# Elasticsearch

**URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=679

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 680

---

## [Elastic Search Null pointer exception in two different join types while fetching their parents](https://discuss.elastic.co/t/elastic-search-null-pointer-exception-in-two-different-join-types-while-fetching-their-parents/267922)

<div class="topic-metadata">

**Author:** [@Syed\_ali\_abbas\_shah](https://discuss.elastic.co/u/Syed_ali_abbas_shah)\
**Replies:** 0\
**Last updated:** [March 21, 2021, 11:00pm UTC](https://discuss.elastic.co/t/elastic-search-null-pointer-exception-in-two-different-join-types-while-fetching-their-parents/267922 "2021-03-21T23:00:58Z")

</div>

I have very simple mapping in Elastic Search 6.x version, and following is my mapping with two different types bookmarks user can also be bookmarked and post can also be bookmarked, { "properties": { "type": { …

---

## [Best way to handle "circuit\_breaking\_exception"](https://discuss.elastic.co/t/best-way-to-handle-circuit-breaking-exception/267913)

<div class="topic-metadata">

**Author:** [@Leibo](https://discuss.elastic.co/u/Leibo)\
**Replies:** 0\
**Last updated:** [March 21, 2021, 4:13pm UTC](https://discuss.elastic.co/t/best-way-to-handle-circuit-breaking-exception/267913 "2021-03-21T16:13:50Z")

</div>

Hi, Our micro-service is written in Java. We are facing the "circuit\_breaking\_exception" exception occasionally while trying to index documents from multiple threads. How is the best way to handle it without changing …

---

## [Possiblities of bucket level subtraction](https://discuss.elastic.co/t/possiblities-of-bucket-level-subtraction/267911)

<div class="topic-metadata">

**Author:** [@venkat\_swaminathan](https://discuss.elastic.co/u/venkat_swaminathan)\
**Replies:** 0\
**Last updated:** [March 21, 2021, 3:46pm UTC](https://discuss.elastic.co/t/possiblities-of-bucket-level-subtraction/267911 "2021-03-21T15:46:36Z")

</div>

Good Day, I am collecting metric information from my provider and pushing them to ES through a python script. all I need to do is subtract "MetricName" , (i.e: Count - 5xx) with respect to time on total system availabi…

---

## [Elastic node js client point in time syntax](https://discuss.elastic.co/t/elastic-node-js-client-point-in-time-syntax/267903)

<div class="topic-metadata">

**Author:** [@111452](https://discuss.elastic.co/u/111452)\
**Replies:** 0\
**Last updated:** [March 21, 2021, 10:13am UTC](https://discuss.elastic.co/t/elastic-node-js-client-point-in-time-syntax/267903 "2021-03-21T10:13:58Z")

</div>

Can someone show me the right syntax for using point in time in elastic search on node js client. I'm trying like this: const body = { query: { geo\_shape: { geometry: { relation: 'wit…

---

## [Data stream](https://discuss.elastic.co/t/data-stream/267901)

<div class="topic-metadata">

**Author:** [@dziri63](https://discuss.elastic.co/u/dziri63)\
**Replies:** 0\
**Last updated:** [March 21, 2021, 9:31am UTC](https://discuss.elastic.co/t/data-stream/267901 "2021-03-21T09:31:35Z")

</div>

Hello Can I use data stream indices without fleet ? For example i have a tcp input on a port ( logstash or filebeat doesnt matter) i want index it in a datastream index how can i do that ? thanks in advance

---

## [Using Nest, queries returning with 0 hits](https://discuss.elastic.co/t/using-nest-queries-returning-with-0-hits/267037)

<div class="topic-metadata">

**Author:** [@asimsek99](https://discuss.elastic.co/u/asimsek99)\
**Replies:** 4\
**Last updated:** [March 21, 2021, 9:22am UTC](https://discuss.elastic.co/t/using-nest-queries-returning-with-0-hits/267037 "2021-03-21T09:22:30Z")

</div>

Hey hey, Env: .net Core, Nest, Elasticsearch I had my queries running with using Logstash and Elastic with AWS. Decided to not use logstash and move to cloud.elastic.co. Trying to migrate the current queries to cloud.…

---

## [Performance implications for elasticsearch when specifying fields that won't be in the indexed documents?](https://discuss.elastic.co/t/performance-implications-for-elasticsearch-when-specifying-fields-that-wont-be-in-the-indexed-documents/267858)

<div class="topic-metadata">

**Author:** [@Supermathie](https://discuss.elastic.co/u/Supermathie)\
**Replies:** 0\
**Last updated:** [March 19, 2021, 8:18pm UTC](https://discuss.elastic.co/t/performance-implications-for-elasticsearch-when-specifying-fields-that-wont-be-in-the-indexed-documents/267858 "2021-03-19T20:18:03Z")

</div>

I'm working on switching to using the ECS toolchain for our indices (mostly logs). The usage notes for the generator say: If your indices will never populate particular ECS fields, there's no need to include those fie…

---

## [How to delete a data node](https://discuss.elastic.co/t/how-to-delete-a-data-node/267511)

<div class="topic-metadata">

**Author:** [@smm](https://discuss.elastic.co/u/smm)\
**Replies:** 1\
**Last updated:** [March 20, 2021, 6:46am UTC](https://discuss.elastic.co/t/how-to-delete-a-data-node/267511 "2021-03-20T06:46:03Z")

</div>

Hi there, I would like to delete one of many data nodes in production. There is stille plenty of space and the data node has only this role. Life can be so simple: stop the service and delte the machine. Is this all,…

---

## [How to set up a highly available elasticsearch cluster locally?](https://discuss.elastic.co/t/how-to-set-up-a-highly-available-elasticsearch-cluster-locally/267803)

<div class="topic-metadata">

**Author:** [@Belgacem\_Ghiloufi](https://discuss.elastic.co/u/Belgacem_Ghiloufi)\
**Replies:** 4\
**Last updated:** [March 19, 2021, 8:05pm UTC](https://discuss.elastic.co/t/how-to-set-up-a-highly-available-elasticsearch-cluster-locally/267803 "2021-03-19T20:05:13Z")

</div>

I am new to Elasticsearch and I want to set up a highly available Elasticsearch cluster on one machine to test and learn how to use Elasticsearch. I hope that when the master node fails, one of the other nodes will take …

---

## [Index mapping changed from object to nested and reindex](https://discuss.elastic.co/t/index-mapping-changed-from-object-to-nested-and-reindex/266373)

<div class="topic-metadata">

**Author:** [@Clony](https://discuss.elastic.co/u/Clony)\
**Replies:** 1\
**Last updated:** [March 19, 2021, 5:26pm UTC](https://discuss.elastic.co/t/index-mapping-changed-from-object-to-nested-and-reindex/266373 "2021-03-19T17:26:04Z")

</div>

Hello I want to change an index property which is object (default) to nested type and keep the data. The process I'm following is creating a new index with the new mappings then use the reindex API. The problem comes wh…

---

## [\_index field filter performance VS index name in url](https://discuss.elastic.co/t/index-field-filter-performance-vs-index-name-in-url/266572)

<div class="topic-metadata">

**Author:** [@Abbass](https://discuss.elastic.co/u/Abbass)\
**Replies:** 4\
**Last updated:** [March 19, 2021, 3:33pm UTC](https://discuss.elastic.co/t/index-field-filter-performance-vs-index-name-in-url/266572 "2021-03-19T15:33:18Z")

</div>

From performance perspective, does filtering on \_index field behave as if i've set the index name in the URL? GET log-\*/\_doc/\_search { "query": { "bool": { "must": \[ { "term": { …

---

## ["No Added Sugar" and "Added Sugar" term match](https://discuss.elastic.co/t/no-added-sugar-and-added-sugar-term-match/267730)

<div class="topic-metadata">

**Author:** [@Alan88](https://discuss.elastic.co/u/Alan88)\
**Replies:** 3\
**Last updated:** [March 19, 2021, 3:17pm UTC](https://discuss.elastic.co/t/no-added-sugar-and-added-sugar-term-match/267730 "2021-03-19T15:17:01Z")

</div>

I'm looking for a way to tell elasticsearch that "no added sugar" and "added sugar" are separate phrases and should be indexed accordingly. I do not want them to conflate or conflict with each other. Docs example: "Col…

---

## [How to Get a Raw Logs Copy from elasticsearch](https://discuss.elastic.co/t/how-to-get-a-raw-logs-copy-from-elasticsearch/266326)

<div class="topic-metadata">

**Author:** [@ajesh](https://discuss.elastic.co/u/ajesh)\
**Replies:** 6\
**Last updated:** [March 19, 2021, 3:11pm UTC](https://discuss.elastic.co/t/how-to-get-a-raw-logs-copy-from-elasticsearch/266326 "2021-03-19T15:11:42Z")

</div>

Hi Team, We are currently sending all our audit logs to elasticsearch cluster using filebeat and auditbeat ( Logstash is not used) , Can we get the raw copy of logs or some log forwarder can be used in elasticsearch to …

---

## [Add local json file into elasticsearch](https://discuss.elastic.co/t/add-local-json-file-into-elasticsearch/267819)

<div class="topic-metadata">

**Author:** [@feyn\_mak](https://discuss.elastic.co/u/feyn_mak)\
**Replies:** 1\
**Last updated:** [March 19, 2021, 2:48pm UTC](https://discuss.elastic.co/t/add-local-json-file-into-elasticsearch/267819 "2021-03-19T14:48:13Z")

</div>

Hi, how do i add a json file e.g { "0": "passage 1", "1":"passage 2", "2":"passage 3" } into elasticsearch? Thank you so much for your help!

---

## [Search in all given filed but it return only match filed. so i can send those value on front end](https://discuss.elastic.co/t/search-in-all-given-filed-but-it-return-only-match-filed-so-i-can-send-those-value-on-front-end/267770)

<div class="topic-metadata">

**Author:** [@mayank\_hardiya](https://discuss.elastic.co/u/mayank_hardiya)\
**Replies:** 0\
**Last updated:** [March 19, 2021, 9:16am UTC](https://discuss.elastic.co/t/search-in-all-given-filed-but-it-return-only-match-filed-so-i-can-send-those-value-on-front-end/267770 "2021-03-19T09:16:53Z")

</div>

My query - client.search({ index: indexname, body: { query: { multi\_match: { query: req.query.search, fields: \["description","name","hostname","username","category\_name"\], } }, } }, it return - \[ { "\_index"…

---

## [Data tiering (hot, warm and cold storage)](https://discuss.elastic.co/t/data-tiering-hot-warm-and-cold-storage/267814)

<div class="topic-metadata">

**Author:** [@parthmaniar](https://discuss.elastic.co/u/parthmaniar)\
**Replies:** 0\
**Last updated:** [March 19, 2021, 1:29pm UTC](https://discuss.elastic.co/t/data-tiering-hot-warm-and-cold-storage/267814 "2021-03-19T13:29:35Z")

</div>

Hello, I am a self-funded student with a homelab wherein I am capturing honeypot logs. I have a workstation with SSD storage wherein one disk holds the VMs OS (Ubuntu server 20.04.2 LTS), and the second SSD contains a da…

---

## [Can elasticsearch help in seo](https://discuss.elastic.co/t/can-elasticsearch-help-in-seo/267622)

<div class="topic-metadata">

**Author:** [@fatheyabelslam](https://discuss.elastic.co/u/fatheyabelslam)\
**Replies:** 3\
**Last updated:** [March 19, 2021, 12:10pm UTC](https://discuss.elastic.co/t/can-elasticsearch-help-in-seo/267622 "2021-03-19T12:10:39Z")

</div>

Hi, I working with yoast.js The main use of it is to analyze content and return score of content based on google requirements for best content structure And i think :thinking: that elasticsearch is the best in unders…

---

## [Elasticsearch bulk insertion issue: 403 request throttled due to too many requests](https://discuss.elastic.co/t/elasticsearch-bulk-insertion-issue-403-request-throttled-due-to-too-many-requests/267748)

<div class="topic-metadata">

**Author:** [@divakar](https://discuss.elastic.co/u/divakar)\
**Replies:** 16\
**Last updated:** [March 19, 2021, 11:13am UTC](https://discuss.elastic.co/t/elasticsearch-bulk-insertion-issue-403-request-throttled-due-to-too-many-requests/267748 "2021-03-19T11:13:36Z")

</div>

I have following cluster configuration of ES on AWS: Instance Type: t2.small.elasticsearch Number of Nodes: 1 EBS Volume Type: GP2 EBS Volume Size: 10 GiB Heap size: 1 GiB I am trying to index around 20000 document…

---

## [Is it possible to Return only one filed with Id](https://discuss.elastic.co/t/is-it-possible-to-return-only-one-filed-with-id/267664)

<div class="topic-metadata">

**Author:** [@mayank\_hardiya](https://discuss.elastic.co/u/mayank_hardiya)\
**Replies:** 2\
**Last updated:** [March 19, 2021, 9:03am UTC](https://discuss.elastic.co/t/is-it-possible-to-return-only-one-filed-with-id/267664 "2021-03-19T09:03:18Z")

</div>

\[ { "\_index": "onlive", "\_type": "\_doc", "\_id": "584", "\_score": 1, "\_source": { "description": "Free group Yoga session !!! for all levels Experience authentic Yoga from ancient scriptures", "name": "Free Yoga 1…

---

## [Is the below sizing fits for mentioned use case?](https://discuss.elastic.co/t/is-the-below-sizing-fits-for-mentioned-use-case/266855)

<div class="topic-metadata">

**Author:** [@Jax\_dev](https://discuss.elastic.co/u/Jax_dev)\
**Replies:** 12\
**Last updated:** [March 19, 2021, 9:01am UTC](https://discuss.elastic.co/t/is-the-below-sizing-fits-for-mentioned-use-case/266855 "2021-03-19T09:01:39Z")

</div>

I have been reading many documents to understand about sizing about elastic search... Data load: 9k transactions per second Each transaction contains around 1kb of data. Per second, 9k inserts and 50k search queries w…

---

## [Got error "No processor type exists with name \[attachment\]](https://discuss.elastic.co/t/got-error-no-processor-type-exists-with-name-attachment/267741)

<div class="topic-metadata">

**Author:** [@lxia](https://discuss.elastic.co/u/lxia)\
**Replies:** 4\
**Last updated:** [March 19, 2021, 8:57am UTC](https://discuss.elastic.co/t/got-error-no-processor-type-exists-with-name-attachment/267741 "2021-03-19T08:57:20Z")

</div>

have installed ingest-attachment on the host, and also restart the service "sudo systemctl restart elasticsearch.service". and get the message on the host: elasticsearch@CNSHZ-Amarisoft-OptiPlex-7050:/usr/local/elastic…

---

## [ClusterBlockException : All shards failed](https://discuss.elastic.co/t/clusterblockexception-all-shards-failed/267755)

<div class="topic-metadata">

**Author:** [@onkark](https://discuss.elastic.co/u/onkark)\
**Replies:** 4\
**Last updated:** [March 19, 2021, 8:34am UTC](https://discuss.elastic.co/t/clusterblockexception-all-shards-failed/267755 "2021-03-19T08:34:09Z")

</div>

Hi, I am getting the error like org.elasticsearch.cluster.block.ClusterBlockException : blocked by : \[SERVICE\_UNAVAILABLE/1/state not recovered/initialized\] where the cluster health status is YELLOW and primary shards …

---

## [Synonyms and/or synonym graph for mapping product names to other names](https://discuss.elastic.co/t/synonyms-and-or-synonym-graph-for-mapping-product-names-to-other-names/267678)

<div class="topic-metadata">

**Author:** [@Robert\_SL](https://discuss.elastic.co/u/Robert_SL)\
**Replies:** 0\
**Last updated:** [March 18, 2021, 2:05pm UTC](https://discuss.elastic.co/t/synonyms-and-or-synonym-graph-for-mapping-product-names-to-other-names/267678 "2021-03-18T14:05:56Z")

</div>

(Elastic Cloud 6.8) I have a requirement when searching for a product name to also return a different product that will replace it in the future. For example, when the user searches for "Product ABC", I also want to re…

---

## [How to implement join-fields with Spring Data Elasticsearch 4.0.0](https://discuss.elastic.co/t/how-to-implement-join-fields-with-spring-data-elasticsearch-4-0-0/267661)

<div class="topic-metadata">

**Author:** [@matt4](https://discuss.elastic.co/u/matt4)\
**Replies:** 2\
**Last updated:** [March 19, 2021, 7:50am UTC](https://discuss.elastic.co/t/how-to-implement-join-fields-with-spring-data-elasticsearch-4-0-0/267661 "2021-03-19T07:50:49Z")

</div>

Hi, I am using Spring Data Elasticsearch 4.0.0 and I would like to establish a parent-child-relationship between my entities. I found out that @JoinTypeRelation comes with version 4.1.X, but unfortunately, I am stuck wi…

---

## [Include/Exclude for cardinality aggregation](https://discuss.elastic.co/t/include-exclude-for-cardinality-aggregation/267759)

<div class="topic-metadata">

**Author:** [@robmartin11](https://discuss.elastic.co/u/robmartin11)\
**Replies:** 0\
**Last updated:** [March 19, 2021, 7:50am UTC](https://discuss.elastic.co/t/include-exclude-for-cardinality-aggregation/267759 "2021-03-19T07:50:01Z")

</div>

I have a terms aggregation with an IncludeExclude filter: { "size": 0, "query": { ... }, "aggregations": { "facets": { "terms": { "field": "type\_id", "size": 20, "order": \[ …

---

## [Upgrading Elasticsearch in Kubernetes using Helm](https://discuss.elastic.co/t/upgrading-elasticsearch-in-kubernetes-using-helm/267752)

<div class="topic-metadata">

**Author:** [@am\_Pg](https://discuss.elastic.co/u/am_Pg)\
**Replies:** 0\
**Last updated:** [March 19, 2021, 5:52am UTC](https://discuss.elastic.co/t/upgrading-elasticsearch-in-kubernetes-using-helm/267752 "2021-03-19T05:52:53Z")

</div>

Hello! Is it possible to upgrade Elasticsearch in Kubernetes using Helm from version 5.4.2 to 6.8? I saw this guide from Elastic https://www.elastic.co/guide/en/elasticsearch/reference/6.8/rolling-upgrades.html. I was w…

---

## [Delete by query not working](https://discuss.elastic.co/t/delete-by-query-not-working/267652)

<div class="topic-metadata">

**Author:** [@Sandeep\_Raju](https://discuss.elastic.co/u/Sandeep_Raju)\
**Replies:** 4\
**Last updated:** [March 19, 2021, 3:10am UTC](https://discuss.elastic.co/t/delete-by-query-not-working/267652 "2021-03-19T03:10:24Z")

</div>

Hi all, I have an index with documents of username : 220987,220388,1218383. I want to delete all documents with username starting with 22. So i used below code: POST /snmp-ser-my-thyalytics-com/\_delete\_by\_query { …

---

## [X-ndjson build request from .NET error](https://discuss.elastic.co/t/x-ndjson-build-request-from-net-error/267681)

<div class="topic-metadata">

**Author:** [@roman.pavliuk](https://discuss.elastic.co/u/roman.pavliuk)\
**Replies:** 1\
**Last updated:** [March 19, 2021, 3:06am UTC](https://discuss.elastic.co/t/x-ndjson-build-request-from-net-error/267681 "2021-03-19T03:06:58Z")

</div>

I am sending content-Type/x-ndjson from my .net core app, but I have got error with incorrect header, or 400(bad request) or error below! { "error": { "root\_cause": \[ { "type": "illegal\_argument\_exception", "reason…

---

## [Way to get summary of content](https://discuss.elastic.co/t/way-to-get-summary-of-content/267739)

<div class="topic-metadata">

**Author:** [@jaru\_kim](https://discuss.elastic.co/u/jaru_kim)\
**Replies:** 0\
**Last updated:** [March 19, 2021, 2:29am UTC](https://discuss.elastic.co/t/way-to-get-summary-of-content/267739 "2021-03-19T02:29:55Z")

</div>

I am testing query for index that has documents. { "query": { "bool": { "should": \[ { "match": { "title": "test.docx" } }, …

---

## [How to get store size for each filebeat module?](https://discuss.elastic.co/t/how-to-get-store-size-for-each-filebeat-module/267504)

<div class="topic-metadata">

**Author:** [@inhinyera16](https://discuss.elastic.co/u/inhinyera16)\
**Replies:** 1\
**Last updated:** [March 19, 2021, 12:08am UTC](https://discuss.elastic.co/t/how-to-get-store-size-for-each-filebeat-module/267504 "2021-03-19T00:08:31Z")

</div>

Hi, The total store size of our filebeat-\* indices is 242GB. This indices is a combination of system, apache, and mssql modules. Is there any way how we can get store size of each module? Appreciate the reply …

[Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=678)

[Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=680)
