# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=710 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 711 --- ## [Sum with negative fields (double type) strange result](https://discuss.elastic.co/t/sum-with-negative-fields-double-type-strange-result/263438)
**Author:** [@Maurip00](https://discuss.elastic.co/u/Maurip00)\ **Replies:** 0\ **Last updated:** [February 5, 2021, 4:43pm UTC](https://discuss.elastic.co/t/sum-with-negative-fields-double-type-strange-result/263438 "2021-02-05T16:43:00Z")
There is someone that could me explain why by this simple aggregation: \> GET cfo1/\_search \> { \> "size": 0, \> "aggs": { \> "NAME": { \> "filter": {...}, \> "aggs": { \> … --- ## [ElasticSearch: L2 norm script\_score returns false distances](https://discuss.elastic.co/t/elasticsearch-l2-norm-script-score-returns-false-distances/257384)
**Author:** [@christiana](https://discuss.elastic.co/u/christiana)\ **Replies:** 1\ **Last updated:** [February 5, 2021, 9:57pm UTC](https://discuss.elastic.co/t/elasticsearch-l2-norm-script-score-returns-false-distances/257384 "2021-02-05T21:57:44Z")
i'm trying to calculate the L2-Norm between the fields of my database. To validate the correctness I setup a testing database with two documents, which are having equal vectors. My db look like this: Documents \_index:… --- ## [Intermittent exception using high-level-rest-client. Unable to load a DateTransformer](https://discuss.elastic.co/t/intermittent-exception-using-high-level-rest-client-unable-to-load-a-datetransformer/262375)
**Author:** [@Srikar\_Yekollu](https://discuss.elastic.co/u/Srikar_Yekollu)\ **Replies:** 10\ **Last updated:** [February 5, 2021, 9:29pm UTC](https://discuss.elastic.co/t/intermittent-exception-using-high-level-rest-client-unable-to-load-a-datetransformer/262375 "2021-02-05T21:29:42Z")
Elastic Search Version: 7.9.2 Client: Java: elasticsearch-rest-high-level-client We use elastic search on Kubernetes in AWS. We are noticing these errors sporadically in our server logs. When this happens, all searche… --- ## [ES Data node global metadata not found](https://discuss.elastic.co/t/es-data-node-global-metadata-not-found/263452)
**Author:** [@Gratien](https://discuss.elastic.co/u/Gratien)\ **Replies:** 3\ **Last updated:** [February 5, 2021, 7:42pm UTC](https://discuss.elastic.co/t/es-data-node-global-metadata-not-found/263452 "2021-02-05T19:42:04Z")
Hello everyone, I'm working on a marathon hosted cluster (7.6.2) which is not very stable sometimes. Occasionnaly when there is a host failure, I end up with the following on a data node : java.lang.IllegalStateExcept… --- ## [Nodes being dropped from cluster](https://discuss.elastic.co/t/nodes-being-dropped-from-cluster/263161)
**Author:** [@khuang](https://discuss.elastic.co/u/khuang)\ **Replies:** 7\ **Last updated:** [February 5, 2021, 7:20pm UTC](https://discuss.elastic.co/t/nodes-being-dropped-from-cluster/263161 "2021-02-05T19:20:04Z")
I am currently trying to set up a 17 node cluster. 3 master nodes - 4 vCPU, 12 GB RAM, 7 GB Heap 10 data nodes - 15 vCPU, 116 GB RAM, 32 GB Heap 3 ingest nodes - 7 vCPU, 8 GB RAM, 2 GB Heap (Is this enough?) 1 coordi… --- ## [Removal of mapping types in 7.x: why not include index aliases in results?](https://discuss.elastic.co/t/removal-of-mapping-types-in-7-x-why-not-include-index-aliases-in-results/263293)
**Author:** [@Thomas\_Doman](https://discuss.elastic.co/u/Thomas_Doman)\ **Replies:** 0\ **Last updated:** [February 4, 2021, 7:10pm UTC](https://discuss.elastic.co/t/removal-of-mapping-types-in-7-x-why-not-include-index-aliases-in-results/263293 "2021-02-04T19:10:56Z")
ES: 6.8.13 NEST: 6.8.6 We're preparing to upgrade to ES 7.x and are considering the type removal. We've reviewed the suggestions in Removal of mapping types. Since the 1.x days, we haven't had multiple types in any o… --- ## [What is the best way to push/add new elements into a nested array of objects?](https://discuss.elastic.co/t/what-is-the-best-way-to-push-add-new-elements-into-a-nested-array-of-objects/263439)
**Author:** [@OB1290](https://discuss.elastic.co/u/OB1290)\ **Replies:** 0\ **Last updated:** [February 5, 2021, 4:47pm UTC](https://discuss.elastic.co/t/what-is-the-best-way-to-push-add-new-elements-into-a-nested-array-of-objects/263439 "2021-02-05T16:47:07Z")
I have a candidate Index where documents are structured like so : { "\_index" : "candidates", "\_type" : "\_doc", "\_id" : "a23OcncBXBMGOH6pwXge", "\_version" : 1, "\_seq\_no" : 1, "\_primary\_term" : 1, "found" : … --- ## [Best way to install Metricbeat on hundreds of machines](https://discuss.elastic.co/t/best-way-to-install-metricbeat-on-hundreds-of-machines/263245)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 3\ **Last updated:** [February 5, 2021, 3:31pm UTC](https://discuss.elastic.co/t/best-way-to-install-metricbeat-on-hundreds-of-machines/263245 "2021-02-05T15:31:33Z")
Hi. what will be the best way to install metricbeat in hundreds of machines? --- ## [Write in elasti is slow](https://discuss.elastic.co/t/write-in-elasti-is-slow/263403)
**Author:** [@Giovanni\_Di\_Lembo](https://discuss.elastic.co/u/Giovanni_Di_Lembo)\ **Replies:** 1\ **Last updated:** [February 5, 2021, 2:52pm UTC](https://discuss.elastic.co/t/write-in-elasti-is-slow/263403 "2021-02-05T14:52:01Z")
hi all and sorry for my poor english, I notice a write time very high on my index. I wonder if exists a way to write tons of doc quickly --- ## [Rolling upgrade to 7.x](https://discuss.elastic.co/t/rolling-upgrade-to-7-x/263386)
**Author:** [@srikanth\_k](https://discuss.elastic.co/u/srikanth_k)\ **Replies:** 0\ **Last updated:** [February 5, 2021, 1:29pm UTC](https://discuss.elastic.co/t/rolling-upgrade-to-7-x/263386 "2021-02-05T13:29:20Z")
In case of rolling upgrade, "In the unlikely case of a network malfunction during the upgrade process that isolates all remaining old nodes from the cluster, you must take the old nodes offline and upgrade them to enabl… --- ## [Reload\_search\_analyzers behaviour](https://discuss.elastic.co/t/reload-search-analyzers-behaviour/263376)
**Author:** [@Philippus\_Baalman](https://discuss.elastic.co/u/Philippus_Baalman)\ **Replies:** 1\ **Last updated:** [February 5, 2021, 11:43am UTC](https://discuss.elastic.co/t/reload-search-analyzers-behaviour/263376 "2021-02-05T11:43:39Z")
Maybe my memory is foggy but I thought that the 'reload\_search\_analyzers'-command only reloads the synonyms file (when the 'updateable'-field is set to true) and not other files (like stop\_words and stemmer\_override). W… --- ## [Load and Performance of Elastic](https://discuss.elastic.co/t/load-and-performance-of-elastic/260989)
**Author:** [@vikramnr](https://discuss.elastic.co/u/vikramnr)\ **Replies:** 2\ **Last updated:** [February 5, 2021, 10:50am UTC](https://discuss.elastic.co/t/load-and-performance-of-elastic/260989 "2021-02-05T10:50:58Z")
We are having single node architecture with 50 GB of physical space and 10 GB ram. We are looking to store around 90 Million documents spread across multiple index in the free version of Elastic search. Can Elastic sear… --- ## [Packetbeat OSS "HTTPS Error 404 - Not Found" with YUM](https://discuss.elastic.co/t/packetbeat-oss-https-error-404-not-found-with-yum/263360)
**Author:** [@gohovd](https://discuss.elastic.co/u/gohovd)\ **Replies:** 0\ **Last updated:** [February 5, 2021, 9:40am UTC](https://discuss.elastic.co/t/packetbeat-oss-https-error-404-not-found-with-yum/263360 "2021-02-05T09:40:21Z")
Hi all, Using the following elastic repo for oss: \[elastic-7.x\] name=Elastic repository for 7.x packages baseurl=https://artifacts.elastic.co/packages/oss-7.x/yum gpgcheck=1 gpgkey=https://artifacts.elastic.co/GPG-KEY-… --- ## [How to query by value in past bucket](https://discuss.elastic.co/t/how-to-query-by-value-in-past-bucket/263352)
**Author:** [@111439](https://discuss.elastic.co/u/111439)\ **Replies:** 0\ **Last updated:** [February 5, 2021, 8:45am UTC](https://discuss.elastic.co/t/how-to-query-by-value-in-past-bucket/263352 "2021-02-05T08:45:32Z")
Hi, Im' Newbie of ELK Stack. I have question of elasticsearch REST API, I want to select data 2 time. First I use range (-20s to -140s) and aggregation term and bucket sort to find min value in this time. ex : 08.30 AM… --- ## [How to make auto Complete filters multiple contexts with an AND operator](https://discuss.elastic.co/t/how-to-make-auto-complete-filters-multiple-contexts-with-an-and-operator/263353)
**Author:** [@awan.soekamto](https://discuss.elastic.co/u/awan.soekamto)\ **Replies:** 0\ **Last updated:** [February 5, 2021, 8:48am UTC](https://discuss.elastic.co/t/how-to-make-auto-complete-filters-multiple-contexts-with-an-and-operator/263353 "2021-02-05T08:48:45Z")
Hi, Is there any way I can return documents that match ALL the contexts? I use "contexts": { "suggestfilter\_groupid": \[3\], "suggestfilter\_userid": \[306\] } I want to just return documents that matches groupid 3 AND… --- ## [How to filter records that have no related record](https://discuss.elastic.co/t/how-to-filter-records-that-have-no-related-record/263240)
**Author:** [@Henk21](https://discuss.elastic.co/u/Henk21)\ **Replies:** 2\ **Last updated:** [February 5, 2021, 7:49am UTC](https://discuss.elastic.co/t/how-to-filter-records-that-have-no-related-record/263240 "2021-02-05T07:49:34Z")
I am loading a feed (ISE syslog events) in a given index. There are two types of events: Authentication events and Start events. The two are related through some unique session\_id. It may happen that for some Authenti… --- ## [ES HADOOP(7.9.0) , ELASTICSEARCH(7.9.0), HIVE(3.1.2)](https://discuss.elastic.co/t/es-hadoop-7-9-0-elasticsearch-7-9-0-hive-3-1-2/263338)
**Author:** [@ycseol](https://discuss.elastic.co/u/ycseol)\ **Replies:** 0\ **Last updated:** [February 5, 2021, 7:27am UTC](https://discuss.elastic.co/t/es-hadoop-7-9-0-elasticsearch-7-9-0-hive-3-1-2/263338 "2021-02-05T07:27:18Z")
hi~ i'm setting HADOOP cluster , ES cluster. so i need to transfer data 'HDFS' to 'ES' HDFS(hive) --\> ES(static index) hive table CREATE EXTERNAL TABLE es\_test(breed string, sex string) STORED BY 'org.elasticsearc… --- ## [Aggregate similar documents](https://discuss.elastic.co/t/aggregate-similar-documents/263332)
**Author:** [@Petr.Simik](https://discuss.elastic.co/u/Petr.Simik)\ **Replies:** 0\ **Last updated:** [February 5, 2021, 6:30am UTC](https://discuss.elastic.co/t/aggregate-similar-documents/263332 "2021-02-05T06:30:09Z")
I have a documents see example "message":"Syslog connection established; fd='15', server='AF\_INET(111.103.111.65:1514)', local='AF\_INET(0.0.0.0:0)'" "message":"Syslog connection established; fd='14', server='AF\_INET(222… --- ## [Why I got so many entries \*.createdAt and \*.updatedAt inside "fields"?](https://discuss.elastic.co/t/why-i-got-so-many-entries-createdat-and-updatedat-inside-fields/263326)
**Author:** [@thesn](https://discuss.elastic.co/u/thesn)\ **Replies:** 1\ **Last updated:** [February 5, 2021, 4:33am UTC](https://discuss.elastic.co/t/why-i-got-so-many-entries-createdat-and-updatedat-inside-fields/263326 "2021-02-05T04:33:02Z")
Hi, I am new to ELK. I have filebeat 7.8.1, Logstash 7.8.0 (in docker), Elasticsearch 7.8.0. I have log like this in my .log file: {"@timestamp":"2021-02-03T09:43:44.439+07:00","@version":"1","message":"channelAct… --- ## [Routing key for multi index query](https://discuss.elastic.co/t/routing-key-for-multi-index-query/263322)
**Author:** [@prosens](https://discuss.elastic.co/u/prosens)\ **Replies:** 0\ **Last updated:** [February 5, 2021, 3:16am UTC](https://discuss.elastic.co/t/routing-key-for-multi-index-query/263322 "2021-02-05T03:16:13Z")
For a multi-index query, is it possible to specify a separate routing key for each index? --- ## [Security roles not working for ML issue](https://discuss.elastic.co/t/security-roles-not-working-for-ml-issue/263320)
**Author:** [@seanziee](https://discuss.elastic.co/u/seanziee)\ **Replies:** 0\ **Last updated:** [February 5, 2021, 1:41am UTC](https://discuss.elastic.co/t/security-roles-not-working-for-ml-issue/263320 "2021-02-05T01:41:24Z")
I'm currently frustrated at the ML permissions. I've given one user access to the ML page on kibana, but I'd like the user only to be able to access the .ml index that I created for that user. I followed the directions … --- ## [Date format error from elasticsearch](https://discuss.elastic.co/t/date-format-error-from-elasticsearch/263307)
**Author:** [@earlsanchez](https://discuss.elastic.co/u/earlsanchez)\ **Replies:** 2\ **Last updated:** [February 4, 2021, 11:32pm UTC](https://discuss.elastic.co/t/date-format-error-from-elasticsearch/263307 "2021-02-04T23:32:11Z")
Hello, I originally posted this in the Logstash forum but it was suggested that I should post in Elasticsearch instead. I'm getting a date format error from elasticsearch but the format seems to match the posted date o… --- ## [Elasticsearch rollup question](https://discuss.elastic.co/t/elasticsearch-rollup-question/263095)
**Author:** [@jamesp220291](https://discuss.elastic.co/u/jamesp220291)\ **Replies:** 1\ **Last updated:** [February 4, 2021, 10:46pm UTC](https://discuss.elastic.co/t/elasticsearch-rollup-question/263095 "2021-02-04T22:46:08Z")
hI I Just have a question re the rollup feature. if i have a index, attached to a ILM which deletes the index after 30 days. if i roll this up daily, does the rollup job also delete the index once it has completed, or… --- ## [Simple Query String Search - Wildcard (\*) inside a phrase (" ")](https://discuss.elastic.co/t/simple-query-string-search-wildcard-inside-a-phrase/263190)
**Author:** [@russellmenezes](https://discuss.elastic.co/u/russellmenezes)\ **Replies:** 1\ **Last updated:** [February 4, 2021, 10:40pm UTC](https://discuss.elastic.co/t/simple-query-string-search-wildcard-inside-a-phrase/263190 "2021-02-04T22:40:36Z")
Hi every one, I've been looking all over the web on how to preform a wildcard query inside a phrase search. I have used the English Analyzer to index a text field. I have also modified the analyzer with a custom mappi… --- ## [Error 404 on \[server\]/\_search (works fine on my other instance!)](https://discuss.elastic.co/t/error-404-on-server-search-works-fine-on-my-other-instance/263288)
**Author:** [@thiago.preihs](https://discuss.elastic.co/u/thiago.preihs)\ **Replies:** 0\ **Last updated:** [February 4, 2021, 6:51pm UTC](https://discuss.elastic.co/t/error-404-on-server-search-works-fine-on-my-other-instance/263288 "2021-02-04T18:51:57Z")
Hello guys! I am scratching my head to understand why the same very simple query works fine on one instance (v. 7.6.0) but does not work on my other instance (v. 7.9.3) - I get 404. curl --location --request GET 'https… --- ## [How to use OCR in Elasticsearch ingest attachment plugin?](https://discuss.elastic.co/t/how-to-use-ocr-in-elasticsearch-ingest-attachment-plugin/263007)
**Author:** [@OB1290](https://discuss.elastic.co/u/OB1290)\ **Replies:** 11\ **Last updated:** [February 4, 2021, 4:27pm UTC](https://discuss.elastic.co/t/how-to-use-ocr-in-elasticsearch-ingest-attachment-plugin/263007 "2021-02-04T16:27:31Z")
I was able to make the plugin work with PDFs that contain searchable text. When I give it a PDF or PNG with non searchable text, it fails to extract the text from the binary data. Unfortunately, I couldn't find anything… --- ## [ES 7.8 Percolate Performance Issues](https://discuss.elastic.co/t/es-7-8-percolate-performance-issues/263262)
**Author:** [@plush](https://discuss.elastic.co/u/plush)\ **Replies:** 0\ **Last updated:** [February 4, 2021, 3:23pm UTC](https://discuss.elastic.co/t/es-7-8-percolate-performance-issues/263262 "2021-02-04T15:23:46Z")
We've recently updated our Elasticsearch cluster version from 6.7 to 7.8. Since we upgraded, we've noticed that the performance of our percolate queries has significantly degraded. For reference, when running a single-t… --- ## [Can I use my time range in a details visualization?](https://discuss.elastic.co/t/can-i-use-my-time-range-in-a-details-visualization/263255)
**Author:** [@ematal96](https://discuss.elastic.co/u/ematal96)\ **Replies:** 0\ **Last updated:** [February 4, 2021, 2:44pm UTC](https://discuss.elastic.co/t/can-i-use-my-time-range-in-a-details-visualization/263255 "2021-02-04T14:44:17Z")
Hi all, I need to parse my time range into my scripted field to set a details table to start from: "time-range-start" , to:"time-range-end". Actually i've a scripted filed that create the visualization with a fixed t… --- ## [Same output when searching exact phrase in Discovery search](https://discuss.elastic.co/t/same-output-when-searching-exact-phrase-in-discovery-search/263248)
**Author:** [@nastymajestic](https://discuss.elastic.co/u/nastymajestic)\ **Replies:** 0\ **Last updated:** [February 4, 2021, 2:09pm UTC](https://discuss.elastic.co/t/same-output-when-searching-exact-phrase-in-discovery-search/263248 "2021-02-04T14:09:00Z")
I'm trying to search for exact phrase in Discovery tab. In "message" field I'm trying to search for "transactionId:" phrase (with quotation marks) and when I search for it like this: "message": "\\"transactionId\\"\\:" It… --- ## [Search between two indexes](https://discuss.elastic.co/t/search-between-two-indexes/262216)
**Author:** [@rohit\_pandey](https://discuss.elastic.co/u/rohit_pandey)\ **Replies:** 5\ **Last updated:** [February 4, 2021, 12:42pm UTC](https://discuss.elastic.co/t/search-between-two-indexes/262216 "2021-02-04T12:42:07Z")
I have two indexes: Index1 | id | name | | 1 | A | | 2 | B | | 3 | Z | Index2 | id | stmt\_id | description | | 1 | 11 | AAA | 2 | 11 | BBB | 3 | 11 | BBC | 4 | 22 | … [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=709) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=711)