# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=685 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 686 --- ## [Recursive search query for all leaf nodes(childs)](https://discuss.elastic.co/t/recursive-search-query-for-all-leaf-nodes-childs/266791)
**Author:** [@Paresh\_Vaniya](https://discuss.elastic.co/u/Paresh_Vaniya)\ **Replies:** 1\ **Last updated:** [March 11, 2021, 10:35am UTC](https://discuss.elastic.co/t/recursive-search-query-for-all-leaf-nodes-childs/266791 "2021-03-11T10:35:04Z")
Hi All, I need help for getting all the leaf nodes details using elasticsearch query. If I have search for root node id and it contains childEntities then it should get all the child id and its name in result. I have t… --- ## [How to remove custom metadata fields from users and roles](https://discuss.elastic.co/t/how-to-remove-custom-metadata-fields-from-users-and-roles/266646)
**Author:** [@Wolfram\_Haussig](https://discuss.elastic.co/u/Wolfram_Haussig)\ **Replies:** 5\ **Last updated:** [March 11, 2021, 9:17am UTC](https://discuss.elastic.co/t/how-to-remove-custom-metadata-fields-from-users-and-roles/266646 "2021-03-11T09:17:35Z")
Hi, I am running a 7.10 Stack with Security enabled and I am currently playing around with the ElasticSearch REST API for creating users, roles and so on. The usecase here is to add advanced information to the security … --- ## [Elastic Cloud SaaS on AWS](https://discuss.elastic.co/t/elastic-cloud-saas-on-aws/266899)
**Author:** [@AJ18](https://discuss.elastic.co/u/AJ18)\ **Replies:** 3\ **Last updated:** [March 11, 2021, 9:03am UTC](https://discuss.elastic.co/t/elastic-cloud-saas-on-aws/266899 "2021-03-11T09:03:45Z")
Are all features of ELK+ Beats in Elastic Cloud available in the SaaS cloud solution on AWS? Is Elastic Agent supported by Elastic SaaS cloud solution? --- ## [Elastic 7.10.2: no way to automatically create the first index. Manually kickstart ILM still mandatory?](https://discuss.elastic.co/t/elastic-7-10-2-no-way-to-automatically-create-the-first-index-manually-kickstart-ilm-still-mandatory/266811)
**Author:** [@ORich](https://discuss.elastic.co/u/ORich)\ **Replies:** 1\ **Last updated:** [March 11, 2021, 8:30am UTC](https://discuss.elastic.co/t/elastic-7-10-2-no-way-to-automatically-create-the-first-index-manually-kickstart-ilm-still-mandatory/266811 "2021-03-11T08:30:21Z")
Dear experts, I am running Elastic 7.10.2. I would like to manage a first index with syntax filebeat-7.10.2-postfix-2021.03.10-000001. Thanks to ILM rollover mechanism next one would be filebeat-7.10.2-postfix-2021.03.1… --- ## [Elasticsearch stopped working on kubernetes](https://discuss.elastic.co/t/elasticsearch-stopped-working-on-kubernetes/266891)
**Author:** [@Naomi](https://discuss.elastic.co/u/Naomi)\ **Replies:** 0\ **Last updated:** [March 11, 2021, 6:35am UTC](https://discuss.elastic.co/t/elasticsearch-stopped-working-on-kubernetes/266891 "2021-03-11T06:35:05Z")
I have an elastic cluster on kubernetes. containing 3 master pods 2 data pods and 2 clients. everything worked fine until I installed it on environment which containing 6 kubenrtes nodes 3 Master and 3 none. now I keep g… --- ## [ES7 Multiply scores from boolean queries](https://discuss.elastic.co/t/es7-multiply-scores-from-boolean-queries/266130)
**Author:** [@JF2018](https://discuss.elastic.co/u/JF2018)\ **Replies:** 4\ **Last updated:** [March 10, 2021, 10:31pm UTC](https://discuss.elastic.co/t/es7-multiply-scores-from-boolean-queries/266130 "2021-03-10T22:31:11Z")
Hey Is it possible in some way to multiply the scores of two boolean queries? I now BoolQuery.Should can add the scores together, but not multiply. Another possibility is function scores, but here I can only provide a… --- ## [How to detect network scan using EQL](https://discuss.elastic.co/t/how-to-detect-network-scan-using-eql/266466)
**Author:** [@msszafar](https://discuss.elastic.co/u/msszafar)\ **Replies:** 4\ **Last updated:** [March 10, 2021, 6:34pm UTC](https://discuss.elastic.co/t/how-to-detect-network-scan-using-eql/266466 "2021-03-10T18:34:00Z")
Hi All, Can anyone please help me setting up a simple correlation rule using EQL that detect if same source.ip attempts more than 50 destination.ip within 15 minutes. I'm unable to write EQL. I've fortigate logs, my c… --- ## [Forming a new document with all the fields everytime a new event comes in](https://discuss.elastic.co/t/forming-a-new-document-with-all-the-fields-everytime-a-new-event-comes-in/265248)
**Author:** [@karanp](https://discuss.elastic.co/u/karanp)\ **Replies:** 7\ **Last updated:** [March 10, 2021, 6:27pm UTC](https://discuss.elastic.co/t/forming-a-new-document-with-all-the-fields-everytime-a-new-event-comes-in/265248 "2021-03-10T18:27:42Z")
Hello, So I am currently trying to figure this out and would love to know if my current approach is correct and if not, is there a way to do it. So, the question is We have these events coming in with each event having … --- ## [Using Nest.net indexing list\ where SomeType is abstract](https://discuss.elastic.co/t/using-nest-net-indexing-list-sometype-where-sometype-is-abstract/266848)
**Author:** [@RejectKid](https://discuss.elastic.co/u/RejectKid)\ **Replies:** 0\ **Last updated:** [March 10, 2021, 5:40pm UTC](https://discuss.elastic.co/t/using-nest-net-indexing-list-sometype-where-sometype-is-abstract/266848 "2021-03-10T17:40:32Z")
I have an object public class SomeObject { List\ } There are several derived types of SomeType and populated in the list. However when i push this data into ES using Nest.net it strips out … --- ## [Doing aggregations using flattened\_fields is slow](https://discuss.elastic.co/t/doing-aggregations-using-flattened-fields-is-slow/266832)
**Author:** [@Ronald\_de\_Haan](https://discuss.elastic.co/u/Ronald_de_Haan)\ **Replies:** 1\ **Last updated:** [March 10, 2021, 4:41pm UTC](https://discuss.elastic.co/t/doing-aggregations-using-flattened-fields-is-slow/266832 "2021-03-10T16:41:31Z")
We consume and store data containing a field filter\_properties containing key =\> value fields. Up until now we use dynamic mapping to store that data but that's creating a lot of unique fields. So I decided to try the f… --- ## [Forcemerge multiple indices = high fragmentation on disk?](https://discuss.elastic.co/t/forcemerge-multiple-indices-high-fragmentation-on-disk/265586)
**Author:** [@MichelV](https://discuss.elastic.co/u/MichelV)\ **Replies:** 8\ **Last updated:** [March 10, 2021, 4:25pm UTC](https://discuss.elastic.co/t/forcemerge-multiple-indices-high-fragmentation-on-disk/265586 "2021-03-10T16:25:42Z")
I'm applying an ILM policy on older (daily) indices. In warm phase I have enabled forcemerge to reduce the number of segments. If I assign the ILM policy to multiple indices, say 30 days, will the forcemerge run on all … --- ## [No dynamic or static mapping - data not searchable?](https://discuss.elastic.co/t/no-dynamic-or-static-mapping-data-not-searchable/266270)
**Author:** [@DefensiveDepth](https://discuss.elastic.co/u/DefensiveDepth)\ **Replies:** 1\ **Last updated:** [March 10, 2021, 4:00pm UTC](https://discuss.elastic.co/t/no-dynamic-or-static-mapping-data-not-searchable/266270 "2021-03-10T16:00:52Z")
I have a template that disables dynamic mapping and statically maps a few specific fields. When data is ingested that does not fit the static mappings, I can see the data in elasticsearch, but I can't search it. Queryin… --- ## [ConnectTransportException non-master-eligible node found](https://discuss.elastic.co/t/connecttransportexception-non-master-eligible-node-found/266417)
**Author:** [@SSRR](https://discuss.elastic.co/u/SSRR)\ **Replies:** 2\ **Last updated:** [March 10, 2021, 4:00pm UTC](https://discuss.elastic.co/t/connecttransportexception-non-master-eligible-node-found/266417 "2021-03-10T16:00:28Z")
I'm configuring Elasticserach 7.9.0 cluster with 2 hosts. The elasticsearch.yml in host1 is setup with node.master as true and host2 is setup with node.master as false. Both hosts have elasticsearch started but with err… --- ## [EL7.11 Index recoveries stuck at translog stage](https://discuss.elastic.co/t/el7-11-index-recoveries-stuck-at-translog-stage/266830)
**Author:** [@alexolivan](https://discuss.elastic.co/u/alexolivan)\ **Replies:** 0\ **Last updated:** [March 10, 2021, 3:15pm UTC](https://discuss.elastic.co/t/el7-11-index-recoveries-stuck-at-translog-stage/266830 "2021-03-10T15:15:58Z")
Hi community. I'm experiencing a problem I never saw before during index recovery... after the loss of a server, where a master and data nodes where running (something I've seen EL clustering managing exceptionally well… --- ## [API REST AWS COST EXPLORER](https://discuss.elastic.co/t/api-rest-aws-cost-explorer/266828)
**Author:** [@Oscar\_Lopez](https://discuss.elastic.co/u/Oscar_Lopez)\ **Replies:** 0\ **Last updated:** [March 10, 2021, 3:09pm UTC](https://discuss.elastic.co/t/api-rest-aws-cost-explorer/266828 "2021-03-10T15:09:27Z")
Good morning, does anyone know if it is feasible to consume the aws cost explorer rest api with logstash, I know that there are three options in aws, one is through the CLI, another through a JDK and the last one that is… --- ## [Best approach to multi-word search as you type](https://discuss.elastic.co/t/best-approach-to-multi-word-search-as-you-type/266826)
**Author:** [@tbzl](https://discuss.elastic.co/u/tbzl)\ **Replies:** 0\ **Last updated:** [March 10, 2021, 3:00pm UTC](https://discuss.elastic.co/t/best-approach-to-multi-word-search-as-you-type/266826 "2021-03-10T15:00:51Z")
Hi, I would like to add some sort of "search as you type" functionality but have been struggling to find the right one. Say I have the following product name: Some Brand Sweater Striped Green What would be the best m… --- ## [Adding rollover configuration in ELK 7.6](https://discuss.elastic.co/t/adding-rollover-configuration-in-elk-7-6/265521)
**Author:** [@Atul\_Chadha](https://discuss.elastic.co/u/Atul_Chadha)\ **Replies:** 1\ **Last updated:** [March 10, 2021, 2:32pm UTC](https://discuss.elastic.co/t/adding-rollover-configuration-in-elk-7-6/265521 "2021-03-10T14:32:13Z")
I am trying to rollover indices that are over 30 days and need to target indices that are already in the elasticsearch along with new indices Our indices get created on weekly basis and i am not able to add an rollover … --- ## [Unable to establish connection](https://discuss.elastic.co/t/unable-to-establish-connection/266808)
**Author:** [@RomanK](https://discuss.elastic.co/u/RomanK)\ **Replies:** 0\ **Last updated:** [March 10, 2021, 12:55pm UTC](https://discuss.elastic.co/t/unable-to-establish-connection/266808 "2021-03-10T12:55:39Z")
Our architecture has microservices that cannot connect to the internal network by themselves (for security reasons). Is it possible to establish a TCP connection from the Elasticsearch side? --- ## [Snapshot recovery problem](https://discuss.elastic.co/t/snapshot-recovery-problem/266782)
**Author:** [@haipeng.zhao](https://discuss.elastic.co/u/haipeng.zhao)\ **Replies:** 0\ **Last updated:** [March 10, 2021, 9:03am UTC](https://discuss.elastic.co/t/snapshot-recovery-problem/266782 "2021-03-10T09:03:11Z")
hi all POST /\_snapshot/my\_backup/snapshot\_1/\_restore { "indices": "data\_stream\_1,index\_1,index\_2", "ignore\_unavailable": true, "include\_global\_state": false, "rename\_pattern": "index\_(.+)", "rena… --- ## [Performance of outside Query vs filter inside aggregation while aggregating](https://discuss.elastic.co/t/performance-of-outside-query-vs-filter-inside-aggregation-while-aggregating/266726)
**Author:** [@the\_nemo](https://discuss.elastic.co/u/the_nemo)\ **Replies:** 3\ **Last updated:** [March 10, 2021, 8:24am UTC](https://discuss.elastic.co/t/performance-of-outside-query-vs-filter-inside-aggregation-while-aggregating/266726 "2021-03-10T08:24:16Z")
Is there any performance difference between the below two quires assuming "type" is a keyword? { "size": 0, "aggs": { "t\_shirts": { "filter": { "term": { "type… --- ## [How to store real estate data in an elastic search?](https://discuss.elastic.co/t/how-to-store-real-estate-data-in-an-elastic-search/266747)
**Author:** [@jay2021](https://discuss.elastic.co/u/jay2021)\ **Replies:** 1\ **Last updated:** [March 9, 2021, 11:49pm UTC](https://discuss.elastic.co/t/how-to-store-real-estate-data-in-an-elastic-search/266747 "2021-03-09T23:49:54Z")
I have Real Estate data. I am looking into storing it into elastic search to allow users to search the database real time. I want to be able to let my users search by key fields like price, lot size, year-built, total b… --- ## [Add 3 master nodes to our cluster configured only default(master/data...) node](https://discuss.elastic.co/t/add-3-master-nodes-to-our-cluster-configured-only-default-master-data-node/266764)
**Author:** [@mgjung02](https://discuss.elastic.co/u/mgjung02)\ **Replies:** 0\ **Last updated:** [March 10, 2021, 5:39am UTC](https://discuss.elastic.co/t/add-3-master-nodes-to-our-cluster-configured-only-default-master-data-node/266764 "2021-03-10T05:39:59Z")
Now, we run 6 nodes and all of them has default role (master/data...). For more efficient cluster environment, we want to change our cluster like below. Add 2 master-dedicated node. (new node) Change one existed n… --- ## [I downloaded and installed elasticsearch](https://discuss.elastic.co/t/i-downloaded-and-installed-elasticsearch/266760)
**Author:** [@PaulGureghian](https://discuss.elastic.co/u/PaulGureghian)\ **Replies:** 1\ **Last updated:** [March 10, 2021, 4:41am UTC](https://discuss.elastic.co/t/i-downloaded-and-installed-elasticsearch/266760 "2021-03-10T04:41:32Z")
But when I do ./bin/elasticsearch it says it can't find the bundled jdk. Why do I have to set JAVA\_HOME for Elasticsearch to use it's bundled Java? And if I have to set JAVA\_HOME, what exactly do I need to do ? What … --- ## [Using TLS with PFX from third party in 7.11](https://discuss.elastic.co/t/using-tls-with-pfx-from-third-party-in-7-11/266743)
**Author:** [@ARDiver86](https://discuss.elastic.co/u/ARDiver86)\ **Replies:** 1\ **Last updated:** [March 10, 2021, 2:46am UTC](https://discuss.elastic.co/t/using-tls-with-pfx-from-third-party-in-7-11/266743 "2021-03-10T02:46:42Z")
I am having issues getting TLS working on my two-node cluster. I know two-node is not best practice or supported in Elastic or any other clustering technology, but this is just test environment that I will add more nodes… --- ## [Strange error - 'provisioner-\*' index pattern doesn't have a scripted field called 'kubernetes.labels.eks\_amazonaws\_com'](https://discuss.elastic.co/t/strange-error-provisioner-index-pattern-doesnt-have-a-scripted-field-called-kubernetes-labels-eks-amazonaws-com/266621)
**Author:** [@pingz](https://discuss.elastic.co/u/pingz)\ **Replies:** 0\ **Last updated:** [March 9, 2021, 12:13am UTC](https://discuss.elastic.co/t/strange-error-provisioner-index-pattern-doesnt-have-a-scripted-field-called-kubernetes-labels-eks-amazonaws-com/266621 "2021-03-09T00:13:52Z")
I have an elastic index pattern named "provisoner-\*" that contains field "kubernetes.labels.eks\_amazonaws\_com/component" I noticed that whenever I tried to edit a field that contains character '/', in Kinana index patter… --- ## [How to automatically delete documents older than 3 months](https://discuss.elastic.co/t/how-to-automatically-delete-documents-older-than-3-months/265851)
**Author:** [@kate\_yxy](https://discuss.elastic.co/u/kate_yxy)\ **Replies:** 7\ **Last updated:** [March 9, 2021, 10:22pm UTC](https://discuss.elastic.co/t/how-to-automatically-delete-documents-older-than-3-months/265851 "2021-03-09T22:22:06Z")
Hey, I want to delete documents older than 3 months in my index. And I have read the doc here about using ILM to create time-based indices and apply ILM policies. However, this doesn't seem to fit our use case. We're us… --- ## [I downloaded and installed elasticsearch](https://discuss.elastic.co/t/i-downloaded-and-installed-elasticsearch/266623)
**Author:** [@PaulGureghian](https://discuss.elastic.co/u/PaulGureghian)\ **Replies:** 4\ **Last updated:** [March 9, 2021, 10:21pm UTC](https://discuss.elastic.co/t/i-downloaded-and-installed-elasticsearch/266623 "2021-03-09T22:21:54Z")
\*\*On Linux Mint. I extracted the archive tar.gz and cd into elasticsearch dir and ran ./bin/elasticsearch, \*\* The error message was: could not find java in the bundled jdk dir. I have Open JDK already installed on my s… --- ## [Snapshot and restore users, spaces and aliases](https://discuss.elastic.co/t/snapshot-and-restore-users-spaces-and-aliases/264200)
**Author:** [@martinsz](https://discuss.elastic.co/u/martinsz)\ **Replies:** 2\ **Last updated:** [March 9, 2021, 9:34pm UTC](https://discuss.elastic.co/t/snapshot-and-restore-users-spaces-and-aliases/264200 "2021-03-09T21:34:53Z")
Hello, we are finally moving ahead with STIRing our data (earlier post for context https://discuss.elastic.co/t/help-a-non-profit-stir-the-data/251589 ) And we have now found challenges while moving data to the main clus… --- ## ["enabing" security on an existing multinode cluster with multiple clients](https://discuss.elastic.co/t/enabing-security-on-an-existing-multinode-cluster-with-multiple-clients/266753)
**Author:** [@Russell\_Fulton](https://discuss.elastic.co/u/Russell_Fulton)\ **Replies:** 0\ **Last updated:** [March 9, 2021, 8:19pm UTC](https://discuss.elastic.co/t/enabing-security-on-an-existing-multinode-cluster-with-multiple-clients/266753 "2021-03-09T20:19:41Z")
I am trying to plan how to "enable security" on my cluster with the minimum of disruption to data collection. Most of the documentation focuses on how to do this when starting up a new installation (unsurprisingly). In… --- ## [Increase elasticsearch version when importing resthighlevelclient](https://discuss.elastic.co/t/increase-elasticsearch-version-when-importing-resthighlevelclient/266735)
**Author:** [@Carlos\_Fernando\_Palm](https://discuss.elastic.co/u/Carlos_Fernando_Palm)\ **Replies:** 2\ **Last updated:** [March 9, 2021, 8:14pm UTC](https://discuss.elastic.co/t/increase-elasticsearch-version-when-importing-resthighlevelclient/266735 "2021-03-09T20:14:32Z")
Hello people. I am using resthighlevelclient to connect to elasticsearch 7.9.3. Now I have done by importing all of this: \ \org.elasticsearch.client\ \ela… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=684) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=686)