# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=717 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 718 --- ## [Problem with elasticsearch ILM](https://discuss.elastic.co/t/problem-with-elasticsearch-ilm/262265)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 3\ **Last updated:** [January 27, 2021, 7:35am UTC](https://discuss.elastic.co/t/problem-with-elasticsearch-ilm/262265 "2021-01-27T07:35:22Z")
I have an index log-wlb-sysmon-2021.01.26 having 3 shards and zero replica its size is 30 mb. Here is my sysmon index template "refresh\_interval": "5s", "number\_of\_shards": "3", "number\_of\_replicas": "0" Now … --- ## [Esrally deployment on Kubernetes](https://discuss.elastic.co/t/esrally-deployment-on-kubernetes/261960)
**Author:** [@mastermind](https://discuss.elastic.co/u/mastermind)\ **Replies:** 1\ **Last updated:** [January 27, 2021, 7:34am UTC](https://discuss.elastic.co/t/esrally-deployment-on-kubernetes/261960 "2021-01-27T07:34:51Z")
Hi, I want to deploy esrally on the Kubernetes cluster to test the performance and then run the queries can anyone tell me how I can deploy that on Kubernetes cluster. Any help would be appreciated Thank you so much --- ## [Master not discovered or elected yet, an election requires 2 nodes with ids](https://discuss.elastic.co/t/master-not-discovered-or-elected-yet-an-election-requires-2-nodes-with-ids/262205)
**Author:** [@sadff](https://discuss.elastic.co/u/sadff)\ **Replies:** 8\ **Last updated:** [January 27, 2021, 6:59am UTC](https://discuss.elastic.co/t/master-not-discovered-or-elected-yet-an-election-requires-2-nodes-with-ids/262205 "2021-01-27T06:59:25Z")
\*\*config file \*\* version: '2.2' services: es03: image: docker.elastic.co/elasticsearch/elasticsearch:7.10.2 container\_name: es03 environment: - node.name=es03 - network.publish\_host=192.168.61.… --- ## [Whitelisting own cloud elasticsearch instance IP](https://discuss.elastic.co/t/whitelisting-own-cloud-elasticsearch-instance-ip/262313)
**Author:** [@mkadiri](https://discuss.elastic.co/u/mkadiri)\ **Replies:** 0\ **Last updated:** [January 27, 2021, 5:35am UTC](https://discuss.elastic.co/t/whitelisting-own-cloud-elasticsearch-instance-ip/262313 "2021-01-27T05:35:02Z")
For one our deployments we've created a traffic filter via https://cloud.elastic.co/deployment-features/traffic-filters that whitelists our VPN IP addresses. This works as expected, I can only access elasticsearch/kiban… --- ## [Do i need a paid license to configure user-name password?](https://discuss.elastic.co/t/do-i-need-a-paid-license-to-configure-user-name-password/262316)
**Author:** [@pemfir](https://discuss.elastic.co/u/pemfir)\ **Replies:** 1\ **Last updated:** [January 27, 2021, 5:56am UTC](https://discuss.elastic.co/t/do-i-need-a-paid-license-to-configure-user-name-password/262316 "2021-01-27T05:56:20Z")
I work for a company and at this stage doing very preliminary research on toy data on one single server. Do I need a paid license to configure username/password in elastic-search stack ? In particular do I need a paid … --- ## [Request rejected(400) without details(root-cause) in 6.2.4](https://discuss.elastic.co/t/request-rejected-400-without-details-root-cause-in-6-2-4/262185)
**Author:** [@Long\_Quanzheng](https://discuss.elastic.co/u/Long_Quanzheng)\ **Replies:** 4\ **Last updated:** [January 27, 2021, 1:39am UTC](https://discuss.elastic.co/t/request-rejected-400-without-details-root-cause-in-6-2-4/262185 "2021-01-27T01:39:19Z")
Hi, how do I troubleshoot rejected request ElasticSearch 6.2.4? The request got Error: elastic: Error 400 (Bad Request): all shards failed \[type=search\_phase\_execution\_exception\] As the returned but there is no detail… --- ## [Elasticsearch possible same \_id for parent-child](https://discuss.elastic.co/t/elasticsearch-possible-same-id-for-parent-child/262217)
**Author:** [@J\_Kit](https://discuss.elastic.co/u/J_Kit)\ **Replies:** 1\ **Last updated:** [January 26, 2021, 9:38pm UTC](https://discuss.elastic.co/t/elasticsearch-possible-same-id-for-parent-child/262217 "2021-01-26T21:38:00Z")
Hi As I designing the elastic search for parent-child document type, I encounter this situation where my the parent and Child database table is different. And when I combine both into the parent child, the will be pos… --- ## [Watcher email configuration postfix 7.5](https://discuss.elastic.co/t/watcher-email-configuration-postfix-7-5/262262)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 0\ **Last updated:** [January 26, 2021, 5:24pm UTC](https://discuss.elastic.co/t/watcher-email-configuration-postfix-7-5/262262 "2021-01-26T17:24:44Z")
Hi, I was using this configuration in elasticsearch.yml for the email, but a friend told me that I was suposed to use the local postfix for the email, currently is pointing to the relay. xpack.notification.email.account… --- ## [Define a global default type for a string](https://discuss.elastic.co/t/define-a-global-default-type-for-a-string/262281)
**Author:** [@liorg2](https://discuss.elastic.co/u/liorg2)\ **Replies:** 0\ **Last updated:** [January 26, 2021, 8:56pm UTC](https://discuss.elastic.co/t/define-a-global-default-type-for-a-string/262281 "2021-01-26T20:56:52Z")
Hello, Can I ask elasticsearch to treat incoming strings as keyword , for any future created index without a matched template? Something like global template Thanks --- ## [High RAM usage by data nodes (Kubernetes)](https://discuss.elastic.co/t/high-ram-usage-by-data-nodes-kubernetes/262008)
**Author:** [@itsron](https://discuss.elastic.co/u/itsron)\ **Replies:** 4\ **Last updated:** [January 26, 2021, 7:58pm UTC](https://discuss.elastic.co/t/high-ram-usage-by-data-nodes-kubernetes/262008 "2021-01-26T19:58:32Z")
We are running v7.10.1 on Kubernetes. We've 4 data nodes each with 4 cpus and 16gb RAM (8gb heap). Currently it has only metricbeat and filebeat writing data into it which is a total of ~1.5M docs/hour (~10GB/day,retaine… --- ## [Building Elasticsearch source code stuck at 99%](https://discuss.elastic.co/t/building-elasticsearch-source-code-stuck-at-99/262242)
**Author:** [@Amr\_Rady](https://discuss.elastic.co/u/Amr_Rady)\ **Replies:** 1\ **Last updated:** [January 26, 2021, 4:46pm UTC](https://discuss.elastic.co/t/building-elasticsearch-source-code-stuck-at-99/262242 "2021-01-26T16:46:32Z")
I am trying to build the source code but it stuck at 99% --- ## [ES 6.8.0 on Ubuntu 16.04 starts properly but Systemd times out](https://discuss.elastic.co/t/es-6-8-0-on-ubuntu-16-04-starts-properly-but-systemd-times-out/262155)
**Author:** [@jtbis](https://discuss.elastic.co/u/jtbis)\ **Replies:** 2\ **Last updated:** [January 26, 2021, 12:15pm UTC](https://discuss.elastic.co/t/es-6-8-0-on-ubuntu-16-04-starts-properly-but-systemd-times-out/262155 "2021-01-26T12:15:30Z")
Hello, I have a server where ES is starting properly, but the service is always showing activating. With TimeoutStartSec=infinity in the service file, everything functions as normal except for the service always stayin… --- ## [Can I use "script" to truncate a field so it's 950 characters or less in a watcher?](https://discuss.elastic.co/t/can-i-use-script-to-truncate-a-field-so-its-950-characters-or-less-in-a-watcher/261277)
**Author:** [@runtman](https://discuss.elastic.co/u/runtman)\ **Replies:** 1\ **Last updated:** [January 26, 2021, 12:06pm UTC](https://discuss.elastic.co/t/can-i-use-script-to-truncate-a-field-so-its-950-characters-or-less-in-a-watcher/261277 "2021-01-26T12:06:38Z")
So, we use PagerDuty as an action for our alerts. Unfortunately, with this action you can only set description so we must try to plug as much information into the field before we fire off the alert. Sometimes this means… --- ## [Timezone with negative (minus) value return more bucket before gte range](https://discuss.elastic.co/t/timezone-with-negative-minus-value-return-more-bucket-before-gte-range/262133)
**Author:** [@anas-hossam](https://discuss.elastic.co/u/anas-hossam)\ **Replies:** 0\ **Last updated:** [January 25, 2021, 4:13pm UTC](https://discuss.elastic.co/t/timezone-with-negative-minus-value-return-more-bucket-before-gte-range/262133 "2021-01-25T16:13:00Z")
i am trying to get docs matching query from elastic v1.5 { "range": { "create\_time": { "gte": "2020-07-20T00:00:00", "lte": "2020-07-30T23:59:59", "time\_zone": "-2:00" … --- ## [Can I filter an array in elastic?](https://discuss.elastic.co/t/can-i-filter-an-array-in-elastic/262198)
**Author:** [@ShreyaBhat](https://discuss.elastic.co/u/ShreyaBhat)\ **Replies:** 2\ **Last updated:** [January 26, 2021, 8:33am UTC](https://discuss.elastic.co/t/can-i-filter-an-array-in-elastic/262198 "2021-01-26T08:33:41Z")
is there a way to filter an array in elastic ? I have inserted the following data into elastic "\_source":{ "FileName": "fileName.log" "logData": \[ { "LineNumber": 1, … --- ## [Sort by every element of array](https://discuss.elastic.co/t/sort-by-every-element-of-array/262201)
**Author:** [@Dmitrii](https://discuss.elastic.co/u/Dmitrii)\ **Replies:** 0\ **Last updated:** [January 26, 2021, 8:02am UTC](https://discuss.elastic.co/t/sort-by-every-element-of-array/262201 "2021-01-26T08:02:50Z")
Hello, I have some problems with sorting by element of array. If I have for example 2 documents like: { "\_id" : "1", "\_source" : { "users" : \[{"name" : "John"},{"name" : "Paul"}\] } } { "\_id" : "2", "\_so… --- ## [Pagination with HighLevelRestClient](https://discuss.elastic.co/t/pagination-with-highlevelrestclient/262146)
**Author:** [@filmac79](https://discuss.elastic.co/u/filmac79)\ **Replies:** 8\ **Last updated:** [January 26, 2021, 6:18am UTC](https://discuss.elastic.co/t/pagination-with-highlevelrestclient/262146 "2021-01-26T06:18:47Z")
Hello, I would like to use HighLevelRestClient to fetch all results matching a given query using pagination. Now, checking on the rest api I can found that scroll api have been replaced by search\_after. So I checked th… --- ## [Issue using searchable snapshots in an ILM policy](https://discuss.elastic.co/t/issue-using-searchable-snapshots-in-an-ilm-policy/262001)
**Author:** [@3266miles](https://discuss.elastic.co/u/3266miles)\ **Replies:** 2\ **Last updated:** [January 26, 2021, 3:33am UTC](https://discuss.elastic.co/t/issue-using-searchable-snapshots-in-an-ilm-policy/262001 "2021-01-26T03:33:40Z")
Taking searchable snapshots as part of an ILM policy for a spin, the indexes seem to be moving through the stages fine until it reaches the cold stage, where it takes the snapshot but then utterly fails to mount it. Run… --- ## [How to import Nested JSON?](https://discuss.elastic.co/t/how-to-import-nested-json/262183)
**Author:** [@hourtest](https://discuss.elastic.co/u/hourtest)\ **Replies:** 0\ **Last updated:** [January 26, 2021, 1:33am UTC](https://discuss.elastic.co/t/how-to-import-nested-json/262183 "2021-01-26T01:33:43Z")
Nested JSON like this { "boolean\_key": "--- true\\n", "empty\_string\_translation": "", "key\_with\_description": "Check it out! This key has a description! (At least in some formats)", "key\_with\_line-break": "This … --- ## [Global index settings](https://discuss.elastic.co/t/global-index-settings/262176)
**Author:** [@cdalexndr](https://discuss.elastic.co/u/cdalexndr)\ **Replies:** 0\ **Last updated:** [January 25, 2021, 11:07pm UTC](https://discuss.elastic.co/t/global-index-settings/262176 "2021-01-25T23:07:30Z")
I want to apply some global index settings (index.number\_of\_replicas, index.codec) to any new created index. From https://discuss.elastic.co/t/index-settings-in-configuration-file-does-not-take-effect/113120 I understan… --- ## [Difference between nested in bool and bool in nested](https://discuss.elastic.co/t/difference-between-nested-in-bool-and-bool-in-nested/262161)
**Author:** [@Anton\_Shuvaev](https://discuss.elastic.co/u/Anton_Shuvaev)\ **Replies:** 0\ **Last updated:** [January 25, 2021, 7:14pm UTC](https://discuss.elastic.co/t/difference-between-nested-in-bool-and-bool-in-nested/262161 "2021-01-25T19:14:26Z")
Is there a difference in terms of performance and cache between nested query inside bool query and vice versa? For example, { "query": { "bool": { "filter": \[ { "nested": { "pa… --- ## [How to get elastic search \_score in the response without script\_score being applied](https://discuss.elastic.co/t/how-to-get-elastic-search-score-in-the-response-without-script-score-being-applied/262085)
**Author:** [@oo7\_manju](https://discuss.elastic.co/u/oo7_manju)\ **Replies:** 0\ **Last updated:** [January 25, 2021, 11:20am UTC](https://discuss.elastic.co/t/how-to-get-elastic-search-score-in-the-response-without-script-score-being-applied/262085 "2021-01-25T11:20:59Z")
Hi, We are looking for fetching \_score value from elastic search response., but looks like \_score value always includes the applied script\_score. We have script\_score to boost the relevancy in the query, and the requi… --- ## [Elastic Search Aggregations](https://discuss.elastic.co/t/elastic-search-aggregations/262009)
**Author:** [@Srini12](https://discuss.elastic.co/u/Srini12)\ **Replies:** 1\ **Last updated:** [January 25, 2021, 6:01pm UTC](https://discuss.elastic.co/t/elastic-search-aggregations/262009 "2021-01-25T18:01:20Z")
Hi I am trying to build small app with facets, I am using NEST to get aggregations. When I execute the aggregations query using cURL iam getting expected results: my cURL is POST product/\_search { "aggs": { "g… --- ## [Fixing Legacy 'Self Monitoring' for Docker containers](https://discuss.elastic.co/t/fixing-legacy-self-monitoring-for-docker-containers/262151)
**Author:** [@doyelese](https://discuss.elastic.co/u/doyelese)\ **Replies:** 1\ **Last updated:** [January 25, 2021, 5:56pm UTC](https://discuss.elastic.co/t/fixing-legacy-self-monitoring-for-docker-containers/262151 "2021-01-25T17:56:29Z")
I am getting the warning that Self Monitoring will not be supported in 8.0. My elastic environment is configured via 5 ElasticSearch container nodes and 1 Kibana container. How do I migrate away from self monitoring the… --- ## [Elasticsearch moving a replica shard between nodes](https://discuss.elastic.co/t/elasticsearch-moving-a-replica-shard-between-nodes/262042)
**Author:** [@vikasp](https://discuss.elastic.co/u/vikasp)\ **Replies:** 6\ **Last updated:** [January 25, 2021, 5:10pm UTC](https://discuss.elastic.co/t/elasticsearch-moving-a-replica-shard-between-nodes/262042 "2021-01-25T17:10:24Z")
Hi, I have a cluster with almost all nodes 111 shards and only 2 nodes 108. I understand that ES balance the cluster with shard count. cluster has around 19 nodes, 3 master eligible of them 2 data as well and 16 data… --- ## [Does the PIT API allow scrolling backward?](https://discuss.elastic.co/t/does-the-pit-api-allow-scrolling-backward/260129)
**Author:** [@F\_eq\_kx](https://discuss.elastic.co/u/F_eq_kx)\ **Replies:** 4\ **Last updated:** [January 25, 2021, 5:05pm UTC](https://discuss.elastic.co/t/does-the-pit-api-allow-scrolling-backward/260129 "2021-01-25T17:05:02Z")
The deprecated Scroll API didn't allow scrolling backward. Now that it is being replaced, is there a way to do that with PIT? --- ## [Elastic does not perform rollover automatically](https://discuss.elastic.co/t/elastic-does-not-perform-rollover-automatically/261395)
**Author:** [@Kosodrom](https://discuss.elastic.co/u/Kosodrom)\ **Replies:** 13\ **Last updated:** [January 25, 2021, 4:34pm UTC](https://discuss.elastic.co/t/elastic-does-not-perform-rollover-automatically/261395 "2021-01-25T16:34:08Z")
Hi folks I have following setup: filebeat sends logs from kubernetes cluster to logstash. Logstash sends them to elastic. These are the configurations of important components: Index template: "filebeat-k8s-logs" : { … --- ## [Moving my first logs to ECS](https://discuss.elastic.co/t/moving-my-first-logs-to-ecs/261567)
**Author:** [@leostereo](https://discuss.elastic.co/u/leostereo)\ **Replies:** 5\ **Last updated:** [January 25, 2021, 4:29pm UTC](https://discuss.elastic.co/t/moving-my-first-logs-to-ecs/261567 "2021-01-25T16:29:41Z")
Hi friends. After succesing submiting my custom events into elk and visalize ok kibana, I would like to improve my event login format. After googlin about creating custom ecs index and indexing its documents , I did no… --- ## [Debuging a watcher](https://discuss.elastic.co/t/debuging-a-watcher/262138)
**Author:** [@Bastien\_SANDER](https://discuss.elastic.co/u/Bastien_SANDER)\ **Replies:** 0\ **Last updated:** [January 25, 2021, 4:23pm UTC](https://discuss.elastic.co/t/debuging-a-watcher/262138 "2021-01-25T16:23:31Z")
I want to update all document of a collection, and setting a boolean to false if the documents are returned by a query. I would like to create the following watcher : { "trigger": { "schedule": { … --- ## [Monitor transforms](https://discuss.elastic.co/t/monitor-transforms/261538)
**Author:** [@liorg2](https://discuss.elastic.co/u/liorg2)\ **Replies:** 3\ **Last updated:** [January 25, 2021, 3:50pm UTC](https://discuss.elastic.co/t/monitor-transforms/261538 "2021-01-25T15:50:05Z")
Hello, Any recommendation about monitoring transforms/ ML jobs performance ? I have lots of them, and I'm not sure which one is causing this issue every hour at about XX:35: I've tried the hot threads, but it's chang… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=716) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=718)