# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=731 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 732 --- ## [Dynamic add/remove indexes alias](https://discuss.elastic.co/t/dynamic-add-remove-indexes-alias/260099)
**Author:** [@Cris.Oporto](https://discuss.elastic.co/u/Cris.Oporto)\ **Replies:** 3\ **Last updated:** [January 5, 2021, 8:55pm UTC](https://discuss.elastic.co/t/dynamic-add-remove-indexes-alias/260099 "2021-01-05T20:55:54Z")
Hi! Currently we are working with a ILP to manage indexes in hot/warm depending on their age. We have noticed retrieving documents from warm indexes is less performant than needed, so, we are thinking in a two steps dat… --- ## [Adding a node from an existing cluster to another cluster](https://discuss.elastic.co/t/adding-a-node-from-an-existing-cluster-to-another-cluster/260252)
**Author:** [@Ryan\_Clark](https://discuss.elastic.co/u/Ryan_Clark)\ **Replies:** 6\ **Last updated:** [January 5, 2021, 8:16pm UTC](https://discuss.elastic.co/t/adding-a-node-from-an-existing-cluster-to-another-cluster/260252 "2021-01-05T20:16:18Z")
I have a single elasticsearch node in it's own cluster (one node cluster) and I have different cluster that has 3 nodes. Both have their own set of data. I want to take the single node and add it to the 3 node cluster t… --- ## [Checking shards creation](https://discuss.elastic.co/t/checking-shards-creation/260192)
**Author:** [@kirillmandrygin](https://discuss.elastic.co/u/kirillmandrygin)\ **Replies:** 1\ **Last updated:** [January 5, 2021, 7:54pm UTC](https://discuss.elastic.co/t/checking-shards-creation/260192 "2021-01-05T19:54:13Z")
When a node hits cluster.max\_shards\_per\_node limit, the cluster status remains green. Logs from elasticsearch: "Caused by: org.elasticsearch.common.ValidationException: Validation Failed: 1: this action would add \[… --- ## [Restore from S3 to multiple ES clusters in parallel](https://discuss.elastic.co/t/restore-from-s3-to-multiple-es-clusters-in-parallel/260250)
**Author:** [@Norman\_Khine](https://discuss.elastic.co/u/Norman_Khine)\ **Replies:** 4\ **Last updated:** [January 5, 2021, 7:48pm UTC](https://discuss.elastic.co/t/restore-from-s3-to-multiple-es-clusters-in-parallel/260250 "2021-01-05T19:48:18Z")
Hello, Would there be any issues with restoring to multiple ES clusters from a single snapshot in parallel from an S3 backup? Will be looking to restore specific indexes into different clusters. Or should this be done… --- ## [Terms query with large number of items increase latency by number of shards](https://discuss.elastic.co/t/terms-query-with-large-number-of-items-increase-latency-by-number-of-shards/259769)
**Author:** [@nickcanz](https://discuss.elastic.co/u/nickcanz)\ **Replies:** 3\ **Last updated:** [January 5, 2021, 5:57pm UTC](https://discuss.elastic.co/t/terms-query-with-large-number-of-items-increase-latency-by-number-of-shards/259769 "2021-01-05T17:57:48Z")
For requests with a very high terms count, Elasticsearch is taking multiple seconds to return an HTTP 400 error. We had an issue with a production system that produced a query that had 250K items in a terms query and thi… --- ## [Elasticsearch 7.5 erros?](https://discuss.elastic.co/t/elasticsearch-7-5-erros/260105)
**Author:** [@Beuhlet\_Reseau](https://discuss.elastic.co/u/Beuhlet_Reseau)\ **Replies:** 6\ **Last updated:** [January 5, 2021, 5:54pm UTC](https://discuss.elastic.co/t/elasticsearch-7-5-erros/260105 "2021-01-05T17:54:05Z")
Hello, Happy new year. It seems Spark Streaming job was slow into Elasticsearch. I check master and find this erros in log ? \[...\] only morning : \[2021-01-04T01:59:56,349\]\[WARN \]\[o.e.x.m.e.l.LocalExporter\] \[opu309\_m… --- ## [Hot-Warm Architecture with ILM: Cluster health turns yellow](https://discuss.elastic.co/t/hot-warm-architecture-with-ilm-cluster-health-turns-yellow/260244)
**Author:** [@Eduardo\_Iglesias](https://discuss.elastic.co/u/Eduardo_Iglesias)\ **Replies:** 6\ **Last updated:** [January 5, 2021, 5:47pm UTC](https://discuss.elastic.co/t/hot-warm-architecture-with-ilm-cluster-health-turns-yellow/260244 "2021-01-05T17:47:37Z")
Hello community, I'm trying to implement a hot warm architecture but I can't make it work, the cluster health turns yellow. Below are the details of my cluster and some outputs: GET \_cat/indices yellow open test-0000… --- ## [Watcher Exception - Could Not Parse: Unknown Action Type "foreach"](https://discuss.elastic.co/t/watcher-exception-could-not-parse-unknown-action-type-foreach/258631)
**Author:** [@ravinb86](https://discuss.elastic.co/u/ravinb86)\ **Replies:** 3\ **Last updated:** [January 5, 2021, 4:40pm UTC](https://discuss.elastic.co/t/watcher-exception-could-not-parse-unknown-action-type-foreach/258631 "2021-01-05T16:40:15Z")
Hello There, I have a basic watcher to see no. of hits based on a query and send an email per hit. i.e. if my query returns 5 hits, I need to be able to send 5 different emails. To loop through the hits in an array: I f… --- ## [Unable to delete the documents when the index is full](https://discuss.elastic.co/t/unable-to-delete-the-documents-when-the-index-is-full/260201)
**Author:** [@subash](https://discuss.elastic.co/u/subash)\ **Replies:** 6\ **Last updated:** [January 5, 2021, 4:21pm UTC](https://discuss.elastic.co/t/unable-to-delete-the-documents-when-the-index-is-full/260201 "2021-01-05T16:21:43Z")
I am unable to delete the documents from an index having the maximum number of documents (2147483519). getting the below exception. Please help me to get this resolved. "cause" : { "type" : "illegal\_argument\_ex… --- ## [ML Advanced datafeed Elasticsearch Query](https://discuss.elastic.co/t/ml-advanced-datafeed-elasticsearch-query/260219)
**Author:** [@Elk\_huh](https://discuss.elastic.co/u/Elk_huh)\ **Replies:** 1\ **Last updated:** [January 5, 2021, 3:49pm UTC](https://discuss.elastic.co/t/ml-advanced-datafeed-elasticsearch-query/260219 "2021-01-05T15:49:30Z")
How do i do query for event.code == 4625 winlog.event\_data.targetusername != "\*svc" this is what i have and doesnt seem to work { "bool": { "must": \[ { "match\_all": {} } \], "filter": \[ { "match\_phrase": { "… --- ## [Elastic receives small amount of data and nginx buffers the bulk events](https://discuss.elastic.co/t/elastic-receives-small-amount-of-data-and-nginx-buffers-the-bulk-events/259578)
**Author:** [@opouwels](https://discuss.elastic.co/u/opouwels)\ **Replies:** 6\ **Last updated:** [January 5, 2021, 12:30pm UTC](https://discuss.elastic.co/t/elastic-receives-small-amount-of-data-and-nginx-buffers-the-bulk-events/259578 "2021-01-05T12:30:22Z")
Hi List, Sinces we switched from fluentd to fluent-bit our elastic cluster showed more problems with the bulk queue, is their a way to see whats in the bulk queue and why its not progressing the queue? the nginx shows … --- ## [Pause Young (Allocation Failure) in gc.log](https://discuss.elastic.co/t/pause-young-allocation-failure-in-gc-log/260100)
**Author:** [@mtudisco](https://discuss.elastic.co/u/mtudisco)\ **Replies:** 2\ **Last updated:** [January 5, 2021, 12:24pm UTC](https://discuss.elastic.co/t/pause-young-allocation-failure-in-gc-log/260100 "2021-01-05T12:24:26Z")
Hi, I've been having these errors in gc.log in elasticsearch (7.3), and sometimes elasticsearch crushes, dont know if because of theese errors. Can anyone help to identifiy what does it mean? \[2021-01-04T14:36:14.097+0… --- ## [Classification of String Data](https://discuss.elastic.co/t/classification-of-string-data/260194)
**Author:** [@Andrey\_Maksimov](https://discuss.elastic.co/u/Andrey_Maksimov)\ **Replies:** 2\ **Last updated:** [January 5, 2021, 12:19pm UTC](https://discuss.elastic.co/t/classification-of-string-data/260194 "2021-01-05T12:19:53Z")
hey there, i have a task to classify download stats (basically, that's URL + some minor but yet valuable fields like referring host, request country, etc) of open-source products our company provide into metadata like s… --- ## [Elasticsearch 6.8.12 os.cpu always 100 although load varies and stays below number of processors](https://discuss.elastic.co/t/elasticsearch-6-8-12-os-cpu-always-100-although-load-varies-and-stays-below-number-of-processors/260136)
**Author:** [@span](https://discuss.elastic.co/u/span)\ **Replies:** 5\ **Last updated:** [January 5, 2021, 11:28am UTC](https://discuss.elastic.co/t/elasticsearch-6-8-12-os-cpu-always-100-although-load-varies-and-stays-below-number-of-processors/260136 "2021-01-05T11:28:21Z")
I have a small elastic cluster running on Kubernetes 1.18 in AKS. It has 3 ingest nodes, 3 masters and 4 data nodes. I do not have much data, only a few gigabytes spread over a dozen indices. It has been setup using Helm… --- ## [Hot/Warm architecture question](https://discuss.elastic.co/t/hot-warm-architecture-question/260119)
**Author:** [@frichard](https://discuss.elastic.co/u/frichard)\ **Replies:** 2\ **Last updated:** [January 5, 2021, 11:02am UTC](https://discuss.elastic.co/t/hot-warm-architecture-question/260119 "2021-01-05T11:02:14Z")
Hi everyone ! I am discussing Elasticsearch architecture with my team, and we wondered if the following setup would work : 2 hot nodes 2 warm nodes As a constraint, each index would have 1 replica for high availabili… --- ## [Set default time field on ingest\_timestamp](https://discuss.elastic.co/t/set-default-time-field-on-ingest-timestamp/260184)
**Author:** [@pat7](https://discuss.elastic.co/u/pat7)\ **Replies:** 0\ **Last updated:** [January 5, 2021, 9:54am UTC](https://discuss.elastic.co/t/set-default-time-field-on-ingest-timestamp/260184 "2021-01-05T09:54:55Z")
hi! i'm adding (w/ an ingest pipeline) an ingest\_timestamp to each document on my index. poorly I cannot use the kibana date picker on that data. how is it possible to set the default time field on an ingest\_timestamp? I… --- ## [How can I get all nouns in my field](https://discuss.elastic.co/t/how-can-i-get-all-nouns-in-my-field/260181)
**Author:** [@akamachi95](https://discuss.elastic.co/u/akamachi95)\ **Replies:** 0\ **Last updated:** [January 5, 2021, 9:19am UTC](https://discuss.elastic.co/t/how-can-i-get-all-nouns-in-my-field/260181 "2021-01-05T09:19:45Z")
Sorry fo my poor English. As kuromoji, I can just use part of speech to filter out the useless words and keep the words I want. For English, I want to do the same thin.So is there any way for me to do the same thing? --- ## [We already have an ES cluster running WITHOUT authentication and TLS. We are trying to enable the security feature. Is it possible to achieve this with zero down time?](https://discuss.elastic.co/t/we-already-have-an-es-cluster-running-without-authentication-and-tls-we-are-trying-to-enable-the-security-feature-is-it-possible-to-achieve-this-with-zero-down-time/260153)
**Author:** [@liwanjie](https://discuss.elastic.co/u/liwanjie)\ **Replies:** 9\ **Last updated:** [January 5, 2021, 8:46am UTC](https://discuss.elastic.co/t/we-already-have-an-es-cluster-running-without-authentication-and-tls-we-are-trying-to-enable-the-security-feature-is-it-possible-to-achieve-this-with-zero-down-time/260153 "2021-01-05T08:46:05Z")
Hello, I have encountered the problem mentioned above. I encountered it during the rolling upgrade of elasticsearch 6.8.1 to 7.8.1. Because my 6.8.1 did not configure xpack related configuration, but I want to configu… --- ## [Create multiple indicies mapping at one elasticsearch](https://discuss.elastic.co/t/create-multiple-indicies-mapping-at-one-elasticsearch/260162)
**Author:** [@tahseen\_fatima](https://discuss.elastic.co/u/tahseen_fatima)\ **Replies:** 1\ **Last updated:** [January 5, 2021, 6:51am UTC](https://discuss.elastic.co/t/create-multiple-indicies-mapping-at-one-elasticsearch/260162 "2021-01-05T06:51:59Z")
Hi, I have a scenario where my index name is changing frequently, I want to create index mapping at one go. with my-index-\* But I am not able to create at one go. PUT /my-index-\*/\_mapping { "properties": { "emai… --- ## [Creating and deleting a small index every 3 minutes, posible problems?](https://discuss.elastic.co/t/creating-and-deleting-a-small-index-every-3-minutes-posible-problems/260158)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 5\ **Last updated:** [January 5, 2021, 6:44am UTC](https://discuss.elastic.co/t/creating-and-deleting-a-small-index-every-3-minutes-posible-problems/260158 "2021-01-05T06:44:51Z")
Hi, with a python script I run a single logstash pipeline that create an ES index, in the same script I delete the index every 3 minutes, the size of the index is less than 1 Mb, I was wandering if this constant deletio… --- ## [Multiple nodes docker-compose](https://discuss.elastic.co/t/multiple-nodes-docker-compose/260127)
**Author:** [@nyquillus](https://discuss.elastic.co/u/nyquillus)\ **Replies:** 8\ **Last updated:** [January 5, 2021, 6:32am UTC](https://discuss.elastic.co/t/multiple-nodes-docker-compose/260127 "2021-01-05T06:32:38Z")
Hi, I currently manage a docker ELK stack with 3 nodes (1 master/no-data, 2 master/data) on the same machine. If I add 2 mode data node containers to this(still on the same machine) will i experience significant perform… --- ## [No matching indices found: No indices match pattern "winlogbeat-\*"](https://discuss.elastic.co/t/no-matching-indices-found-no-indices-match-pattern-winlogbeat/260134)
**Author:** [@sixstringssteve](https://discuss.elastic.co/u/sixstringssteve)\ **Replies:** 14\ **Last updated:** [January 5, 2021, 2:14am UTC](https://discuss.elastic.co/t/no-matching-indices-found-no-indices-match-pattern-winlogbeat/260134 "2021-01-05T02:14:47Z")
I am getting the errors "No matching indices found: No indices match pattern "winlogbeat-\*" when I try to go to the Winlogbeat dashboard or Discover. There was a winlogbeat-\* index pattern created, just no traffic hitt… --- ## [7.x How do remove duplicates in search after query?](https://discuss.elastic.co/t/7-x-how-do-remove-duplicates-in-search-after-query/259692)
**Author:** [@Adin\_Sijamija](https://discuss.elastic.co/u/Adin_Sijamija)\ **Replies:** 1\ **Last updated:** [January 5, 2021, 12:54am UTC](https://discuss.elastic.co/t/7-x-how-do-remove-duplicates-in-search-after-query/259692 "2021-01-05T00:54:39Z")
I have several indexes spread across 3 shards that hold my data. I want to make a SearchAfter where I fetch 50 rows ordered by start time. When I run it I am returned 50 hits but half of them are duplicates as the data i… --- ## [Running elasticsearch as daemon from shell script with password-protected keystore file](https://discuss.elastic.co/t/running-elasticsearch-as-daemon-from-shell-script-with-password-protected-keystore-file/260033)
**Author:** [@dzyubanv](https://discuss.elastic.co/u/dzyubanv)\ **Replies:** 2\ **Last updated:** [January 4, 2021, 11:10pm UTC](https://discuss.elastic.co/t/running-elasticsearch-as-daemon-from-shell-script-with-password-protected-keystore-file/260033 "2021-01-04T23:10:00Z")
Issue - elasticsearch doesn't start when running it as daemon from shell script. Details: I installed elasticsearch version 7.9.3 from archive on RHEL Configured 2 nodes cluster with TLS/SSL in elasticsearch.yml Prote… --- ## [Which is better - requests or elasticsearch](https://discuss.elastic.co/t/which-is-better-requests-or-elasticsearch/259974)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 1\ **Last updated:** [January 4, 2021, 10:35pm UTC](https://discuss.elastic.co/t/which-is-better-requests-or-elasticsearch/259974 "2021-01-04T22:35:13Z")
Inside python I can use two different method to retrieve the data. one with requests.get or can use elasticsarch module. for requests.get I can use sql query. while in elasticsearch I have to use REST code. which one … --- ## [Fix broken cluster with elasticsearch-node detach-cluster not working](https://discuss.elastic.co/t/fix-broken-cluster-with-elasticsearch-node-detach-cluster-not-working/260070)
**Author:** [@ebuildy](https://discuss.elastic.co/u/ebuildy)\ **Replies:** 17\ **Last updated:** [January 4, 2021, 5:58pm UTC](https://discuss.elastic.co/t/fix-broken-cluster-with-elasticsearch-node-detach-cluster-not-working/260070 "2021-01-04T17:58:28Z")
I want to fix a broken cluster (when a node cannot join because differente cluster UUID by exemple) without removing all data folder (the dirty solution I can see every time....), currently I am testing it, using officia… --- ## [SocketTimeoutException within Java High Level Client](https://discuss.elastic.co/t/sockettimeoutexception-within-java-high-level-client/259871)
**Author:** [@David-Lor](https://discuss.elastic.co/u/David-Lor)\ **Replies:** 4\ **Last updated:** [January 4, 2021, 4:13pm UTC](https://discuss.elastic.co/t/sockettimeoutexception-within-java-high-level-client/259871 "2021-01-04T16:13:11Z")
I'm building an application involving SpringBoot and the official Elastic REST High Level Client, and it seems that the connection with the Elastic server eventually dies if not used after some time. On the application … --- ## [Hot-warm policy](https://discuss.elastic.co/t/hot-warm-policy/259862)
**Author:** [@Abdelhalim](https://discuss.elastic.co/u/Abdelhalim)\ **Replies:** 2\ **Last updated:** [January 4, 2021, 3:48pm UTC](https://discuss.elastic.co/t/hot-warm-policy/259862 "2021-01-04T15:48:19Z")
Hello, I would like to create a Hot-warm policy , and the index should rollover when the index is 20Gb of size or max\_age equal to 30days BUT, if the size condition occur before the age condition, the index should rollo… --- ## [Ilm - index creation time picked as future date and time](https://discuss.elastic.co/t/ilm-index-creation-time-picked-as-future-date-and-time/260075)
**Author:** [@kannan\_raj](https://discuss.elastic.co/u/kannan_raj)\ **Replies:** 1\ **Last updated:** [January 4, 2021, 3:44pm UTC](https://discuss.elastic.co/t/ilm-index-creation-time-picked-as-future-date-and-time/260075 "2021-01-04T15:44:33Z")
ILM rollover stopped working from 12/27/2020, because of wrong index creation time. we verified system date, system date was correct during index creation. we could confirm by seeing the elasticsearch log that system d… --- ## [Index multiple payload hits to hits array in new index](https://discuss.elastic.co/t/index-multiple-payload-hits-to-hits-array-in-new-index/260101)
**Author:** [@esguy](https://discuss.elastic.co/u/esguy)\ **Replies:** 0\ **Last updated:** [January 4, 2021, 3:17pm UTC](https://discuss.elastic.co/t/index-multiple-payload-hits-to-hits-array-in-new-index/260101 "2021-01-04T15:17:46Z")
Hello, I am developing a watch that needs access to previous watch payload data. Since the watch scope is that of itself, I was thinking that an index action to index the desired payload for future reference was the way… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=730) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=732)