# Elasticsearch

**URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=669

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 670

---

## [Question about wildcard query](https://discuss.elastic.co/t/question-about-wildcard-query/269129)

<div class="topic-metadata">

**Author:** [@anyla](https://discuss.elastic.co/u/anyla)\
**Replies:** 8\
**Last updated:** [April 7, 2021, 2:56pm UTC](https://discuss.elastic.co/t/question-about-wildcard-query/269129 "2021-04-07T14:56:00Z")

</div>

Hi all, It seems that there is something about wildcard queries that it is not clear to me As far as I understand, Wildcard queries are term queries so. the search term is not analysed itself and it is "compared" aga…

---

## [Save logstash and metricbeat indices on diferent place](https://discuss.elastic.co/t/save-logstash-and-metricbeat-indices-on-diferent-place/269425)

<div class="topic-metadata">

**Author:** [@jobanuls](https://discuss.elastic.co/u/jobanuls)\
**Replies:** 4\
**Last updated:** [April 7, 2021, 2:37pm UTC](https://discuss.elastic.co/t/save-logstash-and-metricbeat-indices-on-diferent-place/269425 "2021-04-07T14:37:44Z")

</div>

Hi, I want have two path on my elasticsearch node for save metricbeat indices in the second path. Anyone knows how save metricbeat indices on second path directly? ElasticVersión : 7.9.2-1

---

## [Filter out terms aggregation buckets in elastic search after applying aggregation](https://discuss.elastic.co/t/filter-out-terms-aggregation-buckets-in-elastic-search-after-applying-aggregation/269486)

<div class="topic-metadata">

**Author:** [@ruzeenpalsetia](https://discuss.elastic.co/u/ruzeenpalsetia)\
**Replies:** 0\
**Last updated:** [April 7, 2021, 2:32pm UTC](https://discuss.elastic.co/t/filter-out-terms-aggregation-buckets-in-elastic-search-after-applying-aggregation/269486 "2021-04-07T14:32:09Z")

</div>

Below is snapshot of the dataset: recordNo employeeId employeeStatus employeeAddr 1 employeeA Permanent 2 employeeA ABC …

---

## [Enrich-Policy with daily changes in reference data](https://discuss.elastic.co/t/enrich-policy-with-daily-changes-in-reference-data/269474)

<div class="topic-metadata">

**Author:** [@Oren\_Zomer](https://discuss.elastic.co/u/Oren_Zomer)\
**Replies:** 2\
**Last updated:** [April 7, 2021, 1:57pm UTC](https://discuss.elastic.co/t/enrich-policy-with-daily-changes-in-reference-data/269474 "2021-04-07T13:57:44Z")

</div>

We are trying to create an enrich-processor to add more data to our event documents, based on an existing reference data that may contain ~10k documents. I've read the example in: However, in my case the reference dat…

---

## [Elk requirement](https://discuss.elastic.co/t/elk-requirement/269441)

<div class="topic-metadata">

**Author:** [@dddddddddddddddd](https://discuss.elastic.co/u/dddddddddddddddd)\
**Replies:** 7\
**Last updated:** [April 7, 2021, 1:33pm UTC](https://discuss.elastic.co/t/elk-requirement/269441 "2021-04-07T13:33:51Z")

</div>

hi , i hope this message finds you well, so How much cpu(GHz) /memory/storage at least I need to use ELK stack . regards.

---

## [Sorting log data by specific key](https://discuss.elastic.co/t/sorting-log-data-by-specific-key/269469)

<div class="topic-metadata">

**Author:** [@74db36a597f21b891b3f](https://discuss.elastic.co/u/74db36a597f21b891b3f)\
**Replies:** 0\
**Last updated:** [April 7, 2021, 1:12pm UTC](https://discuss.elastic.co/t/sorting-log-data-by-specific-key/269469 "2021-04-07T13:12:48Z")

</div>

Hello there. I faced with the same problem as described here Documents order in Elasticsearch after processing with filebeat/logstash. Several log lines can be created at the same second, so their order can be incorrect…

---

## [Could not index event to elasticsearch limit of total fields \[1000\]](https://discuss.elastic.co/t/could-not-index-event-to-elasticsearch-limit-of-total-fields-1000/269464)

<div class="topic-metadata">

**Author:** [@azxqw](https://discuss.elastic.co/u/azxqw)\
**Replies:** 2\
**Last updated:** [April 7, 2021, 12:58pm UTC](https://discuss.elastic.co/t/could-not-index-event-to-elasticsearch-limit-of-total-fields-1000/269464 "2021-04-07T12:58:42Z")

</div>

Hi all, I have some trouble with a particular pipeline. I'm trying to index events from our F5 waf, however i get this error on every event. I dont understand why elasticsearch decided that there are more than 1000 fie…

---

## [Scripted field in kibana](https://discuss.elastic.co/t/scripted-field-in-kibana/269465)

<div class="topic-metadata">

**Author:** [@Changra](https://discuss.elastic.co/u/Changra)\
**Replies:** 0\
**Last updated:** [April 7, 2021, 12:50pm UTC](https://discuss.elastic.co/t/scripted-field-in-kibana/269465 "2021-04-07T12:50:57Z")

</div>

Hi Team, I have been to substract the date value and store the value in the variable defined as " duration" and then check if the value is smaller than 2 then return a value through scripted filed in kibana \` \`\` if…

---

## [Create watcher using index pattern](https://discuss.elastic.co/t/create-watcher-using-index-pattern/267478)

<div class="topic-metadata">

**Author:** [@lstoneir](https://discuss.elastic.co/u/lstoneir)\
**Replies:** 1\
**Last updated:** [April 7, 2021, 11:13am UTC](https://discuss.elastic.co/t/create-watcher-using-index-pattern/267478 "2021-04-07T11:13:06Z")

</div>

I have 2 indices (xx-001 and xx-002), and an index pattern xx-\* can i create watcher for xx-\*? how?

---

## [Elasticsearch SQL ODBC Driver error of all shards failed](https://discuss.elastic.co/t/elasticsearch-sql-odbc-driver-error-of-all-shards-failed/268448)

<div class="topic-metadata">

**Author:** [@onkark](https://discuss.elastic.co/u/onkark)\
**Replies:** 7\
**Last updated:** [April 7, 2021, 10:19am UTC](https://discuss.elastic.co/t/elasticsearch-sql-odbc-driver-error-of-all-shards-failed/268448 "2021-04-07T10:19:18Z")

</div>

I'm using Elasticsearch Odbc as driver between my C++ code and Elasticsearch engine. When firing sql select query, the shards are getting failed. Please help me through this. Thanks in advance.

---

## [Hi， guys , how can i useing our db data to transport for es](https://discuss.elastic.co/t/hi-guys-how-can-i-useing-our-db-data-to-transport-for-es/269390)

<div class="topic-metadata">

**Author:** [@votouch904931293](https://discuss.elastic.co/u/votouch904931293)\
**Replies:** 4\
**Last updated:** [April 7, 2021, 9:14am UTC](https://discuss.elastic.co/t/hi-guys-how-can-i-useing-our-db-data-to-transport-for-es/269390 "2021-04-07T09:14:25Z")

</div>

emmmmmmmm,for my company ,need transport out dbdata to es ,useing es to quitk search data,so what should we do ？witch technology is best?

---

## [Upgrade breaks config](https://discuss.elastic.co/t/upgrade-breaks-config/269405)

<div class="topic-metadata">

**Author:** [@viper539](https://discuss.elastic.co/u/viper539)\
**Replies:** 2\
**Last updated:** [April 7, 2021, 8:13am UTC](https://discuss.elastic.co/t/upgrade-breaks-config/269405 "2021-04-07T08:13:54Z")

</div>

Hello Friends, maybe i'm doing it wrong sind years... Can anyone tell me where i can put my individual config and keep it safe during an upgrade? Every time, when i upgrade my ELK, the process tries to overwrite my el…

---

## [Is there any possible solution for group by, order by, and pagination?](https://discuss.elastic.co/t/is-there-any-possible-solution-for-group-by-order-by-and-pagination/269407)

<div class="topic-metadata">

**Author:** [@Jenny1](https://discuss.elastic.co/u/Jenny1)\
**Replies:** 0\
**Last updated:** [April 7, 2021, 6:38am UTC](https://discuss.elastic.co/t/is-there-any-possible-solution-for-group-by-order-by-and-pagination/269407 "2021-04-07T06:38:26Z")

</div>

Hi, I got stuck on the problem with elasticsearch, and appreciated it if someone could help me. I have 2 indices, comment\_index, and like\_index. comment\_index: user comment data like\_index: keeps track of which user…

---

## [Would flush solve my case?](https://discuss.elastic.co/t/would-flush-solve-my-case/269392)

<div class="topic-metadata">

**Author:** [@ecarmona](https://discuss.elastic.co/u/ecarmona)\
**Replies:** 2\
**Last updated:** [April 7, 2021, 6:31am UTC](https://discuss.elastic.co/t/would-flush-solve-my-case/269392 "2021-04-07T06:31:23Z")

</div>

Hi Elastic Team, I am indexing various documents that relate to the execution of Processes within a Database. Basically each document stores the name of the process,the start and end date of the process, time elapsed b…

---

## [Bug: sort \_script is not work](https://discuss.elastic.co/t/bug-sort-script-is-not-work/269394)

<div class="topic-metadata">

**Author:** [@wjhmiss](https://discuss.elastic.co/u/wjhmiss)\
**Replies:** 1\
**Last updated:** [April 7, 2021, 6:26am UTC](https://discuss.elastic.co/t/bug-sort-script-is-not-work/269394 "2021-04-07T06:26:09Z")

</div>

please help me !!!

---

## [Issue with watcher and aggregation](https://discuss.elastic.co/t/issue-with-watcher-and-aggregation/269349)

<div class="topic-metadata">

**Author:** [@Anna\_Foxx](https://discuss.elastic.co/u/Anna_Foxx)\
**Replies:** 2\
**Last updated:** [April 7, 2021, 6:24am UTC](https://discuss.elastic.co/t/issue-with-watcher-and-aggregation/269349 "2021-04-07T06:24:58Z")

</div>

Hi! I have faced the issue with watcher during data aggregation. The watcher works fine without aggregation, but after trying to group values I get this error: "type": "illegal\_argument\_exception", "reason"…

---

## [GeoDistance multisearch](https://discuss.elastic.co/t/geodistance-multisearch/269402)

<div class="topic-metadata">

**Author:** [@barakg](https://discuss.elastic.co/u/barakg)\
**Replies:** 0\
**Last updated:** [April 7, 2021, 5:31am UTC](https://discuss.elastic.co/t/geodistance-multisearch/269402 "2021-04-07T05:31:02Z")

</div>

Hi everyone, I'm looking for an advice for making my Elasticsearch queries faster. My use case is to query all (point) geo\_shape in distance from a ref-point - simple geo distance query (all points in given radius from…

---

## [Best way to reindex documents using Logstash without uninstalling and reinstalling?](https://discuss.elastic.co/t/best-way-to-reindex-documents-using-logstash-without-uninstalling-and-reinstalling/269278)

<div class="topic-metadata">

**Author:** [@caitlyn.carlisle](https://discuss.elastic.co/u/caitlyn.carlisle)\
**Replies:** 2\
**Last updated:** [April 7, 2021, 4:00am UTC](https://discuss.elastic.co/t/best-way-to-reindex-documents-using-logstash-without-uninstalling-and-reinstalling/269278 "2021-04-07T04:00:04Z")

</div>

I can't seem to find information regarding how to clear an Elasticsearch index on my local machine in order to run the Logstash pipeline again?

---

## [Authentication to realm default\_native failed - Password authentication failed](https://discuss.elastic.co/t/authentication-to-realm-default-native-failed-password-authentication-failed/269272)

<div class="topic-metadata">

**Author:** [@natgrant](https://discuss.elastic.co/u/natgrant)\
**Replies:** 1\
**Last updated:** [April 7, 2021, 1:43am UTC](https://discuss.elastic.co/t/authentication-to-realm-default-native-failed-password-authentication-failed/269272 "2021-04-07T01:43:38Z")

</div>

Hi there, I am hoping to see if anyone can help me with the below error occurring on our ingest nodes - \[o.e.x.s.a.AuthenticationService\] \[elastic-ingest-1\] Authentication to realm default\_native failed - Password auth…

---

## [Question about indexing linestring without distance\_error\_pct](https://discuss.elastic.co/t/question-about-indexing-linestring-without-distance-error-pct/269387)

<div class="topic-metadata">

**Author:** [@whiteonyx\_go](https://discuss.elastic.co/u/whiteonyx_go)\
**Replies:** 0\
**Last updated:** [April 7, 2021, 12:54am UTC](https://discuss.elastic.co/t/question-about-indexing-linestring-without-distance-error-pct/269387 "2021-04-07T00:54:35Z")

</div>

Hi Indexing LineString without specifying precision or distance\_error\_pct only hit the query at the start of LineString. If precision is specified, distance\_error\_pct is implicitly treated as 0, so I think that distanc…

---

## [Isue error by elasticsearch-rest-high-level-client to create Index](https://discuss.elastic.co/t/isue-error-by-elasticsearch-rest-high-level-client-to-create-index/269281)

<div class="topic-metadata">

**Author:** [@votouch904931293](https://discuss.elastic.co/u/votouch904931293)\
**Replies:** 7\
**Last updated:** [April 7, 2021, 12:49am UTC](https://discuss.elastic.co/t/isue-error-by-elasticsearch-rest-high-level-client-to-create-index/269281 "2021-04-07T00:49:14Z")

</div>

i use doc url:Maven Repository | Java REST Client \[6.8\] | Elastic i has get init and try to cread indexrequest , the system exception error,for this Handler dispatch failed; nested exception is java.lang.NoSuchMethodE…

---

## [S3 Repo plugin failing certificate validation with MiniO, already added cert to Jdk truststore](https://discuss.elastic.co/t/s3-repo-plugin-failing-certificate-validation-with-minio-already-added-cert-to-jdk-truststore/269069)

<div class="topic-metadata">

**Author:** [@R.L](https://discuss.elastic.co/u/R.L)\
**Replies:** 3\
**Last updated:** [April 6, 2021, 10:38am UTC](https://discuss.elastic.co/t/s3-repo-plugin-failing-certificate-validation-with-minio-already-added-cert-to-jdk-truststore/269069 "2021-04-06T10:38:36Z")

</div>

I want to take snapshots of my ElasticSearch Index and use MiniO instance running on a remote machine as storage. My ES instance (7.6.0) is ran locally, using JDK 13. I can access the miniO storage through my browser ju…

---

## [Recovery of closed indices](https://discuss.elastic.co/t/recovery-of-closed-indices/269274)

<div class="topic-metadata">

**Author:** [@pdxjjb](https://discuss.elastic.co/u/pdxjjb)\
**Replies:** 8\
**Last updated:** [April 6, 2021, 11:08pm UTC](https://discuss.elastic.co/t/recovery-of-closed-indices/269274 "2021-04-06T23:08:06Z")

</div>

General: mixed fleet of 7.4/7.9 instances running on Kubernetes. Mostly log ingest. Every cluster has some newer open indices and some older closed indices. Scenario: a data node leaves the cluster. Node\_left has been i…

---

## [Stemmer filter not working as expected when search, wont find some exact words](https://discuss.elastic.co/t/stemmer-filter-not-working-as-expected-when-search-wont-find-some-exact-words/269377)

<div class="topic-metadata">

**Author:** [@Old\_Relict](https://discuss.elastic.co/u/Old_Relict)\
**Replies:** 1\
**Last updated:** [April 6, 2021, 8:23pm UTC](https://discuss.elastic.co/t/stemmer-filter-not-working-as-expected-when-search-wont-find-some-exact-words/269377 "2021-04-06T20:23:47Z")

</div>

I have a simple search field. The search results work strangely.. some search work as expected, other not. For example 'Building', if I search for the exact term, it wont find the search. Other words, like for example '…

---

## [Shards randomly going into "initializing"/"unassigned" state even when the cluster is in stable state](https://discuss.elastic.co/t/shards-randomly-going-into-initializing-unassigned-state-even-when-the-cluster-is-in-stable-state/269329)

<div class="topic-metadata">

**Author:** [@dinesh\_gnanasamy](https://discuss.elastic.co/u/dinesh_gnanasamy)\
**Replies:** 1\
**Last updated:** [April 6, 2021, 5:26pm UTC](https://discuss.elastic.co/t/shards-randomly-going-into-initializing-unassigned-state-even-when-the-cluster-is-in-stable-state/269329 "2021-04-06T17:26:33Z")

</div>

Description : Even without any nodal disturbances (nodes leaving/joining), some shards go into INITIALIZING, UNASSIGNED states randomly over 24-48 hours. Environment : ES Version : 7.0.1 No of nodes : 12 (No specific…

---

## [\[logstash.outputs.elasticsearch\] Attempted to resurrect connection to dead ES instance](https://discuss.elastic.co/t/logstash-outputs-elasticsearch-attempted-to-resurrect-connection-to-dead-es-instance/267826)

<div class="topic-metadata">

**Author:** [@gerald716](https://discuss.elastic.co/u/gerald716)\
**Replies:** 6\
**Last updated:** [April 6, 2021, 4:30pm UTC](https://discuss.elastic.co/t/logstash-outputs-elasticsearch-attempted-to-resurrect-connection-to-dead-es-instance/267826 "2021-04-06T16:30:31Z")

</div>

\[2021-03-18T15:33:29,348\]\[WARN \]\[logstash.outputs.elasticsearch\] Attempted to resurrect connection to dead ES instance, but got an error. {:url=\>"http://elastic:xxxxxx@127.0.0.1:9200/", :error\_type=\>LogStash::Outputs::E…

---

## [Documents are not getting inserted in ES6.2](https://discuss.elastic.co/t/documents-are-not-getting-inserted-in-es6-2/267968)

<div class="topic-metadata">

**Author:** [@rajat\_singh1](https://discuss.elastic.co/u/rajat_singh1)\
**Replies:** 1\
**Last updated:** [April 6, 2021, 4:26pm UTC](https://discuss.elastic.co/t/documents-are-not-getting-inserted-in-es6-2/267968 "2021-04-06T16:26:21Z")

</div>

Hi, I'm trying to insert documents in ES 6.2. My concern is when I'm inserting data into ES by mapping one of index and mentioning "index": false, This is my mapping query: ' "state": { "type": "text", "index"…

---

## [Json parse exception](https://discuss.elastic.co/t/json-parse-exception/269035)

<div class="topic-metadata">

**Author:** [@jayasree](https://discuss.elastic.co/u/jayasree)\
**Replies:** 1\
**Last updated:** [April 6, 2021, 4:22pm UTC](https://discuss.elastic.co/t/json-parse-exception/269035 "2021-04-06T16:22:14Z")

</div>

Hi Team, We are using elastic search cloud. we got below error. Please help me in resolving this. PHP Fatal error: Uncaught Elasticsearch\\Common\\Exceptions\\BadRequest400Exception: {"error":{"root\_cause":\[{"type":"json\_…

---

## [NoNodesAvailableException: No alive nodes found in your cluster](https://discuss.elastic.co/t/nonodesavailableexception-no-alive-nodes-found-in-your-cluster/268647)

<div class="topic-metadata">

**Author:** [@sewox](https://discuss.elastic.co/u/sewox)\
**Replies:** 2\
**Last updated:** [April 6, 2021, 4:15pm UTC](https://discuss.elastic.co/t/nonodesavailableexception-no-alive-nodes-found-in-your-cluster/268647 "2021-04-06T16:15:20Z")

</div>

Hi everyone, I tried different ways this issue but I can't fix it. Elasticsearch service is running. this is throws exception Fatal error: Uncaught Elasticsearch\\Common\\Exceptions\\NoNodesAvailableException: No alive …

---

## [SQL query do not return whole data](https://discuss.elastic.co/t/sql-query-do-not-return-whole-data/269309)

<div class="topic-metadata">

**Author:** [@czmoku](https://discuss.elastic.co/u/czmoku)\
**Replies:** 1\
**Last updated:** [April 6, 2021, 4:11pm UTC](https://discuss.elastic.co/t/sql-query-do-not-return-whole-data/269309 "2021-04-06T16:11:23Z")

</div>

Hello We facing with issue with Apache Superset + elasticsearch. Apache Superset use the SQL (this one Elasticsearch SQL: Query Elasticsearch Indices with SQL | Elastic) and we notice problems with fetching old data. Ou…

[Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=668)

[Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=670)
