# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=730 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 731 --- ## [Data node and master node spec](https://discuss.elastic.co/t/data-node-and-master-node-spec/260318)
**Author:** [@mohammad\_hanifah\_nur](https://discuss.elastic.co/u/mohammad_hanifah_nur)\ **Replies:** 1\ **Last updated:** [January 6, 2021, 8:39pm UTC](https://discuss.elastic.co/t/data-node-and-master-node-spec/260318 "2021-01-06T20:39:32Z")
i have 2 node server with different spec . is it possible to make them as data node and master node ? can i make data node is higher spec than master node ? --- ## [Reindexing in elasticsearch](https://discuss.elastic.co/t/reindexing-in-elasticsearch/260323)
**Author:** [@tahseen\_fatima](https://discuss.elastic.co/u/tahseen_fatima)\ **Replies:** 1\ **Last updated:** [January 6, 2021, 8:36pm UTC](https://discuss.elastic.co/t/reindexing-in-elasticsearch/260323 "2021-01-06T20:36:37Z")
Hi, I have a setup of ELK7.10v. I want to reindex my data with multiple indices on monthly basis. example: My existing index should create new\_index with monthly basis. I have index1 which contains 1 year of records,… --- ## [How HighLevelRestClient use complex-DSL?](https://discuss.elastic.co/t/how-highlevelrestclient-use-complex-dsl/260366)
**Author:** [@DaiDaDao](https://discuss.elastic.co/u/DaiDaDao)\ **Replies:** 0\ **Last updated:** [January 6, 2021, 4:08pm UTC](https://discuss.elastic.co/t/how-highlevelrestclient-use-complex-dsl/260366 "2021-01-06T16:08:02Z")
When I am trying to use DSL in HighLevelRestClient, I found there is no way to build a SearhSourceBuilder. Then I tried DyWrapperQueryBuilder wqb = new DyWrapperQueryBuilder(dsl); I found that only simple DSL like {"… --- ## [Solarwinds alternative](https://discuss.elastic.co/t/solarwinds-alternative/260280)
**Author:** [@praveen\_raju](https://discuss.elastic.co/u/praveen_raju)\ **Replies:** 3\ **Last updated:** [January 6, 2021, 8:25pm UTC](https://discuss.elastic.co/t/solarwinds-alternative/260280 "2021-01-06T20:25:25Z")
Hi, We are looking to replace our current Solar Winds monitoring system using ELK stack. In this regard i' am looking out for any reference articles on architecture All out network infrastructure , Virtual machines are… --- ## [Snapshot to minio S3 error](https://discuss.elastic.co/t/snapshot-to-minio-s3-error/260365)
**Author:** [@gregorys](https://discuss.elastic.co/u/gregorys)\ **Replies:** 4\ **Last updated:** [January 6, 2021, 8:04pm UTC](https://discuss.elastic.co/t/snapshot-to-minio-s3-error/260365 "2021-01-06T20:04:37Z")
Hi, Elasticsearch 7.10. I'm trying to add an S3 snapshot repository, the endpoint is Minio. The repository-s3 plugin is installed on all nodes, and restarted. I've set the keys in the keystore: elasticsearch-keystor… --- ## ["Legacy Collection" for Stack Monitoring](https://discuss.elastic.co/t/legacy-collection-for-stack-monitoring/259935)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 9\ **Last updated:** [January 6, 2021, 5:40pm UTC](https://discuss.elastic.co/t/legacy-collection-for-stack-monitoring/259935 "2021-01-06T17:40:10Z")
It appears you are using "Legacy Collection" for Stack Monitoring. This method of monitoring will no longer be supported in the next major release I am using metricbeat and filebeat for monitoring our cluster Why it is … --- ## [Converting a string field of already ingested documents to an integer field](https://discuss.elastic.co/t/converting-a-string-field-of-already-ingested-documents-to-an-integer-field/260368)
**Author:** [@jsalamanca](https://discuss.elastic.co/u/jsalamanca)\ **Replies:** 0\ **Last updated:** [January 6, 2021, 4:27pm UTC](https://discuss.elastic.co/t/converting-a-string-field-of-already-ingested-documents-to-an-integer-field/260368 "2021-01-06T16:27:11Z")
Hi, I'm trying to convert the type of a field of already ingested documents to another type. The pipeline incorrectly ingested documents with integers as strings, like "1" or "2" (or any other integer as string). I alr… --- ## [Logs not visible in kibana - Could not index event to Elasticsearch. 400](https://discuss.elastic.co/t/logs-not-visible-in-kibana-could-not-index-event-to-elasticsearch-400/260306)
**Author:** [@jsec](https://discuss.elastic.co/u/jsec)\ **Replies:** 5\ **Last updated:** [January 6, 2021, 4:15pm UTC](https://discuss.elastic.co/t/logs-not-visible-in-kibana-could-not-index-event-to-elasticsearch-400/260306 "2021-01-06T16:15:36Z")
Dears, I've just saw that logs aren't comming anymore from beats to kibana since 1 month. In the syslog, I saw the following warning: Could not index event to Elasticsearch. 400 Validation Failed: 1: this action would… --- ## [Shard routing and consistency in Elasticsearch](https://discuss.elastic.co/t/shard-routing-and-consistency-in-elasticsearch/260361)
**Author:** [@peterol](https://discuss.elastic.co/u/peterol)\ **Replies:** 2\ **Last updated:** [January 6, 2021, 4:08pm UTC](https://discuss.elastic.co/t/shard-routing-and-consistency-in-elasticsearch/260361 "2021-01-06T16:08:13Z")
Hello everyone, I have two questions regarding comprehension of shard routing and consistency in Elasticsearch. I read this documentation Reading and Writing documents and made the conclusion that Elasticsearch is even… --- ## [New Index is not getting Updated in Alias](https://discuss.elastic.co/t/new-index-is-not-getting-updated-in-alias/260313)
**Author:** [@Rohit\_Kumbhar](https://discuss.elastic.co/u/Rohit_Kumbhar)\ **Replies:** 2\ **Last updated:** [January 6, 2021, 4:03pm UTC](https://discuss.elastic.co/t/new-index-is-not-getting-updated-in-alias/260313 "2021-01-06T16:03:41Z")
Hi Experts, I created Index Pattern as xyz-\* and created alias for this index pattern as abc using following command POST /\_aliases { "actions" : \[ { "add" : { "index" : "xyz-\*", "alias" : "abc" } } \] } If new… --- ## [Formulate query for comparing timestamps](https://discuss.elastic.co/t/formulate-query-for-comparing-timestamps/260334)
**Author:** [@Farid\_N](https://discuss.elastic.co/u/Farid_N)\ **Replies:** 0\ **Last updated:** [January 6, 2021, 11:56am UTC](https://discuss.elastic.co/t/formulate-query-for-comparing-timestamps/260334 "2021-01-06T11:56:10Z")
Hi I want to write a query to compare two timestamp in bellow Image: I want a query, to check this two Timestamp... (Only hour and minute) and return the log if there are not equal.... Can you help me how can I wr… --- ## [ML Datafeed lookback retrieved no data](https://discuss.elastic.co/t/ml-datafeed-lookback-retrieved-no-data/260104)
**Author:** [@TheHunter1](https://discuss.elastic.co/u/TheHunter1)\ **Replies:** 11\ **Last updated:** [January 6, 2021, 2:50pm UTC](https://discuss.elastic.co/t/ml-datafeed-lookback-retrieved-no-data/260104 "2021-01-06T14:50:41Z")
I am trying to run the integrated jobs for winlogbeat data, and most of them are having an error Datafeed lookback retrieved no data. I already had the same problem using Elasticsearch version 8.0.0 from code source, So… --- ## [Shards not relocating to warm nodes](https://discuss.elastic.co/t/shards-not-relocating-to-warm-nodes/260198)
**Author:** [@Smrithin\_N\_S](https://discuss.elastic.co/u/Smrithin_N_S)\ **Replies:** 2\ **Last updated:** [January 6, 2021, 2:34pm UTC](https://discuss.elastic.co/t/shards-not-relocating-to-warm-nodes/260198 "2021-01-06T14:34:27Z")
I have a deployment with hot-warm architecture enabled. Below is the ILM policy being used. PUT \_ilm/policy/apm-rollover-30-days { "policy": { "phases": { "hot": { "min\_age":… --- ## [Getting exceptions : search.SearchPhaseExecutionException: all shards failed and ClusterBlockException: blocked by: \[SERVICE\_UNAVAILABLE/2/no master](https://discuss.elastic.co/t/getting-exceptions-search-searchphaseexecutionexception-all-shards-failed-and-clusterblockexception-blocked-by-service-unavailable-2-no-master/260347)
**Author:** [@umen](https://discuss.elastic.co/u/umen)\ **Replies:** 0\ **Last updated:** [January 6, 2021, 1:41pm UTC](https://discuss.elastic.co/t/getting-exceptions-search-searchphaseexecutionexception-all-shards-failed-and-clusterblockexception-blocked-by-service-unavailable-2-no-master/260347 "2021-01-06T13:41:28Z")
i followed the quickstart tutorial both elasticsearch and filebeat installation on Kubernetes the app working for few minutes but then the kibana doesn't respond and when i look at the elasticsearch logs i can see those… --- ## [Getting Hash value in sort response, ES json response is invalid](https://discuss.elastic.co/t/getting-hash-value-in-sort-response-es-json-response-is-invalid/260346)
**Author:** [@Sravanti](https://discuss.elastic.co/u/Sravanti)\ **Replies:** 0\ **Last updated:** [January 6, 2021, 1:20pm UTC](https://discuss.elastic.co/t/getting-hash-value-in-sort-response-es-json-response-is-invalid/260346 "2021-01-06T13:20:08Z")
I'm using icu\_collation for phonebook sort, but getting a hash value in sort response in below search query GET testindex1/\_search { "sort": \[ { "id.sort\_en": { "order": "ASC", "unmapped\_type… --- ## [“\[geo\_distance\] malformed query, expected \[END\_OBJECT\] but found \[FIELD\_NAME\]”](https://discuss.elastic.co/t/geo-distance-malformed-query-expected-end-object-but-found-field-name/260341)
**Author:** [@learn\_and\_try](https://discuss.elastic.co/u/learn_and_try)\ **Replies:** 1\ **Last updated:** [January 6, 2021, 1:28pm UTC](https://discuss.elastic.co/t/geo-distance-malformed-query-expected-end-object-but-found-field-name/260341 "2021-01-06T13:28:05Z")
I am tried to create search queary with a values in 15m radios and between 3 weeks. I tried to execute this query: \> "query": { \> "bool": { \> "must": { \> "match\_all": {} \> } \> , "filter": \[ \> { \> "geo… --- ## [Boolean parameters in token filters are stringified, breaking elasticsearch\_dsl analysis comparison](https://discuss.elastic.co/t/boolean-parameters-in-token-filters-are-stringified-breaking-elasticsearch-dsl-analysis-comparison/260342)
**Author:** [@LeoMcA](https://discuss.elastic.co/u/LeoMcA)\ **Replies:** 0\ **Last updated:** [January 6, 2021, 12:59pm UTC](https://discuss.elastic.co/t/boolean-parameters-in-token-filters-are-stringified-breaking-elasticsearch-dsl-analysis-comparison/260342 "2021-01-06T12:59:50Z")
Heya, I'm not sure if this is a bug with elastic itself or with the elasticsearch\_dsl python library, so posting here before filing an issue on github. If you set up a token filter with a boolean parameter, that paramet… --- ## [Automatic alerting on forcast (machine learning)](https://discuss.elastic.co/t/automatic-alerting-on-forcast-machine-learning/260248)
**Author:** [@Landry](https://discuss.elastic.co/u/Landry)\ **Replies:** 3\ **Last updated:** [January 6, 2021, 12:59pm UTC](https://discuss.elastic.co/t/automatic-alerting-on-forcast-machine-learning/260248 "2021-01-06T12:59:28Z")
Hello, How can we automate machine learning forcast execution in order to notify customers when some unusual events will occurs in the next days. We have a machine learning job that detect anomalies on our datas. Actua… --- ## [Encoded bytes are incorrect length issue](https://discuss.elastic.co/t/encoded-bytes-are-incorrect-length-issue/260228)
**Author:** [@Akaren](https://discuss.elastic.co/u/Akaren)\ **Replies:** 2\ **Last updated:** [January 6, 2021, 10:01am UTC](https://discuss.elastic.co/t/encoded-bytes-are-incorrect-length-issue/260228 "2021-01-06T10:01:49Z")
Hi, my elasticsearch 7.7.1 sometimes returns encoded bytes are incorrect length error with 400. It's only sometimes, can you tell me the meaning? What can be couse of it? --- ## [Negative epoch\_millis sometimes throw error while indexing](https://discuss.elastic.co/t/negative-epoch-millis-sometimes-throw-error-while-indexing/260239)
**Author:** [@JulienNemo](https://discuss.elastic.co/u/JulienNemo)\ **Replies:** 3\ **Last updated:** [January 6, 2021, 9:15am UTC](https://discuss.elastic.co/t/negative-epoch-millis-sometimes-throw-error-while-indexing/260239 "2021-01-06T09:15:43Z")
Hi, version: 7.10.1 Have a"dateOfBirth": { "type": "date" } field. I can't index the document with the dateOfBirth:-1555200000 error : “reason”:“date\_time\_exception: Invalid value for Year (vali… --- ## [S3 Repository Plugin - curl: (52) Empty reply from server](https://discuss.elastic.co/t/s3-repository-plugin-curl-52-empty-reply-from-server/259447)
**Author:** [@bigbansal](https://discuss.elastic.co/u/bigbansal)\ **Replies:** 5\ **Last updated:** [January 6, 2021, 8:34am UTC](https://discuss.elastic.co/t/s3-repository-plugin-curl-52-empty-reply-from-server/259447 "2021-01-06T08:34:59Z")
Hi All, I am struggling to put data node's data to S3 Bucket and getting empty response from server. can u please suggest what could be the reason ? --elasticsearch.yml has path.repo: $s3\_Bucket/$s3\_Prefix/docroot --… --- ## [Cross-field atleast functionality (return documents where a term has x occurrences)](https://discuss.elastic.co/t/cross-field-atleast-functionality-return-documents-where-a-term-has-x-occurrences/260294)
**Author:** [@Daantie](https://discuss.elastic.co/u/Daantie)\ **Replies:** 0\ **Last updated:** [January 6, 2021, 8:23am UTC](https://discuss.elastic.co/t/cross-field-atleast-functionality-return-documents-where-a-term-has-x-occurrences/260294 "2021-01-06T08:23:22Z")
Hello! I'm working for a client in the patent domain. We have a feature called atleast that returns all documents where a term has a minimum of x occurrences. In the past a plugin was written for this (also mentioned he… --- ## [Initial\_master\_nodes case-sensitive to capitalized hostnames on Windows for v7.7.1](https://discuss.elastic.co/t/initial-master-nodes-case-sensitive-to-capitalized-hostnames-on-windows-for-v7-7-1/260264)
**Author:** [@cjcjameson](https://discuss.elastic.co/u/cjcjameson)\ **Replies:** 2\ **Last updated:** [January 6, 2021, 6:39am UTC](https://discuss.elastic.co/t/initial-master-nodes-case-sensitive-to-capitalized-hostnames-on-windows-for-v7-7-1/260264 "2021-01-06T06:39:36Z")
Hi there, We have a cluster on Windows where we're trying to launch Elasticsearch v7.7.1 . We are using cluster.initial\_master\_nodes , setting it to the host-names (we think). We are not setting node.name . We are being… --- ## [Elasticsearch Cardinality aggregation with condition](https://discuss.elastic.co/t/elasticsearch-cardinality-aggregation-with-condition/260275)
**Author:** [@rohitc.11](https://discuss.elastic.co/u/rohitc.11)\ **Replies:** 0\ **Last updated:** [January 6, 2021, 6:35am UTC](https://discuss.elastic.co/t/elasticsearch-cardinality-aggregation-with-condition/260275 "2021-01-06T06:35:04Z")
I want to do cardinality aggregation with condition. I want to count all the unique sellers whose sell sum should be greater than 100 for product list. Is there any way to do this using cardinality or anything else? I… --- ## [Question regarding ES distribution of incoming requests](https://discuss.elastic.co/t/question-regarding-es-distribution-of-incoming-requests/260268)
**Author:** [@Amlan\_Kumar\_Rath](https://discuss.elastic.co/u/Amlan_Kumar_Rath)\ **Replies:** 0\ **Last updated:** [January 6, 2021, 3:19am UTC](https://discuss.elastic.co/t/question-regarding-es-distribution-of-incoming-requests/260268 "2021-01-06T03:19:53Z")
I have a 3 node cluster with 6 indices of 1 shard each and 2 replicas, in short the full copy of an index on each node. Now I know that when I make a search call by calling a particular node of the cluster with a query, … --- ## [Elasticsearch complaining about Shard limit](https://discuss.elastic.co/t/elasticsearch-complaining-about-shard-limit/260266)
**Author:** [@SteveHodges](https://discuss.elastic.co/u/SteveHodges)\ **Replies:** 4\ **Last updated:** [January 6, 2021, 2:59am UTC](https://discuss.elastic.co/t/elasticsearch-complaining-about-shard-limit/260266 "2021-01-06T02:59:44Z")
I have had this problem every other month. I just go in and close the oldest 2 months of indexes. That has been solving the problem up until this week. Even though the Elasticsearch stats pages tells me that I only h… --- ## [Enrich Processor is slow on multi nodes](https://discuss.elastic.co/t/enrich-processor-is-slow-on-multi-nodes/260245)
**Author:** [@Mike\_Connor](https://discuss.elastic.co/u/Mike_Connor)\ **Replies:** 9\ **Last updated:** [January 6, 2021, 2:21am UTC](https://discuss.elastic.co/t/enrich-processor-is-slow-on-multi-nodes/260245 "2021-01-06T02:21:57Z")
Hello, I am helping with a project that is using an ingest pipeline, specifically the enrich processor. The enrich processor is pulling from a source index that is fairly small (300k records, ~25MB). The documents that … --- ## [Elasticsearch-py support for search after](https://discuss.elastic.co/t/elasticsearch-py-support-for-search-after/260222)
**Author:** [@zuanni](https://discuss.elastic.co/u/zuanni)\ **Replies:** 1\ **Last updated:** [January 5, 2021, 10:40pm UTC](https://discuss.elastic.co/t/elasticsearch-py-support-for-search-after/260222 "2021-01-05T22:40:20Z")
Hi All, First time here, I apologize in case I post in the wrong way or area. I'm searching news about the support for https://www.elastic.co/guide/en/elasticsearch/reference/current/paginate-search-results.html#search… --- ## [Unable to access field outside \_source in Painless ingest processor](https://discuss.elastic.co/t/unable-to-access-field-outside-source-in-painless-ingest-processor/260247)
**Author:** [@marcosvrrs](https://discuss.elastic.co/u/marcosvrrs)\ **Replies:** 0\ **Last updated:** [January 5, 2021, 5:14pm UTC](https://discuss.elastic.co/t/unable-to-access-field-outside-source-in-painless-ingest-processor/260247 "2021-01-05T17:14:57Z")
Hi I can not figure out how to access a field that is outside the \_source. The grok processor with the field nested I can't access, or the rename processor too. Tried to access the data with ctx, \_source, \_index. Don't k… --- ## [Handling high task count on daily index rollover](https://discuss.elastic.co/t/handling-high-task-count-on-daily-index-rollover/260214)
**Author:** [@OranShuster](https://discuss.elastic.co/u/OranShuster)\ **Replies:** 3\ **Last updated:** [January 5, 2021, 9:21pm UTC](https://discuss.elastic.co/t/handling-high-task-count-on-daily-index-rollover/260214 "2021-01-05T21:21:19Z")
Some stats about the cluster Version 6.5.0 3 master nodes 12 hot data+ingest nodes 16 vCPU 32GB mem (16GB heap) each 12 warm data+ingest nodes 8 vCPU 32GB mem (16GB heap) each 1 ingest node (added recently for tes… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=729) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=731)