# Elasticsearch

**URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=672

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 673

---

## [Can't index a special word in Nest!](https://discuss.elastic.co/t/cant-index-a-special-word-in-nest/266457)

<div class="topic-metadata">

**Author:** [@ehsan\_kabiri\_33](https://discuss.elastic.co/u/ehsan_kabiri_33)\
**Replies:** 1\
**Last updated:** [April 1, 2021, 8:35am UTC](https://discuss.elastic.co/t/cant-index-a-special-word-in-nest/266457 "2021-04-01T08:35:20Z")

</div>

Let's look at the built in analyzer named "persian" var analyzeResponse = client.Indices.Analyze(a =\> a .Analyzer("persian") .Text("word1 words2 ManyWord3 LargeWOrds4 Sma…

---

## [Elasticsearch load is low, batch write latency is high, how to check the problem](https://discuss.elastic.co/t/elasticsearch-load-is-low-batch-write-latency-is-high-how-to-check-the-problem/268975)

<div class="topic-metadata">

**Author:** [@bxl](https://discuss.elastic.co/u/bxl)\
**Replies:** 1\
**Last updated:** [April 1, 2021, 7:09am UTC](https://discuss.elastic.co/t/elasticsearch-load-is-low-batch-write-latency-is-high-how-to-check-the-problem/268975 "2021-04-01T07:09:43Z")

</div>

elasticsearch load is low, batch write latency is high, how to check the problem , thanks 13:24:27 22.6s{ "completed" : false, "task" : { "node" : "6nPgzz7\_Q96pQzAompMFUQ", "id" : 470791605, "type" : "tr…

---

## [Best design for managing 'likes' on each comment?](https://discuss.elastic.co/t/best-design-for-managing-likes-on-each-comment/267607)

<div class="topic-metadata">

**Author:** [@Jenny1](https://discuss.elastic.co/u/Jenny1)\
**Replies:** 9\
**Last updated:** [April 1, 2021, 6:59am UTC](https://discuss.elastic.co/t/best-design-for-managing-likes-on-each-comment/267607 "2021-04-01T06:59:46Z")

</div>

Hi, I'm new to Elasticsearch and struggling with the design. I have 2 indices. One is 'comment' index which contains comments users wrote, the other is 'ex\_comment' which also contains comments but crawling data. What …

---

## [Elasticsearch failed to start on Ubuntu 18.04](https://discuss.elastic.co/t/elasticsearch-failed-to-start-on-ubuntu-18-04/268262)

<div class="topic-metadata">

**Author:** [@Sebastian\_F](https://discuss.elastic.co/u/Sebastian_F)\
**Replies:** 21\
**Last updated:** [April 1, 2021, 6:54am UTC](https://discuss.elastic.co/t/elasticsearch-failed-to-start-on-ubuntu-18-04/268262 "2021-04-01T06:54:29Z")

</div>

Hi folks, I am an elastic noob and I am stuck with running elasticsearch on an Ubuntu 18.04 V-Server with 4 Cores, 8Gb Ram and a 100GB Hard drive. I followed the instructions from this post: Installieren und Konfigurier…

---

## [Is the dependent jars can be upgraded](https://discuss.elastic.co/t/is-the-dependent-jars-can-be-upgraded/268866)

<div class="topic-metadata">

**Author:** [@mohammed\_rizwan](https://discuss.elastic.co/u/mohammed_rizwan)\
**Replies:** 3\
**Last updated:** [April 1, 2021, 6:43am UTC](https://discuss.elastic.co/t/is-the-dependent-jars-can-be-upgraded/268866 "2021-04-01T06:43:54Z")

</div>

Hi team, We are using the elastic search 7.2.0 which depends on snakeyaml version 1.17. Snakeyaml 1.17 has security vulnerabilities and we plan to upgrade it to the latest version 1.28. Is upgrading the dependant snak…

---

## [Node disconnecting randomly](https://discuss.elastic.co/t/node-disconnecting-randomly/265085)

<div class="topic-metadata">

**Author:** [@DENMODSupport](https://discuss.elastic.co/u/DENMODSupport)\
**Replies:** 27\
**Last updated:** [April 1, 2021, 5:20am UTC](https://discuss.elastic.co/t/node-disconnecting-randomly/265085 "2021-04-01T05:20:07Z")

</div>

Hi, We could see that nodes are disconnecting frequently from cluster. Below are the errors from Master and data nodes. We are using ELK version 5.3.1. Could you please help us to prevent the node disconnection issue? \*…

---

## [Upload logfile in the kibana](https://discuss.elastic.co/t/upload-logfile-in-the-kibana/268972)

<div class="topic-metadata">

**Author:** [@Son\_Vu\_Bao](https://discuss.elastic.co/u/Son_Vu_Bao)\
**Replies:** 6\
**Last updated:** [April 1, 2021, 3:22am UTC](https://discuss.elastic.co/t/upload-logfile-in-the-kibana/268972 "2021-04-01T03:22:01Z")

</div>

Hi, I am new in Elasticsearch. I am trying to upload a log file into elasticsearch by using data visualizer. However, I ran to some error like below:

---

## [How to get the realtime data based on aggrgations](https://discuss.elastic.co/t/how-to-get-the-realtime-data-based-on-aggrgations/268787)

<div class="topic-metadata">

**Author:** [@anjilinga](https://discuss.elastic.co/u/anjilinga)\
**Replies:** 3\
**Last updated:** [March 31, 2021, 10:08pm UTC](https://discuss.elastic.co/t/how-to-get-the-realtime-data-based-on-aggrgations/268787 "2021-03-31T22:08:53Z")

</div>

Hi, With the below data, want to measure the time series graph with 30 sec resolution, how many are logged in and how many are Ready and how many are Busy. how to group by agent and find the status and sum the agents ba…

---

## [Query\_string with fuzzy and stammer filter works wierd](https://discuss.elastic.co/t/query-string-with-fuzzy-and-stammer-filter-works-wierd/268956)

<div class="topic-metadata">

**Author:** [@fedoroko](https://discuss.elastic.co/u/fedoroko)\
**Replies:** 0\
**Last updated:** [March 31, 2021, 7:58pm UTC](https://discuss.elastic.co/t/query-string-with-fuzzy-and-stammer-filter-works-wierd/268956 "2021-03-31T19:58:31Z")

</div>

Found some strange thing with query\_string and stemmer/snowball filters, can't understand how does it work and how to fix this, help me, please. Analyzer and filter: 'analyzer' =\> \[ …

---

## [Suricata -\> Filebeat -\> Elasticsearch](https://discuss.elastic.co/t/suricata-filebeat-elasticsearch/268944)

<div class="topic-metadata">

**Author:** [@nunex\_17](https://discuss.elastic.co/u/nunex_17)\
**Replies:** 0\
**Last updated:** [March 31, 2021, 6:51pm UTC](https://discuss.elastic.co/t/suricata-filebeat-elasticsearch/268944 "2021-03-31T18:51:59Z")

</div>

Hi there! I´m implementing a IDS solution (suricata). I am sending logs via filebeat to a remote ELK server. What happens is that i´m not getting real-time searches. For instance, on the "Discovery" page an event that h…

---

## [400 error from \_reindex](https://discuss.elastic.co/t/400-error-from-reindex/268926)

<div class="topic-metadata">

**Author:** [@drdwilcox](https://discuss.elastic.co/u/drdwilcox)\
**Replies:** 0\
**Last updated:** [March 31, 2021, 2:54pm UTC](https://discuss.elastic.co/t/400-error-from-reindex/268926 "2021-03-31T14:54:23Z")

</div>

I am attempting to use reindex to effect the conversion of a single field from a string to a float. I have run this on several indices without issue, but in my most recent attempt, I get the following error after 29,000 …

---

## [Strange ILM error "Mapping definition for ... has unsupported parameters: \[normalizer : my\_normalizer\]"](https://discuss.elastic.co/t/strange-ilm-error-mapping-definition-for-has-unsupported-parameters-normalizer-my-normalizer/268092)

<div class="topic-metadata">

**Author:** [@dsv](https://discuss.elastic.co/u/dsv)\
**Replies:** 2\
**Last updated:** [March 31, 2021, 2:52pm UTC](https://discuss.elastic.co/t/strange-ilm-error-mapping-definition-for-has-unsupported-parameters-normalizer-my-normalizer/268092 "2021-03-31T14:52:38Z")

</div>

Hey guys, i've got strange ILM error during an ILM phase: ... policy \[p-ilm\] for index \[p-auditbeat-000009\] failed on step \[{"phase":"hot","action":"rollover","name":"attempt-rollover"}\]. Moving to ERROR step Mapping d…

---

## [Could not dynamically add mapping for field \[stats.something.else\]. Existing mapping for \[stats.something\] must be of type object but found \[long\]](https://discuss.elastic.co/t/could-not-dynamically-add-mapping-for-field-stats-something-else-existing-mapping-for-stats-something-must-be-of-type-object-but-found-long/268919)

<div class="topic-metadata">

**Author:** [@szabgab](https://discuss.elastic.co/u/szabgab)\
**Replies:** 1\
**Last updated:** [March 31, 2021, 2:48pm UTC](https://discuss.elastic.co/t/could-not-dynamically-add-mapping-for-field-stats-something-else-existing-mapping-for-stats-something-must-be-of-type-object-but-found-long/268919 "2021-03-31T14:48:44Z")

</div>

The problem seems to be that we have both a field called stats.something and another field called stats.something.else. I get the above error when I try to submit the second piece of data. I could replace each dot with …

---

## [Best approach to apply Fine Grained Access Control to index documents](https://discuss.elastic.co/t/best-approach-to-apply-fine-grained-access-control-to-index-documents/268817)

<div class="topic-metadata">

**Author:** [@grugna](https://discuss.elastic.co/u/grugna)\
**Replies:** 2\
**Last updated:** [March 31, 2021, 1:31pm UTC](https://discuss.elastic.co/t/best-approach-to-apply-fine-grained-access-control-to-index-documents/268817 "2021-03-31T13:31:55Z")

</div>

I have a service that apply fine grained access control to ES index document and I am facing some ES limitation / performance issue. For this reason I am not sure if my approach is correct, of if there is a better way to…

---

## [Bucket Path to access Top-hits aggregation in elasticsearch query](https://discuss.elastic.co/t/bucket-path-to-access-top-hits-aggregation-in-elasticsearch-query/268904)

<div class="topic-metadata">

**Author:** [@Dhruvil\_Doshi](https://discuss.elastic.co/u/Dhruvil_Doshi)\
**Replies:** 0\
**Last updated:** [March 31, 2021, 12:34pm UTC](https://discuss.elastic.co/t/bucket-path-to-access-top-hits-aggregation-in-elasticsearch-query/268904 "2021-03-31T12:34:27Z")

</div>

Hello, I have an index "jmx\_metrics-\*" that contains JVM monitoring data from Jconsole. Following it the mapping of index. { "jmx\_metrics-2021.03" : { "aliases" : { }, "mappings" : { "properties" : { …

---

## [ElasticSearch performance trouble when indexing data](https://discuss.elastic.co/t/elasticsearch-performance-trouble-when-indexing-data/268745)

<div class="topic-metadata">

**Author:** [@nicolaipre](https://discuss.elastic.co/u/nicolaipre)\
**Replies:** 10\
**Last updated:** [March 31, 2021, 11:01am UTC](https://discuss.elastic.co/t/elasticsearch-performance-trouble-when-indexing-data/268745 "2021-03-31T11:01:41Z")

</div>

Hi. I have about 4 TB of data I want to index in Elasticsearch. The amount of data per index will vary, depending on the source data file. These are only static files containing old data that will be ingested and made s…

---

## [Search multiple values for a single field](https://discuss.elastic.co/t/search-multiple-values-for-a-single-field/268327)

<div class="topic-metadata">

**Author:** [@subham\_p](https://discuss.elastic.co/u/subham_p)\
**Replies:** 12\
**Last updated:** [March 31, 2021, 11:52am UTC](https://discuss.elastic.co/t/search-multiple-values-for-a-single-field/268327 "2021-03-31T11:52:42Z")

</div>

Hii.. All , I am pretty new in elk search, I want to find out multiple values for a single field (diseases:” fever,covid\_19”) with in a must with wildcard condition here the data is like this Diseases: “fever, headache…

---

## [Date Range Not Working with Now](https://discuss.elastic.co/t/date-range-not-working-with-now/268825)

<div class="topic-metadata">

**Author:** [@rohan\_5894](https://discuss.elastic.co/u/rohan_5894)\
**Replies:** 8\
**Last updated:** [March 31, 2021, 11:50am UTC](https://discuss.elastic.co/t/date-range-not-working-with-now/268825 "2021-03-31T11:50:38Z")

</div>

I am trying to show only those documents where published\_at date is less than now-7d/d. #It seems ES is not working correctly here. I tried with an example of showing documents which are having published\_at filed greater…

---

## [Install elasticsearch on apache](https://discuss.elastic.co/t/install-elasticsearch-on-apache/268875)

<div class="topic-metadata">

**Author:** [@alexkr](https://discuss.elastic.co/u/alexkr)\
**Replies:** 5\
**Last updated:** [March 31, 2021, 10:40am UTC](https://discuss.elastic.co/t/install-elasticsearch-on-apache/268875 "2021-03-31T10:40:30Z")

</div>

Hey I try to install elasticsearch on my centos 7 but all the installation guide are using ngxin and I need to install it on apache server. Someone did it and please can send me how to do it?

---

## [Exact phrase near other terms](https://discuss.elastic.co/t/exact-phrase-near-other-terms/268893)

<div class="topic-metadata">

**Author:** [@rd8388](https://discuss.elastic.co/u/rd8388)\
**Replies:** 0\
**Last updated:** [March 31, 2021, 10:20am UTC](https://discuss.elastic.co/t/exact-phrase-near-other-terms/268893 "2021-03-31T10:20:34Z")

</div>

Is there a way to search for one or more exact phrases near one or more other terms/phrases? I'm using MatchPhrase with slop zero to find exact phrases fine and using Match to find two or more terms near each other but …

---

## [Elasticsearch or Kibana How to merge two \_id data](https://discuss.elastic.co/t/elasticsearch-or-kibana-how-to-merge-two-id-data/268887)

<div class="topic-metadata">

**Author:** [@Ivan\_chen](https://discuss.elastic.co/u/Ivan_chen)\
**Replies:** 0\
**Last updated:** [March 31, 2021, 9:21am UTC](https://discuss.elastic.co/t/elasticsearch-or-kibana-how-to-merge-two-id-data/268887 "2021-03-31T09:21:35Z")

</div>

Hi I use metricbeat redis moduls My data have two event.dataset in one index I want merge data , Show on kibana data table 1.redis.info Host version 127.0.0.1 5.0.8 127.0.0.2 3.2.0 127.0.0.3 5.0.8 2.re…

---

## [Shrink unable to allocate index due to initial\_recovery setting](https://discuss.elastic.co/t/shrink-unable-to-allocate-index-due-to-initial-recovery-setting/268813)

<div class="topic-metadata">

**Author:** [@toby\_jn](https://discuss.elastic.co/u/toby_jn)\
**Replies:** 4\
**Last updated:** [March 31, 2021, 9:38am UTC](https://discuss.elastic.co/t/shrink-unable-to-allocate-index-due-to-initial-recovery-setting/268813 "2021-03-31T09:38:43Z")

</div>

We ran into a very strange issue with index shrink following recovery from a complete cluster network outage. The outage appears to have taken place in the middle of a shrink operation and following the restart the shrin…

---

## [Issue with query\_string query](https://discuss.elastic.co/t/issue-with-query-string-query/268889)

<div class="topic-metadata">

**Author:** [@arthur\_th](https://discuss.elastic.co/u/arthur_th)\
**Replies:** 0\
**Last updated:** [March 31, 2021, 9:28am UTC](https://discuss.elastic.co/t/issue-with-query-string-query/268889 "2021-03-31T09:28:17Z")

</div>

Hello, I am new to the Elastic stack, I want to do a specific search and it doesn't seem to work. I want to search for a regex respecting word order. For example this would be a query with query\_string: '(/Cytochrome\[…

---

## [Certificate issue with elasticsearch SSL](https://discuss.elastic.co/t/certificate-issue-with-elasticsearch-ssl/268659)

<div class="topic-metadata">

**Author:** [@Gauti](https://discuss.elastic.co/u/Gauti)\
**Replies:** 4\
**Last updated:** [March 31, 2021, 9:07am UTC](https://discuss.elastic.co/t/certificate-issue-with-elasticsearch-ssl/268659 "2021-03-31T09:07:23Z")

</div>

Hi All, We have created a self signed certificate for elasticsearch to use elastic through https, all working good with self signed certificate ( which is not a trusted certificate) Now we got a trusted certificate and…

---

## [Multi tenant cluster architecture](https://discuss.elastic.co/t/multi-tenant-cluster-architecture/268841)

<div class="topic-metadata">

**Author:** [@liorg2](https://discuss.elastic.co/u/liorg2)\
**Replies:** 2\
**Last updated:** [March 31, 2021, 6:15am UTC](https://discuss.elastic.co/t/multi-tenant-cluster-architecture/268841 "2021-03-31T06:15:22Z")

</div>

How would you design a multi tenant cluster in eladtic 7.12? Should support 5000 tenants . Some have less than 100mb of data and some 150 gb or more. I thought of having shared datastream for the small ones, and dedicat…

---

## [Script query - iterating through nested docs](https://discuss.elastic.co/t/script-query-iterating-through-nested-docs/268877)

<div class="topic-metadata">

**Author:** [@bruno\_v](https://discuss.elastic.co/u/bruno_v)\
**Replies:** 0\
**Last updated:** [March 31, 2021, 8:20am UTC](https://discuss.elastic.co/t/script-query-iterating-through-nested-docs/268877 "2021-03-31T08:20:14Z")

</div>

I have the following nested property in my mapping: "books": { "type": "nested", "properties": { "book\_id": { "type": "keyword" }, "book\_name": { "type": "keyword" } …

---

## [How get object in script in aggregations](https://discuss.elastic.co/t/how-get-object-in-script-in-aggregations/268082)

<div class="topic-metadata">

**Author:** [@Marina\_S](https://discuss.elastic.co/u/Marina_S)\
**Replies:** 2\
**Last updated:** [March 23, 2021, 12:26pm UTC](https://discuss.elastic.co/t/how-get-object-in-script-in-aggregations/268082 "2021-03-23T12:26:31Z")

</div>

I have this object which have ArrayList wirh objects "sizeData" : { "id" : 1, "elasticSizeScale" : { "id" : 3, "sizes" : \[ { "id" : 321, …

---

## [Elasticsearch giving query\_shard\_exception for query\_string](https://discuss.elastic.co/t/elasticsearch-giving-query-shard-exception-for-query-string/268556)

<div class="topic-metadata">

**Author:** [@surajdalvi](https://discuss.elastic.co/u/surajdalvi)\
**Replies:** 1\
**Last updated:** [March 31, 2021, 8:01am UTC](https://discuss.elastic.co/t/elasticsearch-giving-query-shard-exception-for-query-string/268556 "2021-03-31T08:01:47Z")

</div>

I am storing URL in the elastic search and I making the following request to get a result for elastic search: { "query\_string": { "query": "\*http://localhost:8000/v3/a…

---

## [Unable to configure the filebeat with open distro for elasticsearch](https://discuss.elastic.co/t/unable-to-configure-the-filebeat-with-open-distro-for-elasticsearch/268799)

<div class="topic-metadata">

**Author:** [@shai](https://discuss.elastic.co/u/shai)\
**Replies:** 2\
**Last updated:** [March 31, 2021, 7:43am UTC](https://discuss.elastic.co/t/unable-to-configure-the-filebeat-with-open-distro-for-elasticsearch/268799 "2021-03-31T07:43:01Z")

</div>

hi team, unable to configure filebeat with open distro for elasticsearch. Please tell me where should be change according to open distro for elastic search

---

## [Index template creation: can we parameterize the shards and replica](https://discuss.elastic.co/t/index-template-creation-can-we-parameterize-the-shards-and-replica/268811)

<div class="topic-metadata">

**Author:** [@raja\_augstin](https://discuss.elastic.co/u/raja_augstin)\
**Replies:** 8\
**Last updated:** [March 31, 2021, 7:36am UTC](https://discuss.elastic.co/t/index-template-creation-can-we-parameterize-the-shards-and-replica/268811 "2021-03-31T07:36:04Z")

</div>

can't we parameterize index shards and replicas in index template. { "index\_template\_1": { "index\_patterns": \[ "\*" \], "settings": { "index": { "analysis": { "analyzer": { "index\_edgeNGram\_analyzer": { "filter"…

[Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=671)

[Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=673)
