# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=700 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 701 --- ## [Possible to have KQL in Elastic?](https://discuss.elastic.co/t/possible-to-have-kql-in-elastic/264842)
**Author:** [@Sandra\_Schlichting](https://discuss.elastic.co/u/Sandra_Schlichting)\ **Replies:** 1\ **Last updated:** [February 19, 2021, 11:21am UTC](https://discuss.elastic.co/t/possible-to-have-kql-in-elastic/264842 "2021-02-19T11:21:05Z")
Dear all =) Is it possible to "execute" KQL in Elasticsearch? If not, does there exist a script/translator, so KQL can be converted to Lucene? Hugs, Sandra =) --- ## [Delete old rollover index](https://discuss.elastic.co/t/delete-old-rollover-index/263365)
**Author:** [@graimato](https://discuss.elastic.co/u/graimato)\ **Replies:** 1\ **Last updated:** [February 19, 2021, 10:54am UTC](https://discuss.elastic.co/t/delete-old-rollover-index/263365 "2021-02-19T10:54:55Z")
Dear all I implemented a ILM policy { "metricbeat-7.10.2" : { "version" : 1, "modified\_date" : "2021-02-04T15:52:42.289Z", "policy" : { "phases" : { "hot" : { "min\_age" : "0ms", … --- ## [Enlarge Cluster with new nodes](https://discuss.elastic.co/t/enlarge-cluster-with-new-nodes/263974)
**Author:** [@cadirol](https://discuss.elastic.co/u/cadirol)\ **Replies:** 9\ **Last updated:** [February 19, 2021, 8:57am UTC](https://discuss.elastic.co/t/enlarge-cluster-with-new-nodes/263974 "2021-02-19T08:57:32Z")
Hi all We are planing to enlarge our cluster with 16 nodes in the end. the first 16 nodes are 4 years old, but still healthy and good enough! But as you can imagine, 4 years ago, we added 4TB Disk space in each node. … --- ## [Query issue, dot in field value returning 0 hits](https://discuss.elastic.co/t/query-issue-dot-in-field-value-returning-0-hits/264819)
**Author:** [@Sampson\_Light](https://discuss.elastic.co/u/Sampson_Light)\ **Replies:** 0\ **Last updated:** [February 19, 2021, 8:43am UTC](https://discuss.elastic.co/t/query-issue-dot-in-field-value-returning-0-hits/264819 "2021-02-19T08:43:38Z")
Hello, There's an issue with the use of . in my field value. The sample below is a 'valid' query that returns some hits { "query": { "bool": { "must": \[ { "wildcard": { "Addre… --- ## [Why term query, keyword is faster than number](https://discuss.elastic.co/t/why-term-query-keyword-is-faster-than-number/264812)
**Author:** [@asasas234](https://discuss.elastic.co/u/asasas234)\ **Replies:** 1\ **Last updated:** [February 19, 2021, 8:26am UTC](https://discuss.elastic.co/t/why-term-query-keyword-is-faster-than-number/264812 "2021-02-19T08:26:00Z")
I saw in https://www.elastic.co/guide/en/elasticsearch/reference/current/tune-for-search-speed.html#map-ids-as-keyword, in term query, keyword query The speed is faster than the digital type, but I am not sure what the r… --- ## [All shards failed](https://discuss.elastic.co/t/all-shards-failed/264777)
**Author:** [@Russell\_Fulton](https://discuss.elastic.co/u/Russell_Fulton)\ **Replies:** 1\ **Last updated:** [February 19, 2021, 8:08am UTC](https://discuss.elastic.co/t/all-shards-failed/264777 "2021-02-19T08:08:00Z")
I have been having a series of issues since the backup filled up the disks and ES ground to a halt. Cluster is now yellow and most indexes appear to be fine others have missing shards which I am working on. Searches ar… --- ## [Can we search from multiple indexs and assemble their？](https://discuss.elastic.co/t/can-we-search-from-multiple-indexs-and-assemble-their/264804)
**Author:** [@Anyzm](https://discuss.elastic.co/u/Anyzm)\ **Replies:** 1\ **Last updated:** [February 19, 2021, 7:55am UTC](https://discuss.elastic.co/t/can-we-search-from-multiple-indexs-and-assemble-their/264804 "2021-02-19T07:55:31Z")
can we search from multiple indexs and assemble their？ eg: there are two index person and car， there are a field called sex in index person and a field called color in index car，we want to search the women who own bla… --- ## [Comparisons with empty strings](https://discuss.elastic.co/t/comparisons-with-empty-strings/264808)
**Author:** [@sultanao](https://discuss.elastic.co/u/sultanao)\ **Replies:** 0\ **Last updated:** [February 19, 2021, 7:41am UTC](https://discuss.elastic.co/t/comparisons-with-empty-strings/264808 "2021-02-19T07:41:56Z")
Hi, I am using Elasticsearch 6.6.0 and I noticed that this query: { "query": { "range": { "my\_alphanumeric\_field": { "from": "", "to": null, "include\_lower… --- ## [Power BI ODFE ODBC SQL Driver](https://discuss.elastic.co/t/power-bi-odfe-odbc-sql-driver/264427)
**Author:** [@shharukh](https://discuss.elastic.co/u/shharukh)\ **Replies:** 1\ **Last updated:** [February 19, 2021, 7:15am UTC](https://discuss.elastic.co/t/power-bi-odfe-odbc-sql-driver/264427 "2021-02-19T07:15:09Z")
hello i have downloaded and configured ODFE ODBC driver but only a small chunk of data is being fetched which is 200 row form any index if you can help me i would be very grateful --- ## [An assigned shards -- max retries exceeded](https://discuss.elastic.co/t/an-assigned-shards-max-retries-exceeded/264779)
**Author:** [@Russell\_Fulton](https://discuss.elastic.co/u/Russell_Fulton)\ **Replies:** 1\ **Last updated:** [February 19, 2021, 3:10am UTC](https://discuss.elastic.co/t/an-assigned-shards-max-retries-exceeded/264779 "2021-02-19T03:10:40Z")
Running on 7.10 I have several indexes which have unassigned replica shards (although) the primaries are OK. For example: { "index" : "authm-000005", "shard" : 1, "primary" : false, "current\_state" : "unassign… --- ## [Map runtime field](https://discuss.elastic.co/t/map-runtime-field/263902)
**Author:** [@paasi6666](https://discuss.elastic.co/u/paasi6666)\ **Replies:** 1\ **Last updated:** [February 19, 2021, 12:50am UTC](https://discuss.elastic.co/t/map-runtime-field/263902 "2021-02-19T00:50:47Z")
I got following query which should create a new field: PUT filebeat\* { "mappings": { "runtime": { "sophos.utm.to.domain": { "type": "keyword", "script": { "source": "emit(def m = /@… --- ## [How to create a pipeline on a field that contains dots](https://discuss.elastic.co/t/how-to-create-a-pipeline-on-a-field-that-contains-dots/264666)
**Author:** [@aeroxy](https://discuss.elastic.co/u/aeroxy)\ **Replies:** 1\ **Last updated:** [February 19, 2021, 12:13am UTC](https://discuss.elastic.co/t/how-to-create-a-pipeline-on-a-field-that-contains-dots/264666 "2021-02-19T00:13:02Z")
When I use /\_ingest/pipeline/user\_agent to create a pipeline as such: { "description": "Add user agent information", "processors": \[ { "user\_agent": { "field": "meta.http.head… --- ## [Powershell alternative command for curl](https://discuss.elastic.co/t/powershell-alternative-command-for-curl/264679)
**Author:** [@Usman](https://discuss.elastic.co/u/Usman)\ **Replies:** 0\ **Last updated:** [February 18, 2021, 10:01am UTC](https://discuss.elastic.co/t/powershell-alternative-command-for-curl/264679 "2021-02-18T10:01:38Z")
Hi, I need the alternative for below command in windows power shell or .bat. curl --insecure -u user:password -X POST "https://hostname:443/\_reindex?pretty" -H 'Content-Type: application/json' -d' { "source": { "ind… --- ## [Cannot import template in elasticsearch](https://discuss.elastic.co/t/cannot-import-template-in-elasticsearch/264655)
**Author:** [@Voula\_Mikr](https://discuss.elastic.co/u/Voula_Mikr)\ **Replies:** 4\ **Last updated:** [February 18, 2021, 10:05pm UTC](https://discuss.elastic.co/t/cannot-import-template-in-elasticsearch/264655 "2021-02-18T22:05:03Z")
Hi I have an Elasticsearch with SearchGuard mechanism on. In searchguard configuration there is pmadmin role with the below permissions in sg\_roles.yml : sgs\_pmadmin\_role: cluster\_permissions: - SGS\_CLUSTER\_MONITOR … --- ## [Authentication of elastic was terminated by realm reserved - failed to authenticate user elastic](https://discuss.elastic.co/t/authentication-of-elastic-was-terminated-by-realm-reserved-failed-to-authenticate-user-elastic/264711)
**Author:** [@testsemd\_email](https://discuss.elastic.co/u/testsemd_email)\ **Replies:** 1\ **Last updated:** [February 18, 2021, 10:02pm UTC](https://discuss.elastic.co/t/authentication-of-elastic-was-terminated-by-realm-reserved-failed-to-authenticate-user-elastic/264711 "2021-02-18T22:02:13Z")
Got error: Authentication of elastic was terminated by realm reserved - failed to authenticate user elastic. Also can not start logstash. I'm using the elastic 7.10.1 version. Thank You! --- ## [Alerts Elasticsearch](https://discuss.elastic.co/t/alerts-elasticsearch/264726)
**Author:** [@roy\_allen](https://discuss.elastic.co/u/roy_allen)\ **Replies:** 1\ **Last updated:** [February 18, 2021, 9:57pm UTC](https://discuss.elastic.co/t/alerts-elasticsearch/264726 "2021-02-18T21:57:13Z")
Hello, Is it possible to send an alerts on elasticsearch everytime I have "error" Level in document for all documents with error. Also is it possible to have different email for every alert ? Something like email fiel… --- ## [Memory usage per Query](https://discuss.elastic.co/t/memory-usage-per-query/264767)
**Author:** [@JulioC](https://discuss.elastic.co/u/JulioC)\ **Replies:** 0\ **Last updated:** [February 18, 2021, 9:30pm UTC](https://discuss.elastic.co/t/memory-usage-per-query/264767 "2021-02-18T21:30:13Z")
Hi I'm new in Elasticsearch and I've been working on doing some comparative exercises between the different ways to mapping data, as Nested, Join and Denormalized, Is it possible to get the memory usage of each query tha… --- ## [Elasticsearch similar elements count](https://discuss.elastic.co/t/elasticsearch-similar-elements-count/264613)
**Author:** [@James\_wood](https://discuss.elastic.co/u/James_wood)\ **Replies:** 6\ **Last updated:** [February 18, 2021, 7:29pm UTC](https://discuss.elastic.co/t/elasticsearch-similar-elements-count/264613 "2021-02-18T19:29:41Z")
I have the following product order list and need to find out what products are ordered together: \[ { "order\_id": 1, "products": \["Coke", "Fanta"\], "created\_on": "2016-12-26T03:41:46+00:0… --- ## [Graceful shard management?](https://discuss.elastic.co/t/graceful-shard-management/264732)
**Author:** [@Curtis-KC](https://discuss.elastic.co/u/Curtis-KC)\ **Replies:** 5\ **Last updated:** [February 18, 2021, 6:36pm UTC](https://discuss.elastic.co/t/graceful-shard-management/264732 "2021-02-18T18:36:06Z")
Most challenging problems occur "when things have gone wrong". We have Warm Nodes that are oversharded and have network access storage mounted by mistake. The result is we have a good amount of data already on NAS, but… --- ## [Unable to add remote cluster for CCS](https://discuss.elastic.co/t/unable-to-add-remote-cluster-for-ccs/264637)
**Author:** [@susindaran](https://discuss.elastic.co/u/susindaran)\ **Replies:** 8\ **Last updated:** [February 18, 2021, 6:06pm UTC](https://discuss.elastic.co/t/unable-to-add-remote-cluster-for-ccs/264637 "2021-02-18T18:06:17Z")
I am simply spinning up two Elasticsearch instances in the same machine and trying to add one as a remote cluster to the other one. Settings for cluster\_one (only the relevant part): transport.port: 9307 http.p… --- ## [Painless compile error using regex pattern](https://discuss.elastic.co/t/painless-compile-error-using-regex-pattern/264623)
**Author:** [@Rodrigo\_Rabioglio](https://discuss.elastic.co/u/Rodrigo_Rabioglio)\ **Replies:** 2\ **Last updated:** [February 18, 2021, 6:00pm UTC](https://discuss.elastic.co/t/painless-compile-error-using-regex-pattern/264623 "2021-02-18T18:00:09Z")
Hello, I'm getting a compile error when using regex patterns inside a scripted field. I couldn't figure out why this error is happening though, since I'm pretty sure the script is right, based on the docs. Here is the … --- ## [Elasticsearch:7.11.0 bootstrap checks failed](https://discuss.elastic.co/t/elasticsearch-7-11-0-bootstrap-checks-failed/264733)
**Author:** [@rp346](https://discuss.elastic.co/u/rp346)\ **Replies:** 3\ **Last updated:** [February 18, 2021, 5:49pm UTC](https://discuss.elastic.co/t/elasticsearch-7-11-0-bootstrap-checks-failed/264733 "2021-02-18T17:49:35Z")
I upgraded elastic-search cluster from elasticsearch:7.10.0 to elasticsearch:7.11.0 and started noticing following error {"type": "server", "timestamp": "2021-02-18T16:15:46,270Z", "level": "INFO", "component": "o.e.b.B… --- ## [Elasticsearch 7.10.2 Installation - “jdk “ ” was unexpected at this time”](https://discuss.elastic.co/t/elasticsearch-7-10-2-installation-jdk-was-unexpected-at-this-time/262355)
**Author:** [@dcenaculo](https://discuss.elastic.co/u/dcenaculo)\ **Replies:** 3\ **Last updated:** [February 18, 2021, 4:21pm UTC](https://discuss.elastic.co/t/elasticsearch-7-10-2-installation-jdk-was-unexpected-at-this-time/262355 "2021-02-18T16:21:40Z")
Hello, I'm trying to install Elasticsearch on premises. I've unziped it and I can't start it from command line: C:\\Program Files\\elasticsearch-7.10.2\\bin\>elasticsearch.bat Files\\elasticsearch-7.10.2\\jdk"" was unexpected… --- ## [Filter on Alias](https://discuss.elastic.co/t/filter-on-alias/264463)
**Author:** [@Oscar\_Lopez](https://discuss.elastic.co/u/Oscar_Lopez)\ **Replies:** 4\ **Last updated:** [February 18, 2021, 3:42pm UTC](https://discuss.elastic.co/t/filter-on-alias/264463 "2021-02-18T15:42:04Z")
Good afternoon, at the moment I am investigating how to restrict the filters of the kibana boards by time, at the moment I have a query that works for the alias\_metricbeat of the index pattern metricbeat- \*, however I se… --- ## [Elasticsearch on AWS ECS Fargate](https://discuss.elastic.co/t/elasticsearch-on-aws-ecs-fargate/264596)
**Author:** [@Agron\_Demiraj](https://discuss.elastic.co/u/Agron_Demiraj)\ **Replies:** 6\ **Last updated:** [February 18, 2021, 3:36pm UTC](https://discuss.elastic.co/t/elasticsearch-on-aws-ecs-fargate/264596 "2021-02-18T15:36:45Z")
Hi. I apologize if this is a duplicate of another thread, but so far I did not see a similar case. I am trying to deploy ES on ECS with default image from docker.elastic.co/elasticsearch/elasticsearch:7.11.1 but it is f… --- ## [How does sorting work under the hood?](https://discuss.elastic.co/t/how-does-sorting-work-under-the-hood/263999)
**Author:** [@Harald\_Bittermann](https://discuss.elastic.co/u/Harald_Bittermann)\ **Replies:** 2\ **Last updated:** [February 18, 2021, 3:34pm UTC](https://discuss.elastic.co/t/how-does-sorting-work-under-the-hood/263999 "2021-02-18T15:34:56Z")
Elasticsearch Version: 7.10 Before I start to take a deeper look at a bug report that just arrived my desk I wanted to know the following. When a sort criteria is applied, is it guaranteed that all documents are sorted… --- ## [Watcher error - null pointer exception](https://discuss.elastic.co/t/watcher-error-null-pointer-exception/262975)
**Author:** [@firstpostcommenter](https://discuss.elastic.co/u/firstpostcommenter)\ **Replies:** 1\ **Last updated:** [February 18, 2021, 3:12pm UTC](https://discuss.elastic.co/t/watcher-error-null-pointer-exception/262975 "2021-02-18T15:12:34Z")
Hi, I seem to have similar problem mentioned in Problem execute watcher "Cannot invoke \\"Object.getClass()\\" because \\"callArgs\[0\]\\" is null" Sample JSON: "aggs": { "unique\_customerid": { … --- ## [Bucket the most 10 popular terms using a scripted field](https://discuss.elastic.co/t/bucket-the-most-10-popular-terms-using-a-scripted-field/262369)
**Author:** [@A\_Mightiev](https://discuss.elastic.co/u/A_Mightiev)\ **Replies:** 1\ **Last updated:** [February 18, 2021, 3:04pm UTC](https://discuss.elastic.co/t/bucket-the-most-10-popular-terms-using-a-scripted-field/262369 "2021-02-18T15:04:37Z")
Hi there, I am a bit struggling getting this right. I have some log messages, What I need to do is to look for log.message, get the first 15 characters and display the most 10 popular messages. What I did so far is cr… --- ## [Elastic search s3 plugin and bucket name](https://discuss.elastic.co/t/elastic-search-s3-plugin-and-bucket-name/264716)
**Author:** [@Sergiodive](https://discuss.elastic.co/u/Sergiodive)\ **Replies:** 0\ **Last updated:** [February 18, 2021, 2:35pm UTC](https://discuss.elastic.co/t/elastic-search-s3-plugin-and-bucket-name/264716 "2021-02-18T14:35:19Z")
Hello May I please get some clarification on my observations regarding the S3 plugin and bucket names? I have observed with Elasticsearch 7.10.2 and the s3 plugin that if i don't provide the bucket name in all caps th… --- ## [Calculate percentage of fileds in aggregate](https://discuss.elastic.co/t/calculate-percentage-of-fileds-in-aggregate/264713)
**Author:** [@Giovanni\_Di\_Lembo](https://discuss.elastic.co/u/Giovanni_Di_Lembo)\ **Replies:** 0\ **Last updated:** [February 18, 2021, 2:14pm UTC](https://discuss.elastic.co/t/calculate-percentage-of-fileds-in-aggregate/264713 "2021-02-18T14:14:30Z")
Hi all and sorry for my poor english I need to calculate percentage of usageTime per services in a json like that { "myID": "-1819947444", "accountUuid": "account-1", "serviceName": "Dazn299", "usageTime": … [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=699) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=701)