# Elasticsearch

**URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=701

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 702

---

## [Error building transform on the destination index of previous transform](https://discuss.elastic.co/t/error-building-transform-on-the-destination-index-of-previous-transform/264338)

<div class="topic-metadata">

**Author:** [@Jeff\_Bolle](https://discuss.elastic.co/u/Jeff_Bolle)\
**Replies:** 6\
**Last updated:** [February 18, 2021, 1:41pm UTC](https://discuss.elastic.co/t/error-building-transform-on-the-destination-index-of-previous-transform/264338 "2021-02-18T13:41:42Z")

</div>

We are running elasticsearch 7.6.1 on linux nodes. Our cluster is about 50 nodes. I have 3 indexes which hold the results of dataframe transforms that aggregate some details on IP addresses across 2 different source ind…

---

## [Elastic licence isn't sticky](https://discuss.elastic.co/t/elastic-licence-isnt-sticky/264677)

<div class="topic-metadata">

**Author:** [@eeijlar](https://discuss.elastic.co/u/eeijlar)\
**Replies:** 3\
**Last updated:** [February 18, 2021, 11:29am UTC](https://discuss.elastic.co/t/elastic-licence-isnt-sticky/264677 "2021-02-18T11:29:40Z")

</div>

I have the ELK stack installed in Kubernetes. I find that the license has to be updated on a daily basis, otherwise I get: {"statusCode":403,"error":"Forbidden","message":"Your basic license does not support PDF Report…

---

## [Use rally to compare existing clusters - document a way to run 'short' tests](https://discuss.elastic.co/t/use-rally-to-compare-existing-clusters-document-a-way-to-run-short-tests/264452)

<div class="topic-metadata">

**Author:** [@arthurlogilab](https://discuss.elastic.co/u/arthurlogilab)\
**Replies:** 2\
**Last updated:** [February 18, 2021, 11:17am UTC](https://discuss.elastic.co/t/use-rally-to-compare-existing-clusters-document-a-way-to-run-short-tests/264452 "2021-02-18T11:17:18Z")

</div>

I'm a bit new to rally and have been recently trying it out. My goal is to start comparing the performance of two elasticsearch clusters I have access to (classic "old one", new "on kubernetes one"). I was hoping to have…

---

## [About build information we get when running curl request to elasticsearch service](https://discuss.elastic.co/t/about-build-information-we-get-when-running-curl-request-to-elasticsearch-service/264562)

<div class="topic-metadata">

**Author:** [@pratiksha](https://discuss.elastic.co/u/pratiksha)\
**Replies:** 5\
**Last updated:** [February 18, 2021, 7:15am UTC](https://discuss.elastic.co/t/about-build-information-we-get-when-running-curl-request-to-elasticsearch-service/264562 "2021-02-18T07:15:37Z")

</div>

I ran curl request to elasticsearch service and I got information related to build as follow: "build\_hash" : "757314695655ea9a1dc2fecd26d1a43856725e65", "build\_date" : "2020-06-14T19:35:50.234439Z", "build\_snapshot" :…

---

## [Hardware recommendation about ES to avoid "Data too large"](https://discuss.elastic.co/t/hardware-recommendation-about-es-to-avoid-data-too-large/264643)

<div class="topic-metadata">

**Author:** [@jmliu1983](https://discuss.elastic.co/u/jmliu1983)\
**Replies:** 0\
**Last updated:** [February 18, 2021, 4:01am UTC](https://discuss.elastic.co/t/hardware-recommendation-about-es-to-avoid-data-too-large/264643 "2021-02-18T04:01:08Z")

</div>

I'm using ES in a machine which has 12G physical memory, when running lower size of data, everything is OK. But as long as the data size and document counts increasing, circuit breaker happens more and more frequently. …

---

## [Elasticsearch Topology Design](https://discuss.elastic.co/t/elasticsearch-topology-design/264638)

<div class="topic-metadata">

**Author:** [@InnerJoin](https://discuss.elastic.co/u/InnerJoin)\
**Replies:** 4\
**Last updated:** [February 18, 2021, 3:59am UTC](https://discuss.elastic.co/t/elasticsearch-topology-design/264638 "2021-02-18T03:59:50Z")

</div>

Hello Elasticsearch big-brain experts, I have been testing out Elasticsearch as a log vaulting, auditing tool, and SEIM for the last few months and my company has authorized the purchase of hardware to build a cluster. …

---

## [Empty server certificate chain does anybody know what to do i'm new to elastic? repeatedly getting these errors](https://discuss.elastic.co/t/empty-server-certificate-chain-does-anybody-know-what-to-do-im-new-to-elastic-repeatedly-getting-these-errors/264537)

<div class="topic-metadata">

**Author:** [@Jerin\_Joy](https://discuss.elastic.co/u/Jerin_Joy)\
**Replies:** 1\
**Last updated:** [February 18, 2021, 2:56am UTC](https://discuss.elastic.co/t/empty-server-certificate-chain-does-anybody-know-what-to-do-im-new-to-elastic-repeatedly-getting-these-errors/264537 "2021-02-18T02:56:47Z")

</div>

"stacktrace": \["io.netty.handler.codec.DecoderException: javax.net.ssl.SSLHandshakeException: Empty server certificate chain", "at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:471) ~\[…

---

## [Issues with Elasticsearch Scroll API results](https://discuss.elastic.co/t/issues-with-elasticsearch-scroll-api-results/264581)

<div class="topic-metadata">

**Author:** [@samacker77elastic](https://discuss.elastic.co/u/samacker77elastic)\
**Replies:** 0\
**Last updated:** [February 17, 2021, 1:30pm UTC](https://discuss.elastic.co/t/issues-with-elasticsearch-scroll-api-results/264581 "2021-02-17T13:30:30Z")

</div>

Hi everyone, I am trying to read documents from an index using the scroll API. The problem that I am facing is that, Kibana Discover shows the hits to be 195,867, but my code misses or skips 10,000 documents. I am not…

---

## [Why word\_delimiter doesn's work on my index?](https://discuss.elastic.co/t/why-word-delimiter-doesns-work-on-my-index/264624)

<div class="topic-metadata">

**Author:** [@andymov](https://discuss.elastic.co/u/andymov)\
**Replies:** 4\
**Last updated:** [February 17, 2021, 11:28pm UTC](https://discuss.elastic.co/t/why-word-delimiter-doesns-work-on-my-index/264624 "2021-02-17T23:28:21Z")

</div>

Hi all! I need to search my products by codes like this one: "50-14Lx". I use word\_delimiter to tokenize "50-14Lx" to "50","14","Lx". But it doesn't work on my index. Index: PUT /products { "settings": {…

---

## [Kibana Elasticsearch TLS does not work (alert and actions)](https://discuss.elastic.co/t/kibana-elasticsearch-tls-does-not-work-alert-and-actions/264367)

<div class="topic-metadata">

**Author:** [@swood](https://discuss.elastic.co/u/swood)\
**Replies:** 1\
**Last updated:** [February 17, 2021, 10:16pm UTC](https://discuss.elastic.co/t/kibana-elasticsearch-tls-does-not-work-alert-and-actions/264367 "2021-02-17T22:16:02Z")

</div>

Hi, I have the same problem as someone had by the topic: Does it possible to investigate the reason why it doesn't work? Maybe some checklist or to run some command to identify which of the instruction point I don't im…

---

## [Is it wise to freeze rolled over index even though it will be heavily searched?](https://discuss.elastic.co/t/is-it-wise-to-freeze-rolled-over-index-even-though-it-will-be-heavily-searched/264050)

<div class="topic-metadata">

**Author:** [@linkerc](https://discuss.elastic.co/u/linkerc)\
**Replies:** 6\
**Last updated:** [February 17, 2021, 9:23pm UTC](https://discuss.elastic.co/t/is-it-wise-to-freeze-rolled-over-index-even-though-it-will-be-heavily-searched/264050 "2021-02-17T21:23:31Z")

</div>

As the title stated. Since the queue size for frozen index is smaller, does it impact search significantly? We rolled over index that stores events as they come in. The roll over criterion is based on shard size. We …

---

## [How is search.max\_buckets calculated? ES 7.5.0](https://discuss.elastic.co/t/how-is-search-max-buckets-calculated-es-7-5-0/264610)

<div class="topic-metadata">

**Author:** [@JonathanAaron](https://discuss.elastic.co/u/JonathanAaron)\
**Replies:** 2\
**Last updated:** [February 17, 2021, 9:11pm UTC](https://discuss.elastic.co/t/how-is-search-max-buckets-calculated-es-7-5-0/264610 "2021-02-17T21:11:57Z")

</div>

I'm wondering how search.max\_buckets is calculated. I have a multilevel terms aggregation. We have 10,000 leaf node buckets. Do the parent buckets count as part of the 10,000 limit?

---

## [Encryption for hosted Elasticsearch instance](https://discuss.elastic.co/t/encryption-for-hosted-elasticsearch-instance/264604)

<div class="topic-metadata">

**Author:** [@christhegrand](https://discuss.elastic.co/u/christhegrand)\
**Replies:** 1\
**Last updated:** [February 17, 2021, 8:27pm UTC](https://discuss.elastic.co/t/encryption-for-hosted-elasticsearch-instance/264604 "2021-02-17T20:27:46Z")

</div>

Do hosted Elasticsearch instances provide encryption at rest?

---

## [ElasticSearch on Docker Swarm using host network](https://discuss.elastic.co/t/elasticsearch-on-docker-swarm-using-host-network/264606)

<div class="topic-metadata">

**Author:** [@Nuno\_Centeio](https://discuss.elastic.co/u/Nuno_Centeio)\
**Replies:** 0\
**Last updated:** [February 17, 2021, 6:46pm UTC](https://discuss.elastic.co/t/elasticsearch-on-docker-swarm-using-host-network/264606 "2021-02-17T18:46:51Z")

</div>

I'm trying to build a 3 node (1 master + 2 nodes) Docker Swarm using Azure's Ubuntu image. I've then tried to deploy an ElasticSearch 3 node cluster. This is my YAML file: version: '3.7' services: elasticsearch: …

---

## [Elasticsearch 7.11 low heap size with bundled JDK](https://discuss.elastic.co/t/elasticsearch-7-11-low-heap-size-with-bundled-jdk/264576)

<div class="topic-metadata">

**Author:** [@MarcusCaepio](https://discuss.elastic.co/u/MarcusCaepio)\
**Replies:** 2\
**Last updated:** [February 17, 2021, 3:33pm UTC](https://discuss.elastic.co/t/elasticsearch-7-11-low-heap-size-with-bundled-jdk/264576 "2021-02-17T15:33:46Z")

</div>

Hi all, I am currently building a brand new cluster based on 7.11. In the docs under it is said that By default, Elasticsearch automatically sizes JVM heap based on a node’s roles and total memory. We recommend this…

---

## [Caching hotel prices](https://discuss.elastic.co/t/caching-hotel-prices/264590)

<div class="topic-metadata">

**Author:** [@half](https://discuss.elastic.co/u/half)\
**Replies:** 1\
**Last updated:** [February 17, 2021, 3:29pm UTC](https://discuss.elastic.co/t/caching-hotel-prices/264590 "2021-02-17T15:29:48Z")

</div>

We are building a hotel reservation system. There will be 5000 hotels and each hotel can have up to 10 room types. The rates for each room depend on selected dates and number of adults. We are planning to prepare precalc…

---

## [Issue after disk problem: java.lang.IllegalArgumentException: requested snapshot generation \[10\] is not available. Min referenced generation is \[11\]](https://discuss.elastic.co/t/issue-after-disk-problem-java-lang-illegalargumentexception-requested-snapshot-generation-10-is-not-available-min-referenced-generation-is-11/264305)

<div class="topic-metadata">

**Author:** [@nico127](https://discuss.elastic.co/u/nico127)\
**Replies:** 6\
**Last updated:** [February 17, 2021, 3:01pm UTC](https://discuss.elastic.co/t/issue-after-disk-problem-java-lang-illegalargumentexception-requested-snapshot-generation-10-is-not-available-min-referenced-generation-is-11/264305 "2021-02-17T15:01:18Z")

</div>

Hi. We've had a disk problem last night, causing a whole slew of issues in our Elasticsearch cluster. We've been able to resolve all of them but one: 1 (replica-less) shard is problematic. However, this is an issue we ha…

---

## [Elasticsearch does not send logs to filebeat and/or Logstash](https://discuss.elastic.co/t/elasticsearch-does-not-send-logs-to-filebeat-and-or-logstash/264405)

<div class="topic-metadata">

**Author:** [@Royal](https://discuss.elastic.co/u/Royal)\
**Replies:** 11\
**Last updated:** [February 17, 2021, 2:56pm UTC](https://discuss.elastic.co/t/elasticsearch-does-not-send-logs-to-filebeat-and-or-logstash/264405 "2021-02-17T14:56:11Z")

</div>

Our situation is as follows: We have a Kubernetes Cluster with a lot of logs piling up. We would like to get a centralized place for the logs to query through. This centralized place is a local VM, which has Elasticsearc…

---

## [Supporting retries on Close operation](https://discuss.elastic.co/t/supporting-retries-on-close-operation/263631)

<div class="topic-metadata">

**Author:** [@Evesy](https://discuss.elastic.co/u/Evesy)\
**Replies:** 2\
**Last updated:** [February 17, 2021, 2:40pm UTC](https://discuss.elastic.co/t/supporting-retries-on-close-operation/263631 "2021-02-17T14:40:36Z")

</div>

I was going to open a feature request/question on Github but was guided here instead. I was interested in Curator supporting retry\_count &retry\_interval for the close operation, similar to how it exists for delete\_snaps…

---

## [Token filter doesn't work on wildcard-search](https://discuss.elastic.co/t/token-filter-doesnt-work-on-wildcard-search/264588)

<div class="topic-metadata">

**Author:** [@TallGuru](https://discuss.elastic.co/u/TallGuru)\
**Replies:** 0\
**Last updated:** [February 17, 2021, 2:31pm UTC](https://discuss.elastic.co/t/token-filter-doesnt-work-on-wildcard-search/264588 "2021-02-17T14:31:07Z")

</div>

Hi I'm trying to implement a filter to find compounded words and needs to combine it with wildcard-search but it doesn't work. Example case: There are documents with names "Coca-Cola", "Cocacola" and "Coca Cola". I wa…

---

## [Adding multi tenant encryption at rest](https://discuss.elastic.co/t/adding-multi-tenant-encryption-at-rest/264423)

<div class="topic-metadata">

**Author:** [@oriagranat9](https://discuss.elastic.co/u/oriagranat9)\
**Replies:** 5\
**Last updated:** [February 17, 2021, 2:28pm UTC](https://discuss.elastic.co/t/adding-multi-tenant-encryption-at-rest/264423 "2021-02-17T14:28:53Z")

</div>

hey everyone, at my job we want to add encryption at rest with multi tenant keys, like this plugin called elasticrypt did a long time ago. since this plugin is deprecated i wanted to know if it is still possible to do s…

---

## [org.apache.lucene.store.AlreadyClosedException: this IndexWriter is closed](https://discuss.elastic.co/t/org-apache-lucene-store-alreadyclosedexception-this-indexwriter-is-closed/264551)

<div class="topic-metadata">

**Author:** [@Farzad\_Ebrahimi](https://discuss.elastic.co/u/Farzad_Ebrahimi)\
**Replies:** 1\
**Last updated:** [February 17, 2021, 12:45pm UTC](https://discuss.elastic.co/t/org-apache-lucene-store-alreadyclosedexception-this-indexwriter-is-closed/264551 "2021-02-17T12:45:34Z")

</div>

Hi, we are doing single large index creation via java program on single elasticsearch node. after few millions of documents, we faced to this error: org.apache.lucene.store.AlreadyClosedException: this IndexWriter…

---

## [Multinode Cluster](https://discuss.elastic.co/t/multinode-cluster/264557)

<div class="topic-metadata">

**Author:** [@gafoc](https://discuss.elastic.co/u/gafoc)\
**Replies:** 1\
**Last updated:** [February 17, 2021, 12:30pm UTC](https://discuss.elastic.co/t/multinode-cluster/264557 "2021-02-17T12:30:22Z")

</div>

Hey can anyone help me setting up multi node cluster on 3 ubuntu machine making 1 as master node and the other two as slave node and injecting the data.

---

## [Lucene Total usage \< Fixed Bitsets usage?](https://discuss.elastic.co/t/lucene-total-usage-fixed-bitsets-usage/264564)

<div class="topic-metadata">

**Author:** [@val](https://discuss.elastic.co/u/val)\
**Replies:** 0\
**Last updated:** [February 17, 2021, 12:08pm UTC](https://discuss.elastic.co/t/lucene-total-usage-fixed-bitsets-usage/264564 "2021-02-17T12:08:10Z")

</div>

When looking at the index memory statistics in Kibana, I currently see this: My question is pretty simple: How come the "Fixed Bitsets" memory usage is bigger than the "Lucene Total" memory usage, even though the for…

---

## [HEAP Memory usage over 90%](https://discuss.elastic.co/t/heap-memory-usage-over-90/264400)

<div class="topic-metadata">

**Author:** [@HammerZEIT](https://discuss.elastic.co/u/HammerZEIT)\
**Replies:** 4\
**Last updated:** [February 17, 2021, 11:46am UTC](https://discuss.elastic.co/t/heap-memory-usage-over-90/264400 "2021-02-17T11:46:04Z")

</div>

Hi everyone, I'm facing an issue with the memory usage of ES. We have a 5 nodes cluster to store our logs sent from graylog. I've searching and reading around for a week now I made some change on my configuration but …

---

## [Romanization keyword sorting (specifically Pinyin)](https://discuss.elastic.co/t/romanization-keyword-sorting-specifically-pinyin/264558)

<div class="topic-metadata">

**Author:** [@UserName3](https://discuss.elastic.co/u/UserName3)\
**Replies:** 0\
**Last updated:** [February 17, 2021, 11:23am UTC](https://discuss.elastic.co/t/romanization-keyword-sorting-specifically-pinyin/264558 "2021-02-17T11:23:47Z")

</div>

Hi, Is sorting by Romanization, specifically Pinyin supported currently? It should be sorted along other languages with Roman alphabet, so the sorting results should be in an order like this: a, b, C, // ignore case j…

---

## [\[SOLVED\] Whole cluster down after sorting on \_id](https://discuss.elastic.co/t/solved-whole-cluster-down-after-sorting-on-id/264445)

<div class="topic-metadata">

**Author:** [@voharunado](https://discuss.elastic.co/u/voharunado)\
**Replies:** 4\
**Last updated:** [February 17, 2021, 10:28am UTC](https://discuss.elastic.co/t/solved-whole-cluster-down-after-sorting-on-id/264445 "2021-02-17T10:28:31Z")

</div>

Hi, I just had a massive issue with my ES prod cluster. I use an ES plugin for IntelliJ IDE that allows to see search result as a table, which can be ordered by clicking on the columns: it then add a sort parameter corr…

---

## [Don't get doc count after setting ilm](https://discuss.elastic.co/t/dont-get-doc-count-after-setting-ilm/264117)

<div class="topic-metadata">

**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\
**Replies:** 5\
**Last updated:** [February 17, 2021, 10:25am UTC](https://discuss.elastic.co/t/dont-get-doc-count-after-setting-ilm/264117 "2021-02-17T10:25:06Z")

</div>

I am using two indices each index is pointed to ilm. below is the index setting for two indices "index": { "lifecycle": { "name": "packetbeat\_flow", "rollover\_alias": "log-pb-flow" }, "number\_o…

---

## [Ingress Could not find the endpoints](https://discuss.elastic.co/t/ingress-could-not-find-the-endpoints/264238)

<div class="topic-metadata">

**Author:** [@Ahmed\_Abdulaleem](https://discuss.elastic.co/u/Ahmed_Abdulaleem)\
**Replies:** 2\
**Last updated:** [February 16, 2021, 1:32pm UTC](https://discuss.elastic.co/t/ingress-could-not-find-the-endpoints/264238 "2021-02-16T13:32:17Z")

</div>

I installed Elasticsearch with helm and nginx-ingress as nginx controller I added the ingress like that but when I check the ingress found this error why ingress resource could not find the endpoints

---

## [NEST Client - Mapping, aggregations, search for dynamic properties/attributes of a model](https://discuss.elastic.co/t/nest-client-mapping-aggregations-search-for-dynamic-properties-attributes-of-a-model/264544)

<div class="topic-metadata">

**Author:** [@krishnapss](https://discuss.elastic.co/u/krishnapss)\
**Replies:** 0\
**Last updated:** [February 17, 2021, 9:44am UTC](https://discuss.elastic.co/t/nest-client-mapping-aggregations-search-for-dynamic-properties-attributes-of-a-model/264544 "2021-02-17T09:44:34Z")

</div>

Hi, Could someone please help me to solve this problem. We are trying to integrate elasticsearch in our project using NEST Client. For our project we will have different schema per customer or product. e.g. cars, boo…

[Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=700)

[Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=702)
