# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=673 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 674 --- ## [How to find the time difference between two documents (rows in sql) in an index (table in sql) with same Id](https://discuss.elastic.co/t/how-to-find-the-time-difference-between-two-documents-rows-in-sql-in-an-index-table-in-sql-with-same-id/268782)
**Author:** [@imganeshr](https://discuss.elastic.co/u/imganeshr)\ **Replies:** 4\ **Last updated:** [March 31, 2021, 7:12am UTC](https://discuss.elastic.co/t/how-to-find-the-time-difference-between-two-documents-rows-in-sql-in-an-index-table-in-sql-with-same-id/268782 "2021-03-31T07:12:13Z")
Hello Everyone, I am new to Elastic Search and Kibana Query Language. I would like to find the time difference between the two documents which have the id as common between them as like below. TimeStamp … --- ## [Indexing performance degraded in Elasticsearch 7.10](https://discuss.elastic.co/t/indexing-performance-degraded-in-elasticsearch-7-10/267938)
**Author:** [@shamzeer](https://discuss.elastic.co/u/shamzeer)\ **Replies:** 2\ **Last updated:** [March 31, 2021, 6:28am UTC](https://discuss.elastic.co/t/indexing-performance-degraded-in-elasticsearch-7-10/267938 "2021-03-31T06:28:01Z")
Hi, As per the blog below, there is considerable improvement made in Elasticsearch 7.10 in data storage needs. https://www.elastic.co/blog/save-space-and-money-with-improved-storage-efficiency-in-elasticsearch-7-10. I… --- ## [OpenSource Framework Solution](https://discuss.elastic.co/t/opensource-framework-solution/268865)
**Author:** [@maheshballa](https://discuss.elastic.co/u/maheshballa)\ **Replies:** 1\ **Last updated:** [March 31, 2021, 6:20am UTC](https://discuss.elastic.co/t/opensource-framework-solution/268865 "2021-03-31T06:20:05Z")
Hello All, We are developing an open source Diagnostic solutions which works on Oracle products. During this process, we have enough logs generated, and we want to use ELK (Open Source) for visualization and analysis o… --- ## [For an I/O block on a machine in the ES cluster, how can I set it so that ES returns a 504 timeout and then tries to poll the node to retry](https://discuss.elastic.co/t/for-an-i-o-block-on-a-machine-in-the-es-cluster-how-can-i-set-it-so-that-es-returns-a-504-timeout-and-then-tries-to-poll-the-node-to-retry/268857)
**Author:** [@serug](https://discuss.elastic.co/u/serug)\ **Replies:** 0\ **Last updated:** [March 31, 2021, 2:59am UTC](https://discuss.elastic.co/t/for-an-i-o-block-on-a-machine-in-the-es-cluster-how-can-i-set-it-so-that-es-returns-a-504-timeout-and-then-tries-to-poll-the-node-to-retry/268857 "2021-03-31T02:59:28Z")
I have a question to ask . The scenario is that one of the machines in my ES(6.7) cluster is blocked by I/O, which causes the ES request to be blocked as well, thus causing the thread pool resource depletion. I would li… --- ## [Default index template for streams](https://discuss.elastic.co/t/default-index-template-for-streams/268847)
**Author:** [@craigothy](https://discuss.elastic.co/u/craigothy)\ **Replies:** 0\ **Last updated:** [March 30, 2021, 11:52pm UTC](https://discuss.elastic.co/t/default-index-template-for-streams/268847 "2021-03-30T23:52:52Z")
Is there a way to create a default index template for the newer streams from the Elastic Agent for example. I am wanting to set the replica count to 0 for all streams. This was pretty easy to do for the legacy templates … --- ## [Snapshot Failures in elastic cloud 's elastic search](https://discuss.elastic.co/t/snapshot-failures-in-elastic-cloud-s-elastic-search/268846)
**Author:** [@saelastic](https://discuss.elastic.co/u/saelastic)\ **Replies:** 3\ **Last updated:** [March 31, 2021, 1:19am UTC](https://discuss.elastic.co/t/snapshot-failures-in-elastic-cloud-s-elastic-search/268846 "2021-03-31T01:19:22Z")
Our current elastic stack is not healthy by snapshot failures. We have about 800 primary shards and all of them fail with the same error during snapshot as below. Could some one help us understand the error in depth tha… --- ## [Trouble getting ILM to work for externally created index](https://discuss.elastic.co/t/trouble-getting-ilm-to-work-for-externally-created-index/268766)
**Author:** [@runtman](https://discuss.elastic.co/u/runtman)\ **Replies:** 0\ **Last updated:** [March 30, 2021, 9:59am UTC](https://discuss.elastic.co/t/trouble-getting-ilm-to-work-for-externally-created-index/268766 "2021-03-30T09:59:33Z")
Hello, I am using a kafka service from a supplier called Aiven, they have a connector which can push logs to elasticsearch. They push the logs into a daily index called: kafka-YYYY-MM-DD . Now I tried to create an inde… --- ## [Rally race gets stuck on check-cluster-health](https://discuss.elastic.co/t/rally-race-gets-stuck-on-check-cluster-health/268815)
**Author:** [@Ellie\_Bird](https://discuss.elastic.co/u/Ellie_Bird)\ **Replies:** 4\ **Last updated:** [March 30, 2021, 4:24pm UTC](https://discuss.elastic.co/t/rally-race-gets-stuck-on-check-cluster-health/268815 "2021-03-30T16:24:36Z")
When I use the track from repository, it works without any problem. Now, I created the track data from existing cluster. and hanging at the stage of 'check-cluster-health'. I am using esrally version 2.0.4 elasticsear… --- ## [Elasticsearch API Search query does not give correct results between timestamp range](https://discuss.elastic.co/t/elasticsearch-api-search-query-does-not-give-correct-results-between-timestamp-range/268786)
**Author:** [@suresh123](https://discuss.elastic.co/u/suresh123)\ **Replies:** 1\ **Last updated:** [March 30, 2021, 2:01pm UTC](https://discuss.elastic.co/t/elasticsearch-api-search-query-does-not-give-correct-results-between-timestamp-range/268786 "2021-03-30T14:01:25Z")
Hello Guys, I have been facing this issue for last 2 days. Can anyone pls help on below issue. Am able to get exact hit counts for example 750755, but field results am not getting between timestamp range. Only few resu… --- ## [Understanding IndexShardSnapshotFailedException](https://discuss.elastic.co/t/understanding-indexshardsnapshotfailedexception/268783)
**Author:** [@Kambing](https://discuss.elastic.co/u/Kambing)\ **Replies:** 1\ **Last updated:** [March 30, 2021, 11:56am UTC](https://discuss.elastic.co/t/understanding-indexshardsnapshotfailedexception/268783 "2021-03-30T11:56:39Z")
I have several snapshot policy, most of them were success to execute and create snapshot, but sometimes I got some shard failed with message "INTERNAL\_SERVER\_ERROR: Aborted", when I look at the snapshot policy history, I… --- ## [Running Elasticsearch](https://discuss.elastic.co/t/running-elasticsearch/268768)
**Author:** [@Ullubiy\_Abdurakhmano](https://discuss.elastic.co/u/Ullubiy_Abdurakhmano)\ **Replies:** 1\ **Last updated:** [March 30, 2021, 10:30am UTC](https://discuss.elastic.co/t/running-elasticsearch/268768 "2021-03-30T10:30:38Z")
Hi. Can anyone help me? I try to run elastic from the command promt, but wright that elasticsearch is running already and I get error like this: \[2021-03-29T07:57:23,485\]\[ERROR\]\[o.e.b.Bootstrap \] \[User\] Exception java… --- ## [The \[0.0.0\] version of the \[jdbc\] client is not compatible with Elasticsearch version \[7.10.0\];\]](https://discuss.elastic.co/t/the-0-0-0-version-of-the-jdbc-client-is-not-compatible-with-elasticsearch-version-7-10-0/267462)
**Author:** [@yxmm-wxe](https://discuss.elastic.co/u/yxmm-wxe)\ **Replies:** 3\ **Last updated:** [March 30, 2021, 9:52am UTC](https://discuss.elastic.co/t/the-0-0-0-version-of-the-jdbc-client-is-not-compatible-with-elasticsearch-version-7-10-0/267462 "2021-03-30T09:52:28Z")
Hello, everyone, I have a strange problem with the JDBC driver version after packaging. \ \org.elasticsearch.plugin\ \x-pack-sql-jdbc\ \7.10.0\ **Author:** [@ssouris](https://discuss.elastic.co/u/ssouris)\ **Replies:** 2\ **Last updated:** [March 30, 2021, 9:31am UTC](https://discuss.elastic.co/t/during-maintenance-all-writes-on-new-shards-targeted-one-node-leading-to-document-rejections/268681 "2021-03-30T09:31:43Z") Hi Elasticsearch experts :slight\_smile: During one of our maintenances of the cluster, we needed to restart a node to add more disk space to it. So we made sure no shards were located on that node, and we performed th… --- ## [TLS implementation for Elasticsearch in Openshift](https://discuss.elastic.co/t/tls-implementation-for-elasticsearch-in-openshift/268287)
**Author:** [@Janakiraman](https://discuss.elastic.co/u/Janakiraman)\ **Replies:** 2\ **Last updated:** [March 30, 2021, 9:26am UTC](https://discuss.elastic.co/t/tls-implementation-for-elasticsearch-in-openshift/268287 "2021-03-30T09:26:52Z")
Hi team, I am trying to implement TLS for single node elasticsearch(v 7.4.1) and when i try to run the elastic cert utility i am facing the below error. can you help me in providing a path to fix this? note: i do not ha… --- ## [Error when querying on search\_as\_you\_type subfields (.\_2gram, .\_3gram)](https://discuss.elastic.co/t/error-when-querying-on-search-as-you-type-subfields-2gram-3gram/268751)
**Author:** [@mariskaas](https://discuss.elastic.co/u/mariskaas)\ **Replies:** 0\ **Last updated:** [March 30, 2021, 8:56am UTC](https://discuss.elastic.co/t/error-when-querying-on-search-as-you-type-subfields-2gram-3gram/268751 "2021-03-30T08:56:42Z")
Hi there. I've been trying to use search\_as\_you\_type for an autocomplete solution. I've mapped a field as the "search\_as\_you\_type" type, however when trying to query on the field, the .\_2gram and .\_3gram field, as descri… --- ## [Error deleting entry from .triggered\_watches for watch](https://discuss.elastic.co/t/error-deleting-entry-from-triggered-watches-for-watch/268734)
**Author:** [@vaclav1](https://discuss.elastic.co/u/vaclav1)\ **Replies:** 1\ **Last updated:** [March 30, 2021, 7:30am UTC](https://discuss.elastic.co/t/error-deleting-entry-from-triggered-watches-for-watch/268734 "2021-03-30T07:30:23Z")
Hello, recently we have experienced this issue: \[2021-03-30T08:08:54,049\]\[ERROR\]\[o.e.x.w.e.ExecutionService\] \[logstashatp4\] Error deleting entry from .triggered\_watches for watch \[bYsk9A5mRbimxYswp5ogTg\_xpack\_license\_e… --- ## [Elasticsearch directory permission](https://discuss.elastic.co/t/elasticsearch-directory-permission/268611)
**Author:** [@twilight](https://discuss.elastic.co/u/twilight)\ **Replies:** 8\ **Last updated:** [March 30, 2021, 5:48am UTC](https://discuss.elastic.co/t/elasticsearch-directory-permission/268611 "2021-03-30T05:48:10Z")
Hello, I just installed elasticsearch 7.12.0 rpm package on AWS Linux AMI, when I try to access the config directory, it says "permission denied". this is the directory detail. $ ls -l drwxr-s--- 3 root elasticsearc… --- ## [Using NEST](https://discuss.elastic.co/t/using-nest/268724)
**Author:** [@S\_Y](https://discuss.elastic.co/u/S_Y)\ **Replies:** 0\ **Last updated:** [March 30, 2021, 5:22am UTC](https://discuss.elastic.co/t/using-nest/268724 "2021-03-30T05:22:09Z")
Hello guys I'm using version is elasticsearch 7.11 and NEST 7.0.0 / Elasticsearch.Net 7.0.0 in .Net stendard 2.0 Unity3D but I can't used this client package because this error " Assets\\Script\\BulkScript.cs(10,7): erro… --- ## [ElasticSearch security set up documentation is Byzantine](https://discuss.elastic.co/t/elasticsearch-security-set-up-documentation-is-byzantine/268722)
**Author:** [@lachlan.simpson](https://discuss.elastic.co/u/lachlan.simpson)\ **Replies:** 1\ **Last updated:** [March 30, 2021, 4:41am UTC](https://discuss.elastic.co/t/elasticsearch-security-set-up-documentation-is-byzantine/268722 "2021-03-30T04:41:45Z")
I am setting up a testing instance in house. Single node, with proof of concept reporting. Elastic, Kibana, Beats, using the free software only. There is no indication that ElasticSearch is securable on the free license… --- ## [Clarification on multiple indices](https://discuss.elastic.co/t/clarification-on-multiple-indices/268705)
**Author:** [@Amphagory](https://discuss.elastic.co/u/Amphagory)\ **Replies:** 2\ **Last updated:** [March 30, 2021, 3:18am UTC](https://discuss.elastic.co/t/clarification-on-multiple-indices/268705 "2021-03-30T03:18:54Z")
I'm new to creating ILM on Elasticsearch version 7.3.2 and have a noob question as follow: The setup: I have two indices index\_a & index\_b, I want to use the same index lifecycle policy. The question: Wouild I create… --- ## [SSL error from Elastic webhook. What does it mean?](https://discuss.elastic.co/t/ssl-error-from-elastic-webhook-what-does-it-mean/268471)
**Author:** [@Sandra\_Schlichting](https://discuss.elastic.co/u/Sandra_Schlichting)\ **Replies:** 2\ **Last updated:** [March 30, 2021, 3:01am UTC](https://discuss.elastic.co/t/ssl-error-from-elastic-webhook-what-does-it-mean/268471 "2021-03-30T03:01:22Z")
Dear all =) I have created a webhook in Elastic, but when Elastic connects to the client it logs SSL\_accept: ssl/record/ssl3\_record.c:322: error:1408F09C:SSL routines:ssl3\_get\_record:http request Can anyone explain wh… --- ## [Easy way to transfer data from one node to another?](https://discuss.elastic.co/t/easy-way-to-transfer-data-from-one-node-to-another/268711)
**Author:** [@smlbiobot](https://discuss.elastic.co/u/smlbiobot)\ **Replies:** 2\ **Last updated:** [March 30, 2021, 2:34am UTC](https://discuss.elastic.co/t/easy-way-to-transfer-data-from-one-node-to-another/268711 "2021-03-30T02:34:44Z")
From time to time, we know that we have to shutdown nodes (remove a node from a cluster) and add a new one. Normally, we shutdown the node, add a new one, and just let the cluster determine the best way to re-allocate ev… --- ## [Field\_masking\_span - Not working as expected with span queries](https://discuss.elastic.co/t/field-masking-span-not-working-as-expected-with-span-queries/268704)
**Author:** [@Michael\_Sander](https://discuss.elastic.co/u/Michael_Sander)\ **Replies:** 1\ **Last updated:** [March 29, 2021, 10:30pm UTC](https://discuss.elastic.co/t/field-masking-span-not-working-as-expected-with-span-queries/268704 "2021-03-29T22:30:53Z")
Hi, I am using field\_masking\_span to find spans across two different fields, a stemmed field (text) and an unstemmed field (text.unstemed). In particular, I am trying to search for the word loss in the text field, and … --- ## [Doubts about the use of StopWords](https://discuss.elastic.co/t/doubts-about-the-use-of-stopwords/268707)
**Author:** [@RabBit\_BR](https://discuss.elastic.co/u/RabBit_BR)\ **Replies:** 0\ **Last updated:** [March 29, 2021, 9:36pm UTC](https://discuss.elastic.co/t/doubts-about-the-use-of-stopwords/268707 "2021-03-29T21:36:25Z")
Hi. I would like to ask a question about what is the best use of stop words. I have a filter (option A) with passing all stopwords and the other option is to create a filter for each language (option B). In any case wou… --- ## [Elasticsearch HighLevelRestClient batch call not updating field reliably](https://discuss.elastic.co/t/elasticsearch-highlevelrestclient-batch-call-not-updating-field-reliably/268642)
**Author:** [@MoOrth](https://discuss.elastic.co/u/MoOrth)\ **Replies:** 0\ **Last updated:** [March 29, 2021, 9:52am UTC](https://discuss.elastic.co/t/elasticsearch-highlevelrestclient-batch-call-not-updating-field-reliably/268642 "2021-03-29T09:52:01Z")
Description of the problem including expected versus actual behavior: We noticed a strange behavior with one of our ElasticSearch bulk refresh calls. If we try to update the stock field in our item index (we use one it… --- ## [Identifying the stale indices in Elasticsearch](https://discuss.elastic.co/t/identifying-the-stale-indices-in-elasticsearch/268537)
**Author:** [@vineethsuhas](https://discuss.elastic.co/u/vineethsuhas)\ **Replies:** 4\ **Last updated:** [March 29, 2021, 8:36pm UTC](https://discuss.elastic.co/t/identifying-the-stale-indices-in-elasticsearch/268537 "2021-03-29T20:36:01Z")
Hi, I want to delete the indices which are stale (Not being accessed since last month). Is there a way to identify the indices which are not in use since one month? I could not find any stats on the indices which corre… --- ## [What exactly steps should take to import custom syslog to elk](https://discuss.elastic.co/t/what-exactly-steps-should-take-to-import-custom-syslog-to-elk/268673)
**Author:** [@Depressed](https://discuss.elastic.co/u/Depressed)\ **Replies:** 4\ **Last updated:** [March 29, 2021, 6:37pm UTC](https://discuss.elastic.co/t/what-exactly-steps-should-take-to-import-custom-syslog-to-elk/268673 "2021-03-29T18:37:41Z")
hi i'm new to elk and i wanted to know what exactly should i do to receive various syslog and proccess and define filed and make dashbord? i've read some articles that points to some filter ,rule and grok stuff that i d… --- ## [Rollover exception](https://discuss.elastic.co/t/rollover-exception/268433)
**Author:** [@Narayan\_Banik](https://discuss.elastic.co/u/Narayan_Banik)\ **Replies:** 4\ **Last updated:** [March 29, 2021, 6:26pm UTC](https://discuss.elastic.co/t/rollover-exception/268433 "2021-03-29T18:26:49Z")
Hello Experts, I'm using ES 7.1.0. One index is not rolling over after reached to 40GB. Old indices rolled over successfully. Here is the below error: { "indices" : { "classicapps-2021.03.25-000068" : { "i… --- ## [Convert parent doc to child doc in 6.6](https://discuss.elastic.co/t/convert-parent-doc-to-child-doc-in-6-6/268683)
**Author:** [@kgeographer](https://discuss.elastic.co/u/kgeographer)\ **Replies:** 0\ **Last updated:** [March 29, 2021, 5:54pm UTC](https://discuss.elastic.co/t/convert-parent-doc-to-child-doc-in-6-6/268683 "2021-03-29T17:54:03Z")
In a 6.6 index, I have a join field 'relation' like so: "relation": { "type": "join", "relations": { "parent": "child" } Several hundred parent docs need to become children to another existing parent doc. I h… --- ## [Data node high CPU usage - find job/query](https://discuss.elastic.co/t/data-node-high-cpu-usage-find-job-query/268666)
**Author:** [@MMH](https://discuss.elastic.co/u/MMH)\ **Replies:** 0\ **Last updated:** [March 29, 2021, 2:24pm UTC](https://discuss.elastic.co/t/data-node-high-cpu-usage-find-job-query/268666 "2021-03-29T14:24:18Z")
I am observing very high CPU usage on data nodes in my 7.9 ES cluster: It happens during "business hours" so I am suspecting one of the applications is issuing a query (or multiple queries) that is causing such high C… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=672) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=674)