# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=735 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 736 --- ## [Return node to cluster](https://discuss.elastic.co/t/return-node-to-cluster/259663)
**Author:** [@KA3AXCTAH](https://discuss.elastic.co/u/KA3AXCTAH)\ **Replies:** 1\ **Last updated:** [December 26, 2020, 7:48pm UTC](https://discuss.elastic.co/t/return-node-to-cluster/259663 "2020-12-26T19:48:22Z")
I have 3 node elasticsearch cluster 192.168.2.11 - node-01 192.168.2.12 - node-02 192.168.2.13 - node-03 and i deleted node-02 from cluster using this command curl -XPUT 192.168.2.12:9200/\_cluster/settings -H 'Content… --- ## [How to specify timezone on elasticsearch?](https://discuss.elastic.co/t/how-to-specify-timezone-on-elasticsearch/259614)
**Author:** [@gabriel.goncalves](https://discuss.elastic.co/u/gabriel.goncalves)\ **Replies:** 6\ **Last updated:** [December 26, 2020, 6:19pm UTC](https://discuss.elastic.co/t/how-to-specify-timezone-on-elasticsearch/259614 "2020-12-26T18:19:38Z")
It says: "Internally, dates are converted to UTC (if the time-zone is specified) and stored as a long number representing milliseconds-since-the-epoch." What are all possible ways to specify the timezone? --- ## [Pipeline with id \[\] does not exist](https://discuss.elastic.co/t/pipeline-with-id-does-not-exist/259476)
**Author:** [@Atul\_Chadha](https://discuss.elastic.co/u/Atul_Chadha)\ **Replies:** 12\ **Last updated:** [December 26, 2020, 12:53pm UTC](https://discuss.elastic.co/t/pipeline-with-id-does-not-exist/259476 "2020-12-26T12:53:05Z")
There are few references to this problem already here but none provide resolution, I am getting the below error on 7.6.2 and i do see the pipeline when i run the GET API call { "index" : "xxxxxxxxxx-2020.45-reind… --- ## [How to search multiple fields and aggregate scores?](https://discuss.elastic.co/t/how-to-search-multiple-fields-and-aggregate-scores/259659)
**Author:** [@Shuri](https://discuss.elastic.co/u/Shuri)\ **Replies:** 0\ **Last updated:** [December 26, 2020, 11:34am UTC](https://discuss.elastic.co/t/how-to-search-multiple-fields-and-aggregate-scores/259659 "2020-12-26T11:34:28Z")
Hi all, I'm trying to figure out a solution to how I should structure my queries for finding answers to people's questions. For example, based off the dataset I will paste at the end of this post, I would like to query "… --- ## [Using aggregation in Elasticsearch to find duplicate data in the same index](https://discuss.elastic.co/t/using-aggregation-in-elasticsearch-to-find-duplicate-data-in-the-same-index/259637)
**Author:** [@Amraneze](https://discuss.elastic.co/u/Amraneze)\ **Replies:** 5\ **Last updated:** [December 25, 2020, 5:41pm UTC](https://discuss.elastic.co/t/using-aggregation-in-elasticsearch-to-find-duplicate-data-in-the-same-index/259637 "2020-12-25T17:41:47Z")
Hi everyone, I'm trying to find duplicates within the same index. I tried to use aggregation like this : { "aggs": { "duplicates": { "terms": { "script": { "source": "if (doc\['username.sort-field'\].size(… --- ## [How can I use elasticsearch java aip to agg from the Query Builders？](https://discuss.elastic.co/t/how-can-i-use-elasticsearch-java-aip-to-agg-from-the-query-builders/259624)
**Author:** [@Vastzhang](https://discuss.elastic.co/u/Vastzhang)\ **Replies:** 2\ **Last updated:** [December 25, 2020, 10:18am UTC](https://discuss.elastic.co/t/how-can-i-use-elasticsearch-java-aip-to-agg-from-the-query-builders/259624 "2020-12-25T10:18:19Z")
Hi!I use elasticsearch java api like as follw: how can i convert json as follow to java api？ Thanks！！！ --- ## [Elasticsearch query that returns latest document for each group of criteria in the query](https://discuss.elastic.co/t/elasticsearch-query-that-returns-latest-document-for-each-group-of-criteria-in-the-query/259625)
**Author:** [@n0rman](https://discuss.elastic.co/u/n0rman)\ **Replies:** 0\ **Last updated:** [December 25, 2020, 9:07am UTC](https://discuss.elastic.co/t/elasticsearch-query-that-returns-latest-document-for-each-group-of-criteria-in-the-query/259625 "2020-12-25T09:07:30Z")
Newbie here. Trying to figure out how to query to find grandparent processes of child processes by using parent process info in windows logs. I have a list of child processes with host info (hostname) and parent proces… --- ## [Indexer Mongodb dans ES en temps réel](https://discuss.elastic.co/t/indexer-mongodb-dans-es-en-temps-reel/259190)
**Author:** [@Jalil](https://discuss.elastic.co/u/Jalil)\ **Replies:** 23\ **Last updated:** [December 25, 2020, 9:03am UTC](https://discuss.elastic.co/t/indexer-mongodb-dans-es-en-temps-reel/259190 "2020-12-25T09:03:53Z")
Bonjour à tous, Mon besoin est d'indexer en temps réel une base mongodb (plusieurs collections) dans Elasticsearch (en leur appliquant qlq transformation au passage : formatage des geo\_point par exemple). J'ai essayé a… --- ## [Grok pattern to match multiple results](https://discuss.elastic.co/t/grok-pattern-to-match-multiple-results/259605)
**Author:** [@Minor\_Vargas](https://discuss.elastic.co/u/Minor_Vargas)\ **Replies:** 1\ **Last updated:** [December 25, 2020, 8:29am UTC](https://discuss.elastic.co/t/grok-pattern-to-match-multiple-results/259605 "2020-12-25T08:29:14Z")
Hi guys, I need to match the first line of each log and maybe store it in an array and prepend some metadata at the beginning of each line.. I have a grok pattern that's matching only the first result and ignores the re… --- ## [Grok pattern to add some metadata to every log](https://discuss.elastic.co/t/grok-pattern-to-add-some-metadata-to-every-log/259432)
**Author:** [@Minor\_Vargas](https://discuss.elastic.co/u/Minor_Vargas)\ **Replies:** 1\ **Last updated:** [December 23, 2020, 6:48am UTC](https://discuss.elastic.co/t/grok-pattern-to-add-some-metadata-to-every-log/259432 "2020-12-23T06:48:39Z")
Hello all, I wrote a grok pattern that matches the beginning of each log line (Writing table data). I need to take the timestamp that I already matched and append it at the beginning of each log line. I'm facing 2 issue… --- ## [How Resubscribe watcher email](https://discuss.elastic.co/t/how-resubscribe-watcher-email/259598)
**Author:** [@Juan\_David\_Jaramillo](https://discuss.elastic.co/u/Juan_David_Jaramillo)\ **Replies:** 4\ **Last updated:** [December 24, 2020, 5:49pm UTC](https://discuss.elastic.co/t/how-resubscribe-watcher-email/259598 "2020-12-24T17:49:41Z")
how can i re-subscribe my mail to the watcher alerts, it no longer notifies me when an event happens in a watcher, i accidentally gave it in unsubscribed, but now i don't know how to re-subscribe my mail to get the alert… --- ## [Snapshot Policy Based on Data Phase](https://discuss.elastic.co/t/snapshot-policy-based-on-data-phase/259595)
**Author:** [@BenB196](https://discuss.elastic.co/u/BenB196)\ **Replies:** 5\ **Last updated:** [December 24, 2020, 5:46pm UTC](https://discuss.elastic.co/t/snapshot-policy-based-on-data-phase/259595 "2020-12-24T17:46:17Z")
Hi All, I was wondering if it's possible to create snapshot policies that include/exclude indices based on their phase? I wasn't able to find any documentation on this and didn't see any posts about it. The use case I … --- ## [Is there any way to configure HTTPS without X-Pack](https://discuss.elastic.co/t/is-there-any-way-to-configure-https-without-x-pack/259588)
**Author:** [@Shubham](https://discuss.elastic.co/u/Shubham)\ **Replies:** 1\ **Last updated:** [December 24, 2020, 12:38pm UTC](https://discuss.elastic.co/t/is-there-any-way-to-configure-https-without-x-pack/259588 "2020-12-24T12:38:40Z")
Is there any way to configure HTTPS in ES cluster without using x-pack ? I'm using 5.4 version. I know it is doable freely in 6.8+ but any lead with 5.4 version ? --- ## [Strange memory leak ElasticSearch](https://discuss.elastic.co/t/strange-memory-leak-elasticsearch/258814)
**Author:** [@ThreatInter](https://discuss.elastic.co/u/ThreatInter)\ **Replies:** 20\ **Last updated:** [December 24, 2020, 10:33am UTC](https://discuss.elastic.co/t/strange-memory-leak-elasticsearch/258814 "2020-12-24T10:33:32Z")
Hi, we have a cluster of ES. Our Heap is 31 Gb on each node. Total RAM 128 Gb on each node. And our RAM fills up over time and starts to run out, it that time we get faults of cluster. We see that "cached" constantly … --- ## [Intermittent search querying issues](https://discuss.elastic.co/t/intermittent-search-querying-issues/259471)
**Author:** [@Sajjan\_Kumar\_Jain](https://discuss.elastic.co/u/Sajjan_Kumar_Jain)\ **Replies:** 8\ **Last updated:** [December 24, 2020, 9:25am UTC](https://discuss.elastic.co/t/intermittent-search-querying-issues/259471 "2020-12-24T09:25:06Z")
Hi, We are using elastic search in our backend hosted on AWS. And our backend is in Java. We have seen a pattern where queries start failing for a brief period of time with the following error: cannot write time value … --- ## [Accessing Elasticsearch index from flutter mobile app](https://discuss.elastic.co/t/accessing-elasticsearch-index-from-flutter-mobile-app/259567)
**Author:** [@Aimn\_Blbol](https://discuss.elastic.co/u/Aimn_Blbol)\ **Replies:** 0\ **Last updated:** [December 24, 2020, 8:46am UTC](https://discuss.elastic.co/t/accessing-elasticsearch-index-from-flutter-mobile-app/259567 "2020-12-24T08:46:57Z")
I have created users Elasticsearch index in the Google Cloud Platform to integrate firestore cloud functions with Elasticsearch so that when a user is created / updated / deleted, the change will be reflected in the Elas… --- ## [Remove outdated java present in Elasticsearch installation](https://discuss.elastic.co/t/remove-outdated-java-present-in-elasticsearch-installation/259553)
**Author:** [@Darshan\_Parab](https://discuss.elastic.co/u/Darshan_Parab)\ **Replies:** 0\ **Last updated:** [December 24, 2020, 6:47am UTC](https://discuss.elastic.co/t/remove-outdated-java-present-in-elasticsearch-installation/259553 "2020-12-24T06:47:45Z")
Hi, We are running Elasticsearch 7.9.1 in our environment. We have been reported that there is outdated java version installed at path /usr/share/elasticsearch/jdk. Though we are not using it to run Elasticsearch. But t… --- ## [Merging indices from old server](https://discuss.elastic.co/t/merging-indices-from-old-server/259420)
**Author:** [@alfredoCo](https://discuss.elastic.co/u/alfredoCo)\ **Replies:** 3\ **Last updated:** [December 24, 2020, 5:24am UTC](https://discuss.elastic.co/t/merging-indices-from-old-server/259420 "2020-12-24T05:24:21Z")
Hello, I need to merge the data of an index from the old server into the new one. The data has been accumulating over a month now in the new server. should I copy the data via a script? or there is a build in functiona… --- ## [Elasticsearch 7.8.1， shards allocation failed](https://discuss.elastic.co/t/elasticsearch-7-8-1-shards-allocation-failed/259352)
**Author:** [@wzhanw](https://discuss.elastic.co/u/wzhanw)\ **Replies:** 5\ **Last updated:** [December 24, 2020, 5:23am UTC](https://discuss.elastic.co/t/elasticsearch-7-8-1-shards-allocation-failed/259352 "2020-12-24T05:23:34Z")
Hi all, I'm running the ealsticsearch 7.8.1 single node cluster on my server, I got a critical error when the logstash insert document to the es. I tried to clean up the data directory and restarted the es, the error … --- ## [java.io.StreamCorruptedException: invalid internal transport message format, got (16,3,3,0)](https://discuss.elastic.co/t/java-io-streamcorruptedexception-invalid-internal-transport-message-format-got-16-3-3-0/257679)
**Author:** [@prashanth\_sri](https://discuss.elastic.co/u/prashanth_sri)\ **Replies:** 16\ **Last updated:** [December 24, 2020, 3:55am UTC](https://discuss.elastic.co/t/java-io-streamcorruptedexception-invalid-internal-transport-message-format-got-16-3-3-0/257679 "2020-12-24T03:55:13Z")
hi , i am updating my xpack security in all my cluster nodes , by using this yml.file, action.auto\_create\_index: .monitoring\*,.watches,.triggered\_watches,.watcher-history\*,.ml\* xpack.security.audit.enabled: true … --- ## [How do we include the stack trace of the error on the JavaScript client?](https://discuss.elastic.co/t/how-do-we-include-the-stack-trace-of-the-error-on-the-javascript-client/259436)
**Author:** [@DevFullStack](https://discuss.elastic.co/u/DevFullStack)\ **Replies:** 2\ **Last updated:** [December 24, 2020, 2:34am UTC](https://discuss.elastic.co/t/how-do-we-include-the-stack-trace-of-the-error-on-the-javascript-client/259436 "2020-12-24T02:34:42Z")
How do we include the stack trace of the error on the JavaScript client? The API says error\_trace is an accepted common parameter, but I couldn't get the complete stack trace of the error\* I was troubleshooting : var … --- ## [Elasticsearch and Logstash logs retention to 7 days](https://discuss.elastic.co/t/elasticsearch-and-logstash-logs-retention-to-7-days/259464)
**Author:** [@atharvak](https://discuss.elastic.co/u/atharvak)\ **Replies:** 1\ **Last updated:** [December 23, 2020, 11:42pm UTC](https://discuss.elastic.co/t/elasticsearch-and-logstash-logs-retention-to-7-days/259464 "2020-12-23T23:42:12Z")
Hi guys, Is there any way to reduce the Elasticsearch and logstash app logs count to 7 days using log4j.properties? Currently as I can observe, the log rotation in /var/log/elasticsearch and /var/log/logstash has no lim… --- ## [How to Search elasticsearch Indexes name filter on Index Creation date](https://discuss.elastic.co/t/how-to-search-elasticsearch-indexes-name-filter-on-index-creation-date/259479)
**Author:** [@yael](https://discuss.elastic.co/u/yael)\ **Replies:** 1\ **Last updated:** [December 23, 2020, 11:24pm UTC](https://discuss.elastic.co/t/how-to-search-elasticsearch-indexes-name-filter-on-index-creation-date/259479 "2020-12-23T23:24:21Z")
How can I filter the result I get from the query: GET /\_cat/indices?h=h,s,i,id,p,r,dc,dd,ss,creation.date.string to all indexes from specific creation.date. Thanks Yael --- ## [How to match every element in the array](https://discuss.elastic.co/t/how-to-match-every-element-in-the-array/259536)
**Author:** [@yaddes](https://discuss.elastic.co/u/yaddes)\ **Replies:** 0\ **Last updated:** [December 23, 2020, 10:48pm UTC](https://discuss.elastic.co/t/how-to-match-every-element-in-the-array/259536 "2020-12-23T22:48:22Z")
I am trying to perform an elastic-search query that will return documents where "every" element of the nested collection has a match, not just one. For example, I have a Driver object, with the List of cars, and each ca… --- ## [Unusual timestamp data that needs fixing](https://discuss.elastic.co/t/unusual-timestamp-data-that-needs-fixing/259209)
**Author:** [@dan.mackie](https://discuss.elastic.co/u/dan.mackie)\ **Replies:** 0\ **Last updated:** [December 20, 2020, 11:54pm UTC](https://discuss.elastic.co/t/unusual-timestamp-data-that-needs-fixing/259209 "2020-12-20T23:54:19Z")
Hello all, Elastic 7.9.2 Kibana 7.9.2 I have an index that has somehow ended up with a date 20000 years in the future. I thought at first that the @timestamp field had simply been misinterpreted as text by elastic, w… --- ## [Creating watcher script if particular value ina field occurs more than five times in five minutes interval of time](https://discuss.elastic.co/t/creating-watcher-script-if-particular-value-ina-field-occurs-more-than-five-times-in-five-minutes-interval-of-time/259375)
**Author:** [@sangatamilan](https://discuss.elastic.co/u/sangatamilan)\ **Replies:** 0\ **Last updated:** [December 22, 2020, 11:16am UTC](https://discuss.elastic.co/t/creating-watcher-script-if-particular-value-ina-field-occurs-more-than-five-times-in-five-minutes-interval-of-time/259375 "2020-12-22T11:16:57Z")
Hi can anyone help how can we create a watcher script for the below requirement I having a field called "log\_message" contaning the below message Failed to load TermRecord for TermID=\*\*\*\*\*\* here the terminal id can be… --- ## [Life Cycle Policies: Alias for rollover index](https://discuss.elastic.co/t/life-cycle-policies-alias-for-rollover-index/259390)
**Author:** [@Jurilz](https://discuss.elastic.co/u/Jurilz)\ **Replies:** 0\ **Last updated:** [December 22, 2020, 1:55pm UTC](https://discuss.elastic.co/t/life-cycle-policies-alias-for-rollover-index/259390 "2020-12-22T13:55:12Z")
Kibana version : 7.10.0 Elasticsearch version : 7.10.0 Filebeat version : 7.10.0 Logstash version : 7.10.0 Good day, I'm trying to set up a lifecycle management for my indices. Therefore I created two index template… --- ## [Health check failed](https://discuss.elastic.co/t/health-check-failed/259430)
**Author:** [@sukumar.koganti](https://discuss.elastic.co/u/sukumar.koganti)\ **Replies:** 5\ **Last updated:** [December 23, 2020, 4:31pm UTC](https://discuss.elastic.co/t/health-check-failed/259430 "2020-12-23T16:31:33Z")
I am trying to install Elasticserver in Linux, after I ran the server I am facing the below issue. Can you please help me to resolve this? \[2020-12-22T00:02:31,363\]\[ERROR\]\[o.e.m.f.FsHealthService \] \[GTHYJDEV01.pneus.to… --- ## [How to handle watermark.low](https://discuss.elastic.co/t/how-to-handle-watermark-low/258955)
**Author:** [@Kxn7](https://discuss.elastic.co/u/Kxn7)\ **Replies:** 3\ **Last updated:** [December 23, 2020, 4:02pm UTC](https://discuss.elastic.co/t/how-to-handle-watermark-low/258955 "2020-12-23T16:02:13Z")
Hi, We recently had the case that multiple nodes of our ElasticSearch cluster running version 7.3.2 reached the low watermark threshold. We immediately added some nodes to counteract the increase in disk usage and made… --- ## [Duplicate log entries](https://discuss.elastic.co/t/duplicate-log-entries/259394)
**Author:** [@leandro.borges](https://discuss.elastic.co/u/leandro.borges)\ **Replies:** 17\ **Last updated:** [December 23, 2020, 3:52pm UTC](https://discuss.elastic.co/t/duplicate-log-entries/259394 "2020-12-23T15:52:32Z")
Hi, We are facing some issues with elasticsearch. We are having lots of duplicate log entries like below. Inside logstash.yml there is only a file in path.config that we use: path.config: "/etc/logstash/pipeline.global.… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=734) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=736)