# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=726 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 727 --- ## [Error Machine Learning Job in Elastic Cloud Enterprise "autodetect"](https://discuss.elastic.co/t/error-machine-learning-job-in-elastic-cloud-enterprise-autodetect/260165)
**Author:** [@pedro.andrade](https://discuss.elastic.co/u/pedro.andrade)\ **Replies:** 12\ **Last updated:** [January 13, 2021, 3:54pm UTC](https://discuss.elastic.co/t/error-machine-learning-job-in-elastic-cloud-enterprise-autodetect/260165 "2021-01-13T15:54:51Z")
I get an error creating the most basic machine learning job. In kibana it says "datafeed-teste\_2 failed to start. Unexpected job state \[failed\] while waiting for job to be opened." Im using Elastic Cloud Enterprise (2.… --- ## [Format stack trace in console for elastic search](https://discuss.elastic.co/t/format-stack-trace-in-console-for-elastic-search/260711)
**Author:** [@navin1093](https://discuss.elastic.co/u/navin1093)\ **Replies:** 4\ **Last updated:** [January 13, 2021, 3:13pm UTC](https://discuss.elastic.co/t/format-stack-trace-in-console-for-elastic-search/260711 "2021-01-13T15:13:19Z")
Hi expers. Below is sample stack trace in log 2021-01011 04:23:23,455 ERROR \[beat-logstash-some-name-832-2015.11.28\] IndexNotFoundException\[no such index\] at org.elasticsearch.cluster.metadata.IndexNameExpressionRe… --- ## [Duplicate results when paging](https://discuss.elastic.co/t/duplicate-results-when-paging/260895)
**Author:** [@noah-elastic](https://discuss.elastic.co/u/noah-elastic)\ **Replies:** 2\ **Last updated:** [January 13, 2021, 2:46pm UTC](https://discuss.elastic.co/t/duplicate-results-when-paging/260895 "2021-01-13T14:46:54Z")
Hello Folks -- I'm researching an interesting situation that one of our users pointed out. We have a somewhat simple query that searches on a couple fields. We are using size/from to allow the users to step through the … --- ## [Calculating event.duration not working](https://discuss.elastic.co/t/calculating-event-duration-not-working/260918)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 1\ **Last updated:** [January 13, 2021, 12:12pm UTC](https://discuss.elastic.co/t/calculating-event-duration-not-working/260918 "2021-01-13T12:12:57Z")
Hello, Based on https://www.elastic.co/blog/calculating-ingest-lag-and-storing-ingest-time-in-elasticsearch-to-improve-observability I added a script processor to my pipeline with the goal to calculate the event.durati… --- ## [Merge two elasticsearch clusters](https://discuss.elastic.co/t/merge-two-elasticsearch-clusters/260678)
**Author:** [@rohitarorait82](https://discuss.elastic.co/u/rohitarorait82)\ **Replies:** 5\ **Last updated:** [January 13, 2021, 11:31am UTC](https://discuss.elastic.co/t/merge-two-elasticsearch-clusters/260678 "2021-01-13T11:31:11Z")
Hi All, Currently we have two clusters, in one we have 4 nodes(1 coordinating, 3 data nodes out of which two are master) and second cluster(1 coordinating, 5 data nodes out of which three are master). Can someone sugges… --- ## [No more logs in ELK](https://discuss.elastic.co/t/no-more-logs-in-elk/260314)
**Author:** [@baddack](https://discuss.elastic.co/u/baddack)\ **Replies:** 3\ **Last updated:** [January 13, 2021, 11:07am UTC](https://discuss.elastic.co/t/no-more-logs-in-elk/260314 "2021-01-13T11:07:05Z")
Hello everyone, I'm new here and I've been using the ELK stack recently. I am in apprenticeship in my company and I am asked to take over the SIEM because nobody knows how to use it. (It was implemented by a previous ap… --- ## [How to make Point In Time API request using JAVA REST High Level Client](https://discuss.elastic.co/t/how-to-make-point-in-time-api-request-using-java-rest-high-level-client/260965)
**Author:** [@Shalika](https://discuss.elastic.co/u/Shalika)\ **Replies:** 1\ **Last updated:** [January 13, 2021, 10:54am UTC](https://discuss.elastic.co/t/how-to-make-point-in-time-api-request-using-java-rest-high-level-client/260965 "2021-01-13T10:54:37Z")
It will be helpful if someone can point me to a way to execute Point In Time API request, which is newly introduced in Elasticsearch 7.10.1, from JAVA using REST high-level client or any other way in JAVA. (except Transp… --- ## [Elasticsearch BulkRequestHandler listener callback execution](https://discuss.elastic.co/t/elasticsearch-bulkrequesthandler-listener-callback-execution/260978)
**Author:** [@Faiz\_Ahmed\_Mushtak\_H](https://discuss.elastic.co/u/Faiz_Ahmed_Mushtak_H)\ **Replies:** 0\ **Last updated:** [January 13, 2021, 10:48am UTC](https://discuss.elastic.co/t/elasticsearch-bulkrequesthandler-listener-callback-execution/260978 "2021-01-13T10:48:55Z")
In line https://github.com/elastic/elasticsearch/blob/master/server/src/main/java/org/elasticsearch/action/bulk/BulkRequestHandler.java#L58 Curious why the semaphore is acquired after the beforeBulk callback? While not … --- ## [Indices.breaker.total.use\_real\_memory or search.check\_buckets\_step\_size  didn't work](https://discuss.elastic.co/t/indices-breaker-total-use-real-memory-or-search-check-buckets-step-size-didnt-work/260945)
**Author:** [@liwanjie](https://discuss.elastic.co/u/liwanjie)\ **Replies:** 0\ **Last updated:** [January 13, 2021, 7:38am UTC](https://discuss.elastic.co/t/indices-breaker-total-use-real-memory-or-search-check-buckets-step-size-didnt-work/260945 "2021-01-13T07:38:19Z")
I always thought that with this new parameter, requests for too many buckets should be rejected。But I tested it today, making two requests and creating hundreds of thousands of buckets per request。In the end, the machine… --- ## [All shards failed - 400 happens on certain indexes](https://discuss.elastic.co/t/all-shards-failed-400-happens-on-certain-indexes/260960)
**Author:** [@Yoav\_Alroy](https://discuss.elastic.co/u/Yoav_Alroy)\ **Replies:** 0\ **Last updated:** [January 13, 2021, 9:26am UTC](https://discuss.elastic.co/t/all-shards-failed-400-happens-on-certain-indexes/260960 "2021-01-13T09:26:06Z")
Hi, A bit of a background - We are using ElasticSearch with index per client for search engine. Now we let the user have several types of search terms that one of them is "search by id" where we focus the search to cer… --- ## [Is it possible to fetch count of total number of docs that qualify an aggregation condition in elasticsearch?](https://discuss.elastic.co/t/is-it-possible-to-fetch-count-of-total-number-of-docs-that-qualify-an-aggregation-condition-in-elasticsearch/260958)
**Author:** [@yash.tandon](https://discuss.elastic.co/u/yash.tandon)\ **Replies:** 0\ **Last updated:** [January 13, 2021, 9:11am UTC](https://discuss.elastic.co/t/is-it-possible-to-fetch-count-of-total-number-of-docs-that-qualify-an-aggregation-condition-in-elasticsearch/260958 "2021-01-13T09:11:17Z")
--- ## [Discovery configuration changes in 7.x](https://discuss.elastic.co/t/discovery-configuration-changes-in-7-x/260522)
**Author:** [@srikanth\_k](https://discuss.elastic.co/u/srikanth_k)\ **Replies:** 6\ **Last updated:** [January 13, 2021, 9:33am UTC](https://discuss.elastic.co/t/discovery-configuration-changes-in-7-x/260522 "2021-01-13T09:33:18Z")
Before an upgrade to 7.x, why is it required to set the below value discovery.zen.ping.unicast.hosts ? " After the cluster forms successfully for the first time, remove the cluster.initial\_master\_nodes setting from eac… --- ## [What value adds Data Streams vs Index Alias for time series data](https://discuss.elastic.co/t/what-value-adds-data-streams-vs-index-alias-for-time-series-data/260948)
**Author:** [@ismarslomic](https://discuss.elastic.co/u/ismarslomic)\ **Replies:** 0\ **Last updated:** [January 13, 2021, 7:51am UTC](https://discuss.elastic.co/t/what-value-adds-data-streams-vs-index-alias-for-time-series-data/260948 "2021-01-13T07:51:50Z")
I'm struggling to understand what benefits Data Streams brings to the table, compared with Index Alias for time series data? Are there any performance (i.e indexing and querying) benefits? --- ## [What happens when decommission a node?](https://discuss.elastic.co/t/what-happens-when-decommission-a-node/260938)
**Author:** [@linkerc](https://discuss.elastic.co/u/linkerc)\ **Replies:** 0\ **Last updated:** [January 13, 2021, 6:25am UTC](https://discuss.elastic.co/t/what-happens-when-decommission-a-node/260938 "2021-01-13T06:25:35Z")
I just decommissioned a node from my cluster. I noticed there are many threads (15-20) doing the shard relocation, which is great. After about 30 minutes, the rebalancing threads dropped down to 3, which is my cluster … --- ## [Scripted field](https://discuss.elastic.co/t/scripted-field/260675)
**Author:** [@Jerry\_Yap](https://discuss.elastic.co/u/Jerry_Yap)\ **Replies:** 5\ **Last updated:** [January 13, 2021, 6:06am UTC](https://discuss.elastic.co/t/scripted-field/260675 "2021-01-13T06:06:43Z")
Hi all, My index fields consists of index\_name (containing P01, P02) X (numbers) How can i scripted the field to display the subtracted result of P01 of X - P02 of X? Thanks in advance. --- ## [No answers for bulk requests](https://discuss.elastic.co/t/no-answers-for-bulk-requests/260933)
**Author:** [@ThreatInter](https://discuss.elastic.co/u/ThreatInter)\ **Replies:** 0\ **Last updated:** [January 13, 2021, 5:18am UTC](https://discuss.elastic.co/t/no-answers-for-bulk-requests/260933 "2021-01-13T05:18:46Z")
Hi, as I wrote in name of topic I have troubles with bulk requests (also with Follower Checker and Leader Checker messages). Usual bulk trace looks like: \[2021-01-13T08:30:44,163\]\[TRACE\]\[o.e.h.HttpTracer \] \[h1-… --- ## [Aggregation time complexity](https://discuss.elastic.co/t/aggregation-time-complexity/260925)
**Author:** [@isbee](https://discuss.elastic.co/u/isbee)\ **Replies:** 0\ **Last updated:** [January 13, 2021, 3:02am UTC](https://discuss.elastic.co/t/aggregation-time-complexity/260925 "2021-01-13T03:02:32Z")
I want to aggregate N(= 10 million) data by percentile\_rank. And I want to call this query lively (more than 100 times per second). As far as I know, Elasticsearch uses t-digest algorithm on percentile. So total time co… --- ## [Insert multi fields data](https://discuss.elastic.co/t/insert-multi-fields-data/260606)
**Author:** [@mojtaba\_safavi](https://discuss.elastic.co/u/mojtaba_safavi)\ **Replies:** 5\ **Last updated:** [January 13, 2021, 1:04am UTC](https://discuss.elastic.co/t/insert-multi-fields-data/260606 "2021-01-13T01:04:48Z")
hi, I am looking for a solution that inserts translated data into multi fields for multi-language --- ## [How can I change the default size of the returned aggregations (10)?](https://discuss.elastic.co/t/how-can-i-change-the-default-size-of-the-returned-aggregations-10/260909)
**Author:** [@Catalin](https://discuss.elastic.co/u/Catalin)\ **Replies:** 2\ **Last updated:** [January 12, 2021, 11:52pm UTC](https://discuss.elastic.co/t/how-can-i-change-the-default-size-of-the-returned-aggregations-10/260909 "2021-01-12T23:52:36Z")
Is there an index setting in order to change default size of aggregations returned, which seems to be set at 10 ? --- ## [org.elasticsearch.action.search.SearchPhaseExecutionException - collector failed to collect data](https://discuss.elastic.co/t/org-elasticsearch-action-search-searchphaseexecutionexception-collector-failed-to-collect-data/260766)
**Author:** [@marcosvrrs](https://discuss.elastic.co/u/marcosvrrs)\ **Replies:** 3\ **Last updated:** [January 12, 2021, 11:32pm UTC](https://discuss.elastic.co/t/org-elasticsearch-action-search-searchphaseexecutionexception-collector-failed-to-collect-data/260766 "2021-01-12T23:32:11Z")
Hi all, We have a deployment in Elastic Cloud, and since yesterday my JVM is with a very high usage (about 85-90% of heap memory) and giving a few errors. Any help would be appreciated. I got this log through the consol… --- ## [("Enabled": false) does it work in index templates or only in mapping directly?](https://discuss.elastic.co/t/enabled-false-does-it-work-in-index-templates-or-only-in-mapping-directly/260898)
**Author:** [@marcosvitali](https://discuss.elastic.co/u/marcosvitali)\ **Replies:** 1\ **Last updated:** [January 12, 2021, 11:29pm UTC](https://discuss.elastic.co/t/enabled-false-does-it-work-in-index-templates-or-only-in-mapping-directly/260898 "2021-01-12T23:29:00Z")
Hi, Im using filebeat with templates and 1 index per day pattern. Id like to disable object in a field but it doenst work in templates (works only in mapping directly) "Enabled": false does it work in index templates … --- ## [Feedback on tuning Data Streams for my use case](https://discuss.elastic.co/t/feedback-on-tuning-data-streams-for-my-use-case/260848)
**Author:** [@ismarslomic](https://discuss.elastic.co/u/ismarslomic)\ **Replies:** 0\ **Last updated:** [January 12, 2021, 3:21pm UTC](https://discuss.elastic.co/t/feedback-on-tuning-data-streams-for-my-use-case/260848 "2021-01-12T15:21:37Z")
I'm working on a use where we need to copy messages from 2 Kafka topics to Elasticsearch, in order to search and visualize data in Web App. I have setup Elastic Cloud on Kubernetes with Elasticsearch and Kibana, and per… --- ## [Delete document from elasticsearch](https://discuss.elastic.co/t/delete-document-from-elasticsearch/260910)
**Author:** [@mac1](https://discuss.elastic.co/u/mac1)\ **Replies:** 3\ **Last updated:** [January 12, 2021, 10:01pm UTC](https://discuss.elastic.co/t/delete-document-from-elasticsearch/260910 "2021-01-12T22:01:26Z")
hi, delete\_by\_query is safe to delete huge volume of data (in gbs) in one go. Will it create any performance issues in ES. Will it free the space automatically ? --- ## [Problem on kibana](https://discuss.elastic.co/t/problem-on-kibana/260905)
**Author:** [@Falikou1](https://discuss.elastic.co/u/Falikou1)\ **Replies:** 12\ **Last updated:** [January 12, 2021, 9:46pm UTC](https://discuss.elastic.co/t/problem-on-kibana/260905 "2021-01-12T21:46:59Z")
Kibana is having trouble loading. I have the following capture: Do I have to delete any indexes? Are there other solutions? --- ## [Update Documents with new Field](https://discuss.elastic.co/t/update-documents-with-new-field/260906)
**Author:** [@stevezemlicka](https://discuss.elastic.co/u/stevezemlicka)\ **Replies:** 2\ **Last updated:** [January 12, 2021, 9:40pm UTC](https://discuss.elastic.co/t/update-documents-with-new-field/260906 "2021-01-12T21:40:22Z")
I have a set of data wherein generic identifiers exist. This is partially due to another index which also uses these generic identifiers and our use of Timelion to display dashboards with a combination of data from both… --- ## [Network I/O](https://discuss.elastic.co/t/network-i-o/260902)
**Author:** [@Srikanth\_Kesireddy](https://discuss.elastic.co/u/Srikanth_Kesireddy)\ **Replies:** 1\ **Last updated:** [January 12, 2021, 9:01pm UTC](https://discuss.elastic.co/t/network-i-o/260902 "2021-01-12T21:01:10Z")
How to Monitor Network I/O in my VM and Which beat is suitable for that? --- ## [I want to split the existing index to daily index](https://discuss.elastic.co/t/i-want-to-split-the-existing-index-to-daily-index/260501)
**Author:** [@Rohit\_Kumbhar](https://discuss.elastic.co/u/Rohit_Kumbhar)\ **Replies:** 6\ **Last updated:** [January 12, 2021, 8:08pm UTC](https://discuss.elastic.co/t/i-want-to-split-the-existing-index-to-daily-index/260501 "2021-01-12T20:08:55Z")
Hello, I want to split the existing index of size 200gb into daily index, That index has data of 1 month. I have setup of 8 core cpu and 16gb ram. what query should I write on dev tools or is there any other way to ex… --- ## [XDELETE is not working - Doesn't delete data from all the Data nodes for ES](https://discuss.elastic.co/t/xdelete-is-not-working-doesnt-delete-data-from-all-the-data-nodes-for-es/260876)
**Author:** [@ajayvembu](https://discuss.elastic.co/u/ajayvembu)\ **Replies:** 2\ **Last updated:** [January 12, 2021, 6:34pm UTC](https://discuss.elastic.co/t/xdelete-is-not-working-doesnt-delete-data-from-all-the-data-nodes-for-es/260876 "2021-01-12T18:34:22Z")
Currently we are using Elastic Search 2.3.1 and trying to issue XDELETE command on the indices. I understand it's pretty old version & has attained EOL but I assume the underlying working mechanism of XDELETE wouldn't ch… --- ## [Google Cloud discovery not working](https://discuss.elastic.co/t/google-cloud-discovery-not-working/260871)
**Author:** [@Mark\_Pevec](https://discuss.elastic.co/u/Mark_Pevec)\ **Replies:** 8\ **Last updated:** [January 12, 2021, 6:06pm UTC](https://discuss.elastic.co/t/google-cloud-discovery-not-working/260871 "2021-01-12T18:06:03Z")
Has anyone ever successfully used the Google Cloud discovery plugin successfully? After testing and debugging for a week I can't get it working. I am using the latest 7.x release (installed on debian-10 following all th… --- ## [How to Query for length with elasticsearch (KQL)](https://discuss.elastic.co/t/how-to-query-for-length-with-elasticsearch-kql/259815)
**Author:** [@Elasticnewbie1](https://discuss.elastic.co/u/Elasticnewbie1)\ **Replies:** 15\ **Last updated:** [January 12, 2021, 4:53pm UTC](https://discuss.elastic.co/t/how-to-query-for-length-with-elasticsearch-kql/259815 "2021-01-12T16:53:44Z")
Hey there, im new to this elk world and im currently working on a threat hunting project with ELK/Zeek. My problem is, that i want for example to query for DNS.Length \> 75 within zeek data. I know that its easy to do i… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=725) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=727)