# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=736 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 737 --- ## [How to migrate rollover aliases to data streams?](https://discuss.elastic.co/t/how-to-migrate-rollover-aliases-to-data-streams/259255)
**Author:** [@elk51211](https://discuss.elastic.co/u/elk51211)\ **Replies:** 1\ **Last updated:** [December 23, 2020, 2:22pm UTC](https://discuss.elastic.co/t/how-to-migrate-rollover-aliases-to-data-streams/259255 "2020-12-23T14:22:21Z")
Hey, We have over 1000 rollover indices on produciton servers. How to we migrate this environment to the data stream setup? How does the migrate path looks like? Thanks a lot, Nils --- ## [Index policy evaluation](https://discuss.elastic.co/t/index-policy-evaluation/259488)
**Author:** [@alfredo.deluca](https://discuss.elastic.co/u/alfredo.deluca)\ **Replies:** 2\ **Last updated:** [December 23, 2020, 1:25pm UTC](https://discuss.elastic.co/t/index-policy-evaluation/259488 "2020-12-23T13:25:20Z")
Hi all. A very quick one. I have the following policy { “policy”: { “policy\_id”: “Delete\_older\_than\_60d”, “description”: “Changes replica count and deletes”, “last\_updated\_time”: 1608542726528, “schema\_version”: 1, “er… --- ## [Sorting with wildcards. occurrences of term. amount of “\*searchstring\*”](https://discuss.elastic.co/t/sorting-with-wildcards-occurrences-of-term-amount-of-searchstring/259481)
**Author:** [@flashpeter](https://discuss.elastic.co/u/flashpeter)\ **Replies:** 0\ **Last updated:** [December 23, 2020, 12:18pm UTC](https://discuss.elastic.co/t/sorting-with-wildcards-occurrences-of-term-amount-of-searchstring/259481 "2020-12-23T12:18:35Z")
hi all i have nasty problem with elastic result sorting combined with boolean type of query (a kind of wildcard). lets say we have blog post with field "content". each post contains some info about dragons. with all co… --- ## [Random file generated by elasticsearch](https://discuss.elastic.co/t/random-file-generated-by-elasticsearch/259453)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 1\ **Last updated:** [December 23, 2020, 11:06am UTC](https://discuss.elastic.co/t/random-file-generated-by-elasticsearch/259453 "2020-12-23T11:06:38Z")
I am using elasticsearch cluster of 8 node (3Master+3data+2coordinate).In data node there is a file called java\_pid4907.hprof of 7.2 gb in elasticsearch data directory this file is present in all elasticsearch data node.… --- ## [Audit logging for applying Licence](https://discuss.elastic.co/t/audit-logging-for-applying-licence/259443)
**Author:** [@Vineeth\_varma](https://discuss.elastic.co/u/Vineeth_varma)\ **Replies:** 0\ **Last updated:** [December 23, 2020, 4:25am UTC](https://discuss.elastic.co/t/audit-logging-for-applying-licence/259443 "2020-12-23T04:25:42Z")
Hi Team, I am using trail licence for ECK, and I have enabled auditing feature but still I am getting only few parameters, as this is testing its okay but after that will go into production one so in order to buy licenc… --- ## [CANVAS SQL: condition with timestamp](https://discuss.elastic.co/t/canvas-sql-condition-with-timestamp/259282)
**Author:** [@TheHunter1](https://discuss.elastic.co/u/TheHunter1)\ **Replies:** 2\ **Last updated:** [December 23, 2020, 8:03am UTC](https://discuss.elastic.co/t/canvas-sql-condition-with-timestamp/259282 "2020-12-23T08:03:19Z")
Hello, I am creating a canvas where I would like to show some anomalies in my cluster, and I wanna create something that show me if a new user in my AD has been created between midnight and 7am for example. I have this… --- ## [Elastic search query using a list](https://discuss.elastic.co/t/elastic-search-query-using-a-list/259439)
**Author:** [@shantanuo](https://discuss.elastic.co/u/shantanuo)\ **Replies:** 0\ **Last updated:** [December 23, 2020, 3:15am UTC](https://discuss.elastic.co/t/elastic-search-query-using-a-list/259439 "2020-12-23T03:15:56Z")
How do I pass a list as query string to match\_phrase query? This works: \`{"match\_phrase": {"requestParameters.bucketName": {"query": "auditloggingnew2232"}}},\` This does not: { "match\_phrase": { … --- ## [How to store big int value in elastic](https://discuss.elastic.co/t/how-to-store-big-int-value-in-elastic/259391)
**Author:** [@AKASH\_DUBEY1](https://discuss.elastic.co/u/AKASH_DUBEY1)\ **Replies:** 4\ **Last updated:** [December 23, 2020, 2:45am UTC](https://discuss.elastic.co/t/how-to-store-big-int-value-in-elastic/259391 "2020-12-23T02:45:24Z")
what data type should be used for storing the given value =281471798906391 .as it is out of long-range in java. and I have to use the range query on it. I tried using the keyword, double,it works but the range query does… --- ## [Fail to pass data from logstash to ES](https://discuss.elastic.co/t/fail-to-pass-data-from-logstash-to-es/259424)
**Author:** [@azteker](https://discuss.elastic.co/u/azteker)\ **Replies:** 1\ **Last updated:** [December 22, 2020, 11:59pm UTC](https://discuss.elastic.co/t/fail-to-pass-data-from-logstash-to-es/259424 "2020-12-22T23:59:29Z")
The output conf in the logstash conf file is output { elasticsearch { hosts =\> \["10.28.1.17:9200"\] index =\> "event-%{+YYYY.MM.dd}" } } I run the logstash in CLI with output as stdout {codec =\> rubyd… --- ## [Ignore\_malformed fires mapper\_parsing\_exception for keyword type on 7.10.1 (it worked on 7.1.0)](https://discuss.elastic.co/t/ignore-malformed-fires-mapper-parsing-exception-for-keyword-type-on-7-10-1-it-worked-on-7-1-0/259142)
**Author:** [@DevFullStack](https://discuss.elastic.co/u/DevFullStack)\ **Replies:** 9\ **Last updated:** [December 22, 2020, 11:13pm UTC](https://discuss.elastic.co/t/ignore-malformed-fires-mapper-parsing-exception-for-keyword-type-on-7-10-1-it-worked-on-7-1-0/259142 "2020-12-22T23:13:04Z")
This may be a breaking change in v.7.4+ that apparently was not documented. Any thoughts on how to solve this issue with an upgrade on a logs analysis use case? The docs about the ignore\_malformed mapping parameter hav… --- ## [Elasticsearch Active Directory Configuration Errors- User authentication](https://discuss.elastic.co/t/elasticsearch-active-directory-configuration-errors-user-authentication/259294)
**Author:** [@linfordwoode](https://discuss.elastic.co/u/linfordwoode)\ **Replies:** 5\ **Last updated:** [December 22, 2020, 8:51pm UTC](https://discuss.elastic.co/t/elasticsearch-active-directory-configuration-errors-user-authentication/259294 "2020-12-22T20:51:16Z")
Hello, I have been stuck on this for a couple of days now. I have tried several options from the forum but I still can't get it to work. Used this documentation https://www.elastic.co/guide/en/elasticsearch/reference/cu… --- ## [\[Ingest Node\] pipeline with id \[x\] does not exist (solved)](https://discuss.elastic.co/t/ingest-node-pipeline-with-id-x-does-not-exist-solved/54436)
**Author:** [@PatrickKik](https://discuss.elastic.co/u/PatrickKik)\ **Replies:** 13\ **Last updated:** [December 22, 2020, 8:10pm UTC](https://discuss.elastic.co/t/ingest-node-pipeline-with-id-x-does-not-exist-solved/54436 "2020-12-22T20:10:32Z")
SOLVED Just minutes before the release of 5.0.0-alpha4 I found this bug. I tried it in \`5.0.0-alpha4' and it works fine. That's nice. But it still feels like I have lost some time... :weary: I'm using elasticsearch-5.… --- ## [Searching then sorting in a multi-indices search](https://discuss.elastic.co/t/searching-then-sorting-in-a-multi-indices-search/259419)
**Author:** [@Chris\_Grim](https://discuss.elastic.co/u/Chris_Grim)\ **Replies:** 0\ **Last updated:** [December 22, 2020, 6:31pm UTC](https://discuss.elastic.co/t/searching-then-sorting-in-a-multi-indices-search/259419 "2020-12-22T18:31:08Z")
Hi, I am trying to create a general search on my site that users can start typing in a name and it will search three indices, an event, an organizer and a city list. Currently I have GET /events,city\_lists,organizers/\_… --- ## [Elasticsearch docker-entrypoint.sh script overwrite](https://discuss.elastic.co/t/elasticsearch-docker-entrypoint-sh-script-overwrite/259414)
**Author:** [@NK2812](https://discuss.elastic.co/u/NK2812)\ **Replies:** 0\ **Last updated:** [December 22, 2020, 6:07pm UTC](https://discuss.elastic.co/t/elasticsearch-docker-entrypoint-sh-script-overwrite/259414 "2020-12-22T18:07:08Z")
Hi, I need to run few commands when container starts, so I would like add those commands in docker-entrypoint.sh script. I am using Elasticsearch version 7.9.2, I tried to create the cluster without adding my custom co… --- ## [Trace http\_request problem](https://discuss.elastic.co/t/trace-http-request-problem/259410)
**Author:** [@bayucandra](https://discuss.elastic.co/u/bayucandra)\ **Replies:** 0\ **Last updated:** [December 22, 2020, 4:37pm UTC](https://discuss.elastic.co/t/trace-http-request-problem/259410 "2020-12-22T16:37:58Z")
Hi, I am an elastic cloud user with a budgeted cluster :slight\_smile: Could someone please help me, how to find out which requests to my Elastic search cluster which causing the following problem: { "statusCod… --- ## [Curl argument list too long](https://discuss.elastic.co/t/curl-argument-list-too-long/259407)
**Author:** [@Pankaj\_Jadhav](https://discuss.elastic.co/u/Pankaj_Jadhav)\ **Replies:** 0\ **Last updated:** [December 22, 2020, 4:13pm UTC](https://discuss.elastic.co/t/curl-argument-list-too-long/259407 "2020-12-22T16:13:43Z")
mapping=(\ **Author:** [@Jurilz](https://discuss.elastic.co/u/Jurilz)\ **Replies:** 1\ **Last updated:** [December 22, 2020, 3:18pm UTC](https://discuss.elastic.co/t/data-stream-has-empty-index/259292 "2020-12-22T15:18:06Z") Good day, I'm currently trying to configure and use lifecycle policies for my indices and was following this instruction (https://www.elastic.co/guide/en/elasticsearch/reference/current/set-up-lifecycle-policy.html). A… --- ## [Problem creating a template 7.5](https://discuss.elastic.co/t/problem-creating-a-template-7-5/259397)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 2\ **Last updated:** [December 22, 2020, 3:00pm UTC](https://discuss.elastic.co/t/problem-creating-a-template-7-5/259397 "2020-12-22T15:00:54Z")
Hi, when I try to create an index template I get this error, I have checked multiple times and seems to be all ok. { "error": { "root\_cause": \[ { "type": "parse\_exception", "reason": "unknown… --- ## [Index template](https://discuss.elastic.co/t/index-template/259161)
**Author:** [@Norman\_Khine](https://discuss.elastic.co/u/Norman_Khine)\ **Replies:** 4\ **Last updated:** [December 22, 2020, 2:45pm UTC](https://discuss.elastic.co/t/index-template/259161 "2020-12-22T14:45:30Z")
Hello, i have the following template for one of my indexes: PUT \_template/template\_analytics-prod { "index\_patterns": \[ "analytics-prod-\*" \], "settings": { "number\_of\_shards": 2, "number\_of\_replicas": … --- ## [Does the .tar.gz archive include the systemd module?](https://discuss.elastic.co/t/does-the-tar-gz-archive-include-the-systemd-module/259372)
**Author:** [@JDP](https://discuss.elastic.co/u/JDP)\ **Replies:** 2\ **Last updated:** [December 22, 2020, 11:20am UTC](https://discuss.elastic.co/t/does-the-tar-gz-archive-include-the-systemd-module/259372 "2020-12-22T11:20:58Z")
Hi all, I have a working installation of Elasticsearch 7.10.1 on Debian 10.7, which was installed via the tar.gz archive into /opt/elasticseach, however I'm having trouble using systemd to control startup\\shutdown. Bec… --- ## [Search template inclusion](https://discuss.elastic.co/t/search-template-inclusion/259374)
**Author:** [@jetnet](https://discuss.elastic.co/u/jetnet)\ **Replies:** 0\ **Last updated:** [December 22, 2020, 11:15am UTC](https://discuss.elastic.co/t/search-template-inclusion/259374 "2020-12-22T11:15:15Z")
We use several search templates with the same query: { ... } section. I'm wondering, if it is possible to store that part as another template and include it in the main ones? Thanks! --- ## [Painless Script Caching Question](https://discuss.elastic.co/t/painless-script-caching-question/259361)
**Author:** [@Arthur\_Zheng](https://discuss.elastic.co/u/Arthur_Zheng)\ **Replies:** 0\ **Last updated:** [December 22, 2020, 10:14am UTC](https://discuss.elastic.co/t/painless-script-caching-question/259361 "2020-12-22T10:14:17Z")
We are using es 7.1. We have an error “Too many dynamic script compilations within”。 It can be fixed by increase some params： script.context.$CONTEXT.max\_compilations\_rate My question is ： Es 7.1 Supports a monitori… --- ## [Index health status coming as 'red\*'](https://discuss.elastic.co/t/index-health-status-coming-as-red/259049)
**Author:** [@NinjaMonkey](https://discuss.elastic.co/u/NinjaMonkey)\ **Replies:** 7\ **Last updated:** [December 22, 2020, 9:27am UTC](https://discuss.elastic.co/t/index-health-status-coming-as-red/259049 "2020-12-22T09:27:39Z")
Using ES 6.5.4 I am using NEST query that basically looks for cat indices for my client and gets health status for all the indices. The expected health statuses are green, yellow and red. However, for one of my lower e… --- ## [Integer field behaving as string](https://discuss.elastic.co/t/integer-field-behaving-as-string/259280)
**Author:** [@wissam](https://discuss.elastic.co/u/wissam)\ **Replies:** 2\ **Last updated:** [December 22, 2020, 9:08am UTC](https://discuss.elastic.co/t/integer-field-behaving-as-string/259280 "2020-12-22T09:08:33Z")
Hi, I'm facing a weird problem with field types in Elasticsearch (7.5.3). I have a field of type "integer" (explicitly mapped), but every time I try to update it via a painless script by doing ctx.\_source.myfield += 1,… --- ## [Sending metadata with external users](https://discuss.elastic.co/t/sending-metadata-with-external-users/258551)
**Author:** [@mahi2](https://discuss.elastic.co/u/mahi2)\ **Replies:** 4\ **Last updated:** [December 22, 2020, 7:53am UTC](https://discuss.elastic.co/t/sending-metadata-with-external-users/258551 "2020-12-22T07:53:17Z")
Hi, I have a scenario where the OpenID Connect users (external users) login to elastic search cloud. Is there a way to send some metadata along with the external user using an API ? To explain clearly, I've given an ex… --- ## [ElasticSearch \`Search\` Usage Metrics and total queries count](https://discuss.elastic.co/t/elasticsearch-search-usage-metrics-and-total-queries-count/259335)
**Author:** [@sb\_chat\_v1](https://discuss.elastic.co/u/sb_chat_v1)\ **Replies:** 0\ **Last updated:** [December 22, 2020, 6:28am UTC](https://discuss.elastic.co/t/elasticsearch-search-usage-metrics-and-total-queries-count/259335 "2020-12-22T06:28:20Z")
We have a use-case which requires us to maintain count of total search queries. We need to do this on an index or index-alias basis and for this we are passing in a custom stats-group (as part of the \_search request). No… --- ## [Search rejection when a shard relocation is complete](https://discuss.elastic.co/t/search-rejection-when-a-shard-relocation-is-complete/258829)
**Author:** [@wangxr1985](https://discuss.elastic.co/u/wangxr1985)\ **Replies:** 2\ **Last updated:** [December 22, 2020, 3:44am UTC](https://discuss.elastic.co/t/search-rejection-when-a-shard-relocation-is-complete/258829 "2020-12-22T03:44:22Z")
There was a rare issue when I tried to add several data nodes to my online ES cluster yesterday. When the new data nodes joined to the cluster, it began to rebalance shards to these new data nodes. Most of the shard re… --- ## [Elastic agent fleet enrollment with Nginx authentication help](https://discuss.elastic.co/t/elastic-agent-fleet-enrollment-with-nginx-authentication-help/259311)
**Author:** [@jgarcia](https://discuss.elastic.co/u/jgarcia)\ **Replies:** 6\ **Last updated:** [December 22, 2020, 1:13am UTC](https://discuss.elastic.co/t/elastic-agent-fleet-enrollment-with-nginx-authentication-help/259311 "2020-12-22T01:13:17Z")
I setup an ELK stack server along with Nginx. I am trying to make use of the Elastic Agent Fleet enrollment so that I can utilize the endpoint security and do some digging. However, I noticed that if I try to enroll an a… --- ## [Dynamically update a target index after completion of indexing (When combining two indexes)](https://discuss.elastic.co/t/dynamically-update-a-target-index-after-completion-of-indexing-when-combining-two-indexes/259290)
**Author:** [@Alfar](https://discuss.elastic.co/u/Alfar)\ **Replies:** 0\ **Last updated:** [December 21, 2020, 4:52pm UTC](https://discuss.elastic.co/t/dynamically-update-a-target-index-after-completion-of-indexing-when-combining-two-indexes/259290 "2020-12-21T16:52:11Z")
Hi, I have used enrich index (addresses) to ingest to incoming documents(customers) in order to combine both indexes(customers and addresses). The indexes have fields as below Customers : name, age, email, address\_id … --- ## [Copy Watcher Rules from Production cluster to DR cluster](https://discuss.elastic.co/t/copy-watcher-rules-from-production-cluster-to-dr-cluster/258712)
**Author:** [@jancodenew](https://discuss.elastic.co/u/jancodenew)\ **Replies:** 1\ **Last updated:** [December 21, 2020, 10:03pm UTC](https://discuss.elastic.co/t/copy-watcher-rules-from-production-cluster-to-dr-cluster/258712 "2020-12-21T22:03:52Z")
Hi, Please help me to copy the watcher rules from prod cluster to DR cluster. Thanks in advance [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=735) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=737)