# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=724 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 725 --- ## [Java RestHighLevelClient: Offset stripped from query for Datehistogram in Composite aggregation](https://discuss.elastic.co/t/java-resthighlevelclient-offset-stripped-from-query-for-datehistogram-in-composite-aggregation/261259)
**Author:** [@jselberg](https://discuss.elastic.co/u/jselberg)\ **Replies:** 0\ **Last updated:** [January 15, 2021, 12:51pm UTC](https://discuss.elastic.co/t/java-resthighlevelclient-offset-stripped-from-query-for-datehistogram-in-composite-aggregation/261259 "2021-01-15T12:51:25Z")
Hi, We're trying to aggregate some data on a weekly basis, but we would like to adjust the calculation of weeks so that the weeks starts on Sundays instead. We've tried using the offset() operation from the DateHistogr… --- ## [How to create a watcher script to match one field with other field in same document](https://discuss.elastic.co/t/how-to-create-a-watcher-script-to-match-one-field-with-other-field-in-same-document/260424)
**Author:** [@sangatamilan](https://discuss.elastic.co/u/sangatamilan)\ **Replies:** 0\ **Last updated:** [January 7, 2021, 9:13am UTC](https://discuss.elastic.co/t/how-to-create-a-watcher-script-to-match-one-field-with-other-field-in-same-document/260424 "2021-01-07T09:13:48Z")
Hi , Can anyone please help me on this scenario to create an alert I am having a log events like the following \<#\> 20200806 17:04:23.261 280018000 EV.WRN \[ MVINB-LSL2.T1G1\_WEBSVR1 main.main TSP1.T1G1\_WEB… --- ## [Java Rest API does not allow ForceMergeAction for hot phase in LifeCyclePolicy](https://discuss.elastic.co/t/java-rest-api-does-not-allow-forcemergeaction-for-hot-phase-in-lifecyclepolicy/261258)
**Author:** [@ismarslomic](https://discuss.elastic.co/u/ismarslomic)\ **Replies:** 0\ **Last updated:** [January 15, 2021, 12:41pm UTC](https://discuss.elastic.co/t/java-rest-api-does-not-allow-forcemergeaction-for-hot-phase-in-lifecyclepolicy/261258 "2021-01-15T12:41:55Z")
While Elasticsearch REST API allows defining forcemerge action for hot phase, Java Rest API (v7.10.2) does not. This is allowed: PUT \_ilm/policy/custom-ilm-policy { "policy": { "phases": { "hot": { … --- ## [Getting error while fetching Array field using elasticsearch-sql-cli](https://discuss.elastic.co/t/getting-error-while-fetching-array-field-using-elasticsearch-sql-cli/260943)
**Author:** [@MaheshMali](https://discuss.elastic.co/u/MaheshMali)\ **Replies:** 2\ **Last updated:** [January 15, 2021, 11:42am UTC](https://discuss.elastic.co/t/getting-error-while-fetching-array-field-using-elasticsearch-sql-cli/260943 "2021-01-15T11:42:18Z")
Hi Team, I am using elasticsearch-sql-cli to fetch host.ip field value from an index called "filebeattest". The value of host.ip is shown as "10.1.10.24, 2603:301b:1080:e000:250:56ff:fe87:4, fe80::250:56ff:fe87:4" in K… --- ## [There are no external requests known to support wildcards that don't support replacing their indices](https://discuss.elastic.co/t/there-are-no-external-requests-known-to-support-wildcards-that-dont-support-replacing-their-indices/261207)
**Author:** [@tianhao](https://discuss.elastic.co/u/tianhao)\ **Replies:** 3\ **Last updated:** [January 15, 2021, 11:31am UTC](https://discuss.elastic.co/t/there-are-no-external-requests-known-to-support-wildcards-that-dont-support-replacing-their-indices/261207 "2021-01-15T11:31:10Z")
Hello, I perform the following operations, and prompt There are no external requests known to support wildcards that don't support replacing their indices elasticsearch version: 7.8.1 POST /\*:.monitoring-es-7-\*,.monit… --- ## [Taking a snapshot](https://discuss.elastic.co/t/taking-a-snapshot/261237)
**Author:** [@Jambo80](https://discuss.elastic.co/u/Jambo80)\ **Replies:** 1\ **Last updated:** [January 15, 2021, 10:39am UTC](https://discuss.elastic.co/t/taking-a-snapshot/261237 "2021-01-15T10:39:52Z")
Hi I'm trying to take a snapshot of my 7 node 6.8.13 cluster. Is it the case that I must have some sort of network share such as NFS to achieve this, or is there a method which does not require a network share? Thanks --- ## [Aggregate 7 fields and get the sum of another field](https://discuss.elastic.co/t/aggregate-7-fields-and-get-the-sum-of-another-field/261211)
**Author:** [@vands](https://discuss.elastic.co/u/vands)\ **Replies:** 4\ **Last updated:** [January 15, 2021, 10:14am UTC](https://discuss.elastic.co/t/aggregate-7-fields-and-get-the-sum-of-another-field/261211 "2021-01-15T10:14:25Z")
Hi All, I have a scenario , where I would need to aggregate 7 fields and get the sum of other field with each unique set . Any suggestions which would solve my issue. --- ## [ILM is not working as per parameter](https://discuss.elastic.co/t/ilm-is-not-working-as-per-parameter/261077)
**Author:** [@shoaib\_akram](https://discuss.elastic.co/u/shoaib_akram)\ **Replies:** 4\ **Last updated:** [January 15, 2021, 9:22am UTC](https://discuss.elastic.co/t/ilm-is-not-working-as-per-parameter/261077 "2021-01-15T09:22:08Z")
HI, here is my policy and template and attached conf file, 4100+ documents ingested successfully but it is not rolled over on 1000 doc check please help me out why it is not rolling over Here is my conf content input { … --- ## [Need help ELK Gurus?](https://discuss.elastic.co/t/need-help-elk-gurus/260716)
**Author:** [@Ganesh\_Sharma](https://discuss.elastic.co/u/Ganesh_Sharma)\ **Replies:** 3\ **Last updated:** [January 15, 2021, 7:41am UTC](https://discuss.elastic.co/t/need-help-elk-gurus/260716 "2021-01-15T07:41:19Z")
How do we design the size of elastic database? Is there a way to control the data being stored by elastic database? How to see the types of logs (stdout, stderr) being stored in elastic database? How to control the lo… --- ## [While taking snapshot of elastic index it takes data of which shards like primary or replica?](https://discuss.elastic.co/t/while-taking-snapshot-of-elastic-index-it-takes-data-of-which-shards-like-primary-or-replica/260953)
**Author:** [@tahseen\_fatima](https://discuss.elastic.co/u/tahseen_fatima)\ **Replies:** 7\ **Last updated:** [January 15, 2021, 7:18am UTC](https://discuss.elastic.co/t/while-taking-snapshot-of-elastic-index-it-takes-data-of-which-shards-like-primary-or-replica/260953 "2021-01-15T07:18:19Z")
Hi, I have a setup of ELK 7.10.0v. I am taking backup of elasticsearch index using snapshot API. I have a doubt while taking backup with sanpshot which shards backup does it takes like primary or replica or it takes ba… --- ## [Convert field data type from text to Date](https://discuss.elastic.co/t/convert-field-data-type-from-text-to-date/260781)
**Author:** [@Sathish22](https://discuss.elastic.co/u/Sathish22)\ **Replies:** 10\ **Last updated:** [January 15, 2021, 6:08am UTC](https://discuss.elastic.co/t/convert-field-data-type-from-text-to-date/260781 "2021-01-15T06:08:30Z")
Hi All, We have created an index that consists of text data type for all fields, but we need to convert timestamp field from text to date (format "2021-01-12 09:19:25.890") but unable to do. I have tried creating a new… --- ## [Does adding data nodes increase write throughput](https://discuss.elastic.co/t/does-adding-data-nodes-increase-write-throughput/261205)
**Author:** [@rex-remind](https://discuss.elastic.co/u/rex-remind)\ **Replies:** 3\ **Last updated:** [January 15, 2021, 4:50am UTC](https://discuss.elastic.co/t/does-adding-data-nodes-increase-write-throughput/261205 "2021-01-15T04:50:46Z")
Question is, all other things equal, and assuming even distribution of shards, does adding data nodes increase write throughput? My assumption is yes, I'd imagine the new data nodes could take on the burden of dealing w… --- ## [K8s metricbeat data volume](https://discuss.elastic.co/t/k8s-metricbeat-data-volume/261201)
**Author:** [@tim11](https://discuss.elastic.co/u/tim11)\ **Replies:** 0\ **Last updated:** [January 15, 2021, 3:34am UTC](https://discuss.elastic.co/t/k8s-metricbeat-data-volume/261201 "2021-01-15T03:34:40Z")
I am following link: https://www.elastic.co/guide/en/beats/metricbeat/6.8/running-on-kubernetes.html I find in the metricbeat-kubernetes.yaml, I am wondering whether I shall mount external volume in? or the data fold… --- ## [Most efficient way to limit search result to List of Ids](https://discuss.elastic.co/t/most-efficient-way-to-limit-search-result-to-list-of-ids/261082)
**Author:** [@Hooman\_Bahreini](https://discuss.elastic.co/u/Hooman_Bahreini)\ **Replies:** 0\ **Last updated:** [January 14, 2021, 6:57am UTC](https://discuss.elastic.co/t/most-efficient-way-to-limit-search-result-to-list-of-ids/261082 "2021-01-14T06:57:31Z")
I am working on an e-commerce website. I have an index called AdDocument which is the products that are synched to Elasticsearch. Each product belongs to a category. Now I want to write a query to get all products which… --- ## [Mapping document indexing with NEST](https://discuss.elastic.co/t/mapping-document-indexing-with-nest/261156)
**Author:** [@Izzy](https://discuss.elastic.co/u/Izzy)\ **Replies:** 0\ **Last updated:** [January 14, 2021, 5:06pm UTC](https://discuss.elastic.co/t/mapping-document-indexing-with-nest/261156 "2021-01-14T17:06:45Z")
I'm using .NET Core application with NEST client. My goal is to index a model with few modifications in its properties, for example, this model contains list of objects, and I would like to document list of the Ids of t… --- ## [Which is the best option for upload photo images and search?](https://discuss.elastic.co/t/which-is-the-best-option-for-upload-photo-images-and-search/261194)
**Author:** [@rajends1](https://discuss.elastic.co/u/rajends1)\ **Replies:** 1\ **Last updated:** [January 14, 2021, 11:50pm UTC](https://discuss.elastic.co/t/which-is-the-best-option-for-upload-photo-images-and-search/261194 "2021-01-14T23:50:26Z")
which is the best option for upload person profile photo images and search ? Three options of Implementation are put image base64 (fig green circle) string data in dynamodb table as new field of type Map list for … --- ## [iS their a better way than this fuzzy search for multi-match?](https://discuss.elastic.co/t/is-their-a-better-way-than-this-fuzzy-search-for-multi-match/261193)
**Author:** [@rajends1](https://discuss.elastic.co/u/rajends1)\ **Replies:** 0\ **Last updated:** [January 14, 2021, 11:41pm UTC](https://discuss.elastic.co/t/is-their-a-better-way-than-this-fuzzy-search-for-multi-match/261193 "2021-01-14T23:41:47Z")
{ "query": { "multi\_match": { "fields": \[ "text", "title" \], "query": "king”, "fuzziness": "AUTO", "type": "best\_fields" } } }’ The fuzziness parameter can be specified as: • 0… --- ## [Best option for Wildcard Search with multimatch](https://discuss.elastic.co/t/best-option-for-wildcard-search-with-multimatch/261192)
**Author:** [@rajends1](https://discuss.elastic.co/u/rajends1)\ **Replies:** 0\ **Last updated:** [January 14, 2021, 11:34pm UTC](https://discuss.elastic.co/t/best-option-for-wildcard-search-with-multimatch/261192 "2021-01-14T23:34:22Z")
which is the Best option for Wildcard Search with multimatch and why ? Wildcard with multi-match { "query": { "multi\_match": { "query": "\*king\*", "fields": \[ "text", "title" \] } } } Alternatively to multi\_ma… --- ## [Does a bulk indexing request compact / unique?](https://discuss.elastic.co/t/does-a-bulk-indexing-request-compact-unique/261174)
**Author:** [@rex-remind](https://discuss.elastic.co/u/rex-remind)\ **Replies:** 5\ **Last updated:** [January 14, 2021, 8:45pm UTC](https://discuss.elastic.co/t/does-a-bulk-indexing-request-compact-unique/261174 "2021-01-14T20:45:11Z")
I'm curious if a bulk indexing API request compacts / uniques when ingested by Elasticsearch, i.e. will a create, then delete, then create, then update of a single document id collapse into just 1 create? If not, why no… --- ## [Upgrade Help: The filter context has been removed in 7.X will old query work?](https://discuss.elastic.co/t/upgrade-help-the-filter-context-has-been-removed-in-7-x-will-old-query-work/261179)
**Author:** [@JonathanAaron](https://discuss.elastic.co/u/JonathanAaron)\ **Replies:** 0\ **Last updated:** [January 14, 2021, 8:28pm UTC](https://discuss.elastic.co/t/upgrade-help-the-filter-context-has-been-removed-in-7-x-will-old-query-work/261179 "2021-01-14T20:28:04Z")
Will my query from 6.X still work? I'm hoping I don't have to change the query since it's being ran on legacy apps. { "constant\_score": { "filter": { "bool": { "adjust\_pure\_ne… --- ## [Can't merge a non object mapping \[error.exception.stacktrace.vars.args\] with an object mapping \[error.exception.stacktrace.vars.args\]](https://discuss.elastic.co/t/cant-merge-a-non-object-mapping-error-exception-stacktrace-vars-args-with-an-object-mapping-error-exception-stacktrace-vars-args/260736)
**Author:** [@amrohit](https://discuss.elastic.co/u/amrohit)\ **Replies:** 0\ **Last updated:** [January 11, 2021, 3:13pm UTC](https://discuss.elastic.co/t/cant-merge-a-non-object-mapping-error-exception-stacktrace-vars-args-with-an-object-mapping-error-exception-stacktrace-vars-args/260736 "2021-01-11T15:13:14Z")
agent = python-apm technology = django index-mapping = dynamic in error doc the error.exception.stacktrace.vars.args have the value: \[ "GET", "/hdshvjkdfhkghfdkjhgdfkhgjdks-2020.12.28/\_search", {}, "{\\"query\\":{\\"b… --- ## [Can't find curator rpm / yum](https://discuss.elastic.co/t/cant-find-curator-rpm-yum/260702)
**Author:** [@CedricB](https://discuss.elastic.co/u/CedricB)\ **Replies:** 1\ **Last updated:** [January 14, 2021, 8:19pm UTC](https://discuss.elastic.co/t/cant-find-curator-rpm-yum/260702 "2021-01-14T20:19:18Z")
Hello there, I'm new here, hope this question was not already answered or documented anywhere. I'm trying to install ElasticSearch-curator on a Centos7 server. Reading this documentation : https://www.elastic.co/guide… --- ## [Reindex string to date field exception](https://discuss.elastic.co/t/reindex-string-to-date-field-exception/260863)
**Author:** [@thanhlam](https://discuss.elastic.co/u/thanhlam)\ **Replies:** 1\ **Last updated:** [January 14, 2021, 7:15pm UTC](https://discuss.elastic.co/t/reindex-string-to-date-field-exception/260863 "2021-01-14T19:15:36Z")
Hello, I've done much searching on the topics of converting a field that's defined or mapped as "text string" to type date but can't find a specific example like what I'm trying. Any help would be appreciated. This ind… --- ## [Use analyzer in Completion Suggester](https://discuss.elastic.co/t/use-analyzer-in-completion-suggester/261161)
**Author:** [@RabBit\_BR](https://discuss.elastic.co/u/RabBit_BR)\ **Replies:** 0\ **Last updated:** [January 14, 2021, 6:00pm UTC](https://discuss.elastic.co/t/use-analyzer-in-completion-suggester/261161 "2021-01-14T18:00:29Z")
I have a question when using the analyzer in Completion Suggestion. I understand that CS performs the prefix search. Shouldn't the analyzer allow you to search for another term in the text other than the first? { "se… --- ## [Elastic stack hardware requirements, (look for recommendation)](https://discuss.elastic.co/t/elastic-stack-hardware-requirements-look-for-recommendation/261148)
**Author:** [@RODRIGO\_P](https://discuss.elastic.co/u/RODRIGO_P)\ **Replies:** 1\ **Last updated:** [January 14, 2021, 4:24pm UTC](https://discuss.elastic.co/t/elastic-stack-hardware-requirements-look-for-recommendation/261148 "2021-01-14T16:24:32Z")
Hi, I want setting up a cluster and I have these scenarios: 28 servers generate log per daily; EPS logs are 300 /s per server; EPD logs are ~5MM/day; RAW DATA BYTES is ~ 460BYTES; Size GB Day ~ 1.2TB; My required ret… --- ## [Unconfined services with Elasticsearch](https://discuss.elastic.co/t/unconfined-services-with-elasticsearch/260151)
**Author:** [@redplastic](https://discuss.elastic.co/u/redplastic)\ **Replies:** 5\ **Last updated:** [January 14, 2021, 4:01pm UTC](https://discuss.elastic.co/t/unconfined-services-with-elasticsearch/260151 "2021-01-14T16:01:17Z")
I'm attempting to use Elasticsearch on Centos but have some concerns over the unconfined java and controller services that Elasticsearch uses. With the system's initial blocking of unconfined services due to security con… --- ## [Shards rebalance when adding nodes and using one primary and one replica](https://discuss.elastic.co/t/shards-rebalance-when-adding-nodes-and-using-one-primary-and-one-replica/260954)
**Author:** [@Travis](https://discuss.elastic.co/u/Travis)\ **Replies:** 6\ **Last updated:** [January 14, 2021, 3:35pm UTC](https://discuss.elastic.co/t/shards-rebalance-when-adding-nodes-and-using-one-primary-and-one-replica/260954 "2021-01-14T15:35:50Z")
Hello ! I plan to use one primary and one replica by day. If I add more nodes, does the shards will be automatically rebalanced equally on all the nodes even if I have only one primary and one replica ? I'm asking th… --- ## [Can't add a new node to an es cluster with x-pack:enabled](https://discuss.elastic.co/t/cant-add-a-new-node-to-an-es-cluster-with-x-pack-enabled/260862)
**Author:** [@KaZuKi\_Yashiro](https://discuss.elastic.co/u/KaZuKi_Yashiro)\ **Replies:** 4\ **Last updated:** [January 14, 2021, 3:04pm UTC](https://discuss.elastic.co/t/cant-add-a-new-node-to-an-es-cluster-with-x-pack-enabled/260862 "2021-01-14T15:04:43Z")
I need to transfer the elasticsearch cluster from two servers to another two servers, without downtime or restart. How can this be done? I've tried to add a new node to an existing cluster with x-pack, but it doesn't w… --- ## [ELK 7.8.0 two node cluster "At least one primary shard for the index \[.security-7\] is unavailable"](https://discuss.elastic.co/t/elk-7-8-0-two-node-cluster-at-least-one-primary-shard-for-the-index-security-7-is-unavailable/261031)
**Author:** [@Vishnu\_Oyitty](https://discuss.elastic.co/u/Vishnu_Oyitty)\ **Replies:** 3\ **Last updated:** [January 14, 2021, 2:23pm UTC](https://discuss.elastic.co/t/elk-7-8-0-two-node-cluster-at-least-one-primary-shard-for-the-index-security-7-is-unavailable/261031 "2021-01-14T14:23:07Z")
Hello, We are on a two node ELK cluster and noticing the below error suddennly. As the error says .security index seems to be corrupted. Is there anyway to restore the old state? Due to this kibana is not loading, none… --- ## [Query\_string not working as expected for multiple fields with AND as default\_operator](https://discuss.elastic.co/t/query-string-not-working-as-expected-for-multiple-fields-with-and-as-default-operator/261128)
**Author:** [@san87singh](https://discuss.elastic.co/u/san87singh)\ **Replies:** 0\ **Last updated:** [January 14, 2021, 1:51pm UTC](https://discuss.elastic.co/t/query-string-not-working-as-expected-for-multiple-fields-with-and-as-default-operator/261128 "2021-01-14T13:51:13Z")
We are not able to get match for a query on multiple fields using query\_string. We are not sure why it is not working even if it's a simple query. Below is the query, document and mapping (index) that we are using: Quer… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=723) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=725)