/270369)
**Author:** [@Gioking](https://discuss.elastic.co/u/Gioking)\ **Replies:** 1\ **Last updated:** [April 19, 2021, 11:33pm UTC](https://discuss.elastic.co/t/search-in-wrong-index/270369 "2021-04-19T23:33:23Z")
Hi all, I'm new to Elasticsearch, I had to add a couple of field in mssql, the same fields must be created in elasticsearch. To add new fields I follow this procedure: 1 Copy the index mapping from the original index … --- ## [How to use "explain" in Elasticsearch-PHP search operation?](https://discuss.elastic.co/t/how-to-use-explain-in-elasticsearch-php-search-operation/270367)
**Author:** [@DimanG](https://discuss.elastic.co/u/DimanG)\ **Replies:** 0\ **Last updated:** [April 16, 2021, 9:40am UTC](https://discuss.elastic.co/t/how-to-use-explain-in-elasticsearch-php-search-operation/270367 "2021-04-16T09:40:43Z")
Hi! I'm using ELK via Elasticsearch-PHP. I want to use "explain" in certain circumstances. When I write "explain" or "\_explain" before or within "body" the result contains explanation in some cases, but it always return… --- ## [Correlation analysis in elasticsearch](https://discuss.elastic.co/t/correlation-analysis-in-elasticsearch/270346)
**Author:** [@111387](https://discuss.elastic.co/u/111387)\ **Replies:** 0\ **Last updated:** [April 16, 2021, 8:14am UTC](https://discuss.elastic.co/t/correlation-analysis-in-elasticsearch/270346 "2021-04-16T08:14:22Z")
I am collecting suricata events with elasticsearch. I want to create an alert through correlation analysis for suricata event. For example, when the following events are saved { rule.event: "event a" src.ip: "… --- ## [Cannot simulate watch - Request Timeout after 90000ms](https://discuss.elastic.co/t/cannot-simulate-watch-request-timeout-after-90000ms/270287)
**Author:** [@kksandesh1](https://discuss.elastic.co/u/kksandesh1)\ **Replies:** 1\ **Last updated:** [April 19, 2021, 11:30pm UTC](https://discuss.elastic.co/t/cannot-simulate-watch-request-timeout-after-90000ms/270287 "2021-04-19T23:30:15Z")
I have watcher setup to send report. But getting the below error Cannot simulate watch Request Timeout after 90000ms. Please help --- ## [Stackmonitor production cluster on a different monitoring cluster](https://discuss.elastic.co/t/stackmonitor-production-cluster-on-a-different-monitoring-cluster/270277)
**Author:** [@Pooja](https://discuss.elastic.co/u/Pooja)\ **Replies:** 1\ **Last updated:** [April 19, 2021, 11:29pm UTC](https://discuss.elastic.co/t/stackmonitor-production-cluster-on-a-different-monitoring-cluster/270277 "2021-04-19T23:29:25Z")
I would like to get help on monitoring production cluster on a separate monitoring cluster using metricbeat. As of now I am finding issues sending the data across clusters. I have the metricbeat setup on poduction clus… --- ## [Index\_closed\_exception on open index](https://discuss.elastic.co/t/index-closed-exception-on-open-index/270273)
**Author:** [@maigel](https://discuss.elastic.co/u/maigel)\ **Replies:** 1\ **Last updated:** [April 19, 2021, 11:28pm UTC](https://discuss.elastic.co/t/index-closed-exception-on-open-index/270273 "2021-04-19T23:28:57Z")
Hi, We currently have a cluster with a lot of network security (Zeek) logs. I have a script written with elasticsearch-py which periodically searches all data for known IOCs (bad IPs, bad domains, etc.) Every once in a… --- ## [Many process](https://discuss.elastic.co/t/many-process/270257)
**Author:** [@gh\_darvishani](https://discuss.elastic.co/u/gh_darvishani)\ **Replies:** 1\ **Last updated:** [April 19, 2021, 11:27pm UTC](https://discuss.elastic.co/t/many-process/270257 "2021-04-19T23:27:34Z")
i use magento as my cms and ES as the search engine. my server (apache) after a while created. i check the log and process and i saw many processes for ES how i can set a limit for processes or threads --- ## [Index created with too many fields, automatic creation](https://discuss.elastic.co/t/index-created-with-too-many-fields-automatic-creation/270245)
**Author:** [@PSTech](https://discuss.elastic.co/u/PSTech)\ **Replies:** 1\ **Last updated:** [April 19, 2021, 11:26pm UTC](https://discuss.elastic.co/t/index-created-with-too-many-fields-automatic-creation/270245 "2021-04-19T23:26:51Z")
hi, I've been trying to setup apache module Filebeat, with automatic index creation. after my index was created I wasn't able to create an index pattern in my Kibana UI with the error code 413 Request Entity Too Large","… --- ## [Better define Kibana Watchers for unavailable Pod](https://discuss.elastic.co/t/better-define-kibana-watchers-for-unavailable-pod/270221)
**Author:** [@es-gabriele](https://discuss.elastic.co/u/es-gabriele)\ **Replies:** 0\ **Last updated:** [April 15, 2021, 11:05am UTC](https://discuss.elastic.co/t/better-define-kibana-watchers-for-unavailable-pod/270221 "2021-04-15T11:05:45Z")
2021-04-14T22:00:00Z (UTC) Good morning, I could need assistance with a particular task. Basically, we implemented a Watcher that is triggered whenever a Pod is unavailable, and we will export this trigger alarm to Ops… --- ## [How to convert painless script to java api](https://discuss.elastic.co/t/how-to-convert-painless-script-to-java-api/270610)
**Author:** [@Rahul4](https://discuss.elastic.co/u/Rahul4)\ **Replies:** 0\ **Last updated:** [April 19, 2021, 5:07pm UTC](https://discuss.elastic.co/t/how-to-convert-painless-script-to-java-api/270610 "2021-04-19T17:07:12Z")
Below is the Elasticsearch painless script query , please suggest me the JAVA API or how to write the java code for below query I wanted to prepare the same query using Java 1.8 and RestHighLevelClient Request:- GET /x… --- ## [Dynamic Mapping for Nested Objects](https://discuss.elastic.co/t/dynamic-mapping-for-nested-objects/270628)
**Author:** [@schawla](https://discuss.elastic.co/u/schawla)\ **Replies:** 0\ **Last updated:** [April 19, 2021, 9:27pm UTC](https://discuss.elastic.co/t/dynamic-mapping-for-nested-objects/270628 "2021-04-19T21:27:24Z")
Is it possible to have dynamic mapping for a nested object like the following - employee { "id":"1", "name":"manager", "assistants":\[ { "id":"2", "name":"assistant1" }, { "id":"3… --- ## [Need help with creating Kibana Alert](https://discuss.elastic.co/t/need-help-with-creating-kibana-alert/270508)
**Author:** [@Long\_Nguyen](https://discuss.elastic.co/u/Long_Nguyen)\ **Replies:** 8\ **Last updated:** [April 19, 2021, 6:19pm UTC](https://discuss.elastic.co/t/need-help-with-creating-kibana-alert/270508 "2021-04-19T18:19:50Z")
Hello everyone, I am new to the Elasticstack in general and I have encountered a problem with creating an Alert using the Elasticsearch Query. I am using the index from metricbeat that indexes various processes of a hos… --- ## [Lucene Merge Thread causing high CPU usage](https://discuss.elastic.co/t/lucene-merge-thread-causing-high-cpu-usage/270599)
**Author:** [@souravsahoo](https://discuss.elastic.co/u/souravsahoo)\ **Replies:** 2\ **Last updated:** [April 19, 2021, 5:37pm UTC](https://discuss.elastic.co/t/lucene-merge-thread-causing-high-cpu-usage/270599 "2021-04-19T17:37:06Z")
Hi all, I have been facing issue with elasticsearch consuming a very high CPU i.e., 80-100% when a heavy data load is ingested. Below are few inputs:- Elasticsearch is running on. 7.10.2 version We have data tier arc… --- ## [Reindex automatization - detection of failures / missing documents](https://discuss.elastic.co/t/reindex-automatization-detection-of-failures-missing-documents/270594)
**Author:** [@plachor](https://discuss.elastic.co/u/plachor)\ **Replies:** 0\ **Last updated:** [April 19, 2021, 2:13pm UTC](https://discuss.elastic.co/t/reindex-automatization-detection-of-failures-missing-documents/270594 "2021-04-19T14:13:59Z")
Hi, I'm trying to automatize reindex operation. I'm looking for a robust way to determine that my reindex operation was indeed successful before start using new indexes. I always start reindex as an asynchronous operatio… --- ## [Performance Issue with Elasticsearch 7.11.1 Cluster](https://discuss.elastic.co/t/performance-issue-with-elasticsearch-7-11-1-cluster/270592)
**Author:** [@dawiro](https://discuss.elastic.co/u/dawiro)\ **Replies:** 0\ **Last updated:** [April 19, 2021, 2:03pm UTC](https://discuss.elastic.co/t/performance-issue-with-elasticsearch-7-11-1-cluster/270592 "2021-04-19T14:03:55Z")
Hi, We've had an issue show itself in recent days with one of our clusters. High level behaviour is as follows: Ingestion Rate has collapsed 504 errors reported by logstash One node showing exceptionally high load ave… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=660) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=662)