# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=737 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 738 --- ## [Bool Queries - Filtering double negatives](https://discuss.elastic.co/t/bool-queries-filtering-double-negatives/258217)
**Author:** [@Stephen\_Kneubuehl](https://discuss.elastic.co/u/Stephen_Kneubuehl)\ **Replies:** 1\ **Last updated:** [December 21, 2020, 9:51pm UTC](https://discuss.elastic.co/t/bool-queries-filtering-double-negatives/258217 "2020-12-21T21:51:01Z")
Hey everyone, I need help with query syntax! I'm trying to build a compound bool query that filters out documents that do not match a certain criteria, essentially a double negative. I want to return relevant events f… --- ## [Make Elastic Stack listen on localhost AND external IPs?](https://discuss.elastic.co/t/make-elastic-stack-listen-on-localhost-and-external-ips/259275)
**Author:** [@riahc3](https://discuss.elastic.co/u/riahc3)\ **Replies:** 3\ **Last updated:** [December 21, 2020, 9:47pm UTC](https://discuss.elastic.co/t/make-elastic-stack-listen-on-localhost-and-external-ips/259275 "2020-12-21T21:47:37Z")
Hello I want to able to make my Elastic Stack (Elasticsearch, Logstash, Kibana, and Beats) all listen on the localhost AND on the external IP (or at least bind it to a IP) All I see is creating a reverse proxy with Ngi… --- ## [Datastream does not rollover properly](https://discuss.elastic.co/t/datastream-does-not-rollover-properly/259295)
**Author:** [@Russell\_Fulton](https://discuss.elastic.co/u/Russell_Fulton)\ **Replies:** 3\ **Last updated:** [December 21, 2020, 7:37pm UTC](https://discuss.elastic.co/t/datastream-does-not-rollover-properly/259295 "2020-12-21T19:37:43Z")
I have a data stream that I am writing to and which has reached its rollover point -- current actions says rollover but there is no 000002 index. Time given for the rollover is 8 hours ago: definition: { "policy"… --- ## [Magento 2.3.5 p1 - Elastic Search 7.7. /var/www/html/vendor/elasticsearch/elasticsearch/src/Elasticsearch/Connections/Connection.php:632)](https://discuss.elastic.co/t/magento-2-3-5-p1-elastic-search-7-7-var-www-html-vendor-elasticsearch-elasticsearch-src-elasticsearch-connections-connection-php-632/259182)
**Author:** [@danielJ](https://discuss.elastic.co/u/danielJ)\ **Replies:** 2\ **Last updated:** [December 21, 2020, 5:37pm UTC](https://discuss.elastic.co/t/magento-2-3-5-p1-elastic-search-7-7-var-www-html-vendor-elasticsearch-elasticsearch-src-elasticsearch-connections-connection-php-632/259182 "2020-12-21T17:37:07Z")
Hello Team, I am using Magento 2.3.5p1 using mysql on an AWS EC2 instance with installed Elasticsearch version 7.7. I get the test successful but on the front end the search does not work with there's no item matching y… --- ## [How to know the time when elasticsearch indexed the data](https://discuss.elastic.co/t/how-to-know-the-time-when-elasticsearch-indexed-the-data/258603)
**Author:** [@soufian.eldouqe](https://discuss.elastic.co/u/soufian.eldouqe)\ **Replies:** 9\ **Last updated:** [December 21, 2020, 5:31pm UTC](https://discuss.elastic.co/t/how-to-know-the-time-when-elasticsearch-indexed-the-data/258603 "2020-12-21T17:31:15Z")
Hello, is there any way to know the time that elasticsearch indexed the data ? in others words, when did the index received de data. Thank you --- ## [Elasticsearch returns documents with score 0.0](https://discuss.elastic.co/t/elasticsearch-returns-documents-with-score-0-0/259289)
**Author:** [@haitran](https://discuss.elastic.co/u/haitran)\ **Replies:** 0\ **Last updated:** [December 21, 2020, 4:40pm UTC](https://discuss.elastic.co/t/elasticsearch-returns-documents-with-score-0-0/259289 "2020-12-21T16:40:29Z")
Please help me to understand the scoring logic. Configuration: PUT /my-index-000001 { "mappings": { "dynamic": "false", "properties": { "test": { "type": "text", "fields": { "\_… --- ## [Aggregate by multiple fields and Top 10 count in ElasticSearcch](https://discuss.elastic.co/t/aggregate-by-multiple-fields-and-top-10-count-in-elasticsearcch/259286)
**Author:** [@Prabhu.292](https://discuss.elastic.co/u/Prabhu.292)\ **Replies:** 0\ **Last updated:** [December 21, 2020, 4:33pm UTC](https://discuss.elastic.co/t/aggregate-by-multiple-fields-and-top-10-count-in-elasticsearcch/259286 "2020-12-21T16:33:12Z")
Dear Team, I have query like this GET logstash-sdc-questionrecords/\_search?q=source:website\_portal { "aggs" : { "genres" : { "terms" : { "field" : "question.keyword", "order" : { "\_count" : "desc" }, "size": 10 … --- ## [Test Dependency on elasticsearch-test.jar for plugins](https://discuss.elastic.co/t/test-dependency-on-elasticsearch-test-jar-for-plugins/259283)
**Author:** [@Bukhtawar\_Khan](https://discuss.elastic.co/u/Bukhtawar_Khan)\ **Replies:** 0\ **Last updated:** [December 21, 2020, 4:03pm UTC](https://discuss.elastic.co/t/test-dependency-on-elasticsearch-test-jar-for-plugins/259283 "2020-12-21T16:03:49Z")
Is there a way a plugin developer can leverage existing ES tests apart from elasticsearch-framework itself. --- ## [Elasticsearch sizing for Production POC](https://discuss.elastic.co/t/elasticsearch-sizing-for-production-poc/259268)
**Author:** [@Abdelhalim](https://discuss.elastic.co/u/Abdelhalim)\ **Replies:** 0\ **Last updated:** [December 21, 2020, 2:12pm UTC](https://discuss.elastic.co/t/elasticsearch-sizing-for-production-poc/259268 "2020-12-21T14:12:12Z")
Hello everybody, It's the first time that I am going to run a cluster for a production POC and I need some help in the way that I size my machines. Knowing that I am going to have like 15Go of data per day, and knowing… --- ## [Elasticsearch transform role backward compatibility](https://discuss.elastic.co/t/elasticsearch-transform-role-backward-compatibility/259254)
**Author:** [@Mohammad\_Mousavi](https://discuss.elastic.co/u/Mohammad_Mousavi)\ **Replies:** 1\ **Last updated:** [December 21, 2020, 1:36pm UTC](https://discuss.elastic.co/t/elasticsearch-transform-role-backward-compatibility/259254 "2020-12-21T13:36:16Z")
Hi, I have a 3 nodes elasticsearch cluster with 7.4.2 version. It's look like this version does not support "transform role". I see in elasticsearch version 7.10.1 logs that a module called "transform" is loaded in star… --- ## [Watcher Acked automatic](https://discuss.elastic.co/t/watcher-acked-automatic/259253)
**Author:** [@Juan\_David\_Jaramillo](https://discuss.elastic.co/u/Juan_David_Jaramillo)\ **Replies:** 0\ **Last updated:** [December 21, 2020, 12:56pm UTC](https://discuss.elastic.co/t/watcher-acked-automatic/259253 "2020-12-21T12:56:26Z")
Hi, guys I'd like to know if it's possible to make a watcher where I send a HTTP request and execute the API REST: POST, every time another alert is activated in 'firing'? make like an 'automatic acked' since inside it … --- ## [Elasticsearch Python Cache](https://discuss.elastic.co/t/elasticsearch-python-cache/259246)
**Author:** [@satyamsinghal575](https://discuss.elastic.co/u/satyamsinghal575)\ **Replies:** 0\ **Last updated:** [December 21, 2020, 11:52am UTC](https://discuss.elastic.co/t/elasticsearch-python-cache/259246 "2020-12-21T11:52:05Z")
I am using elasticsearch primarily for aggregations, then eventually i came across setting the query size to zero, according to my understanding this helps in two ways : payload size is reduced and when we use query in… --- ## [\[OPENDISTRO - Elasticsearch\] Machine learning JOB System Requirements](https://discuss.elastic.co/t/opendistro-elasticsearch-machine-learning-job-system-requirements/259239)
**Author:** [@Flavio1](https://discuss.elastic.co/u/Flavio1)\ **Replies:** 1\ **Last updated:** [December 21, 2020, 11:14am UTC](https://discuss.elastic.co/t/opendistro-elasticsearch-machine-learning-job-system-requirements/259239 "2020-12-21T11:14:05Z")
Hi everybody, Is there any document or table with system requirements to implement elasticsearch opendistro machine learning jobs? Any help will be appreciated. --- ## [Search content in English and resultset returns in other languages](https://discuss.elastic.co/t/search-content-in-english-and-resultset-returns-in-other-languages/259070)
**Author:** [@Antonio\_Teixeira](https://discuss.elastic.co/u/Antonio_Teixeira)\ **Replies:** 2\ **Last updated:** [December 21, 2020, 10:26am UTC](https://discuss.elastic.co/t/search-content-in-english-and-resultset-returns-in-other-languages/259070 "2020-12-21T10:26:27Z")
Hello All Im trying to find the best way to receive in the resultset all the results that being made in a language plus the results in another language. For example if i search for black, i want that Elasticsearch retr… --- ## [How to Reconfigure the setup-password for the elastic cluster, as we are getting the authentication error for all the users](https://discuss.elastic.co/t/how-to-reconfigure-the-setup-password-for-the-elastic-cluster-as-we-are-getting-the-authentication-error-for-all-the-users/259219)
**Author:** [@KunwarAkanksha](https://discuss.elastic.co/u/KunwarAkanksha)\ **Replies:** 1\ **Last updated:** [December 21, 2020, 9:57am UTC](https://discuss.elastic.co/t/how-to-reconfigure-the-setup-password-for-the-elastic-cluster-as-we-are-getting-the-authentication-error-for-all-the-users/259219 "2020-12-21T09:57:57Z")
Enabling xpack.security.enabled to true alone was not enough to start the elasticsearch, as it was giving the error, so we have generated the certificates and deployed it to all the nodes of elastic cluster and kibana us… --- ## [Shard allocation based on shard size](https://discuss.elastic.co/t/shard-allocation-based-on-shard-size/257817)
**Author:** [@coudenysj](https://discuss.elastic.co/u/coudenysj)\ **Replies:** 13\ **Last updated:** [December 21, 2020, 8:38am UTC](https://discuss.elastic.co/t/shard-allocation-based-on-shard-size/257817 "2020-12-21T08:38:30Z")
Hi, I was wondering if there is an option to include shard size in the shard allocation decision process. The Disk-based shard allocation settings and the number of shards/node works, and most of or shards are 50G in s… --- ## [Snapshots - restoring an index from a large repository with long term storage (LTO ...)](https://discuss.elastic.co/t/snapshots-restoring-an-index-from-a-large-repository-with-long-term-storage-lto/259198)
**Author:** [@Rysiu](https://discuss.elastic.co/u/Rysiu)\ **Replies:** 3\ **Last updated:** [December 21, 2020, 8:18am UTC](https://discuss.elastic.co/t/snapshots-restoring-an-index-from-a-large-repository-with-long-term-storage-lto/259198 "2020-12-21T08:18:36Z")
I have a classic question about snapshots in elasticsearch. I make elasticsearch snapshots to some repository - for example, let it be some Network File System (NFS) or similar. Later this snapshot from this network st… --- ## [Restoring deleted elasticsearch indices](https://discuss.elastic.co/t/restoring-deleted-elasticsearch-indices/259017)
**Author:** [@abi.mc](https://discuss.elastic.co/u/abi.mc)\ **Replies:** 4\ **Last updated:** [December 21, 2020, 7:44am UTC](https://discuss.elastic.co/t/restoring-deleted-elasticsearch-indices/259017 "2020-12-21T07:44:20Z")
In kibana (two node cluster ) following indices got deleted from the file system and now kibana is not accessible : bxexbuIpRXqA0n4VyXiDQA - .security-7 3R2woj\_jRVCf58Q8b9--Yg - .apm-agent-configuration RGR9AneMRx6nnQGH… --- ## [Handling custom exception serialisation for plugins](https://discuss.elastic.co/t/handling-custom-exception-serialisation-for-plugins/259225)
**Author:** [@Bukhtawar\_Khan](https://discuss.elastic.co/u/Bukhtawar_Khan)\ **Replies:** 0\ **Last updated:** [December 21, 2020, 7:37am UTC](https://discuss.elastic.co/t/handling-custom-exception-serialisation-for-plugins/259225 "2020-12-21T07:37:29Z")
The wire serialization of exceptions require exceptions to be registered. For instance if the transport node(transport inter-node communication) throws a custom exception, the caller node at transport needs to handle thi… --- ## [Es update document very slow](https://discuss.elastic.co/t/es-update-document-very-slow/259072)
**Author:** [@111421](https://discuss.elastic.co/u/111421)\ **Replies:** 10\ **Last updated:** [December 21, 2020, 7:09am UTC](https://discuss.elastic.co/t/es-update-document-very-slow/259072 "2020-12-21T07:09:27Z")
Now it even takes about 7 minutes to update a doc. Single node, heap size: 8G, 30 shards, a total of 6.2G data, 2 million doc. This is too slow, if anyone can tell me how to solve it, I would appreciate it iostat Lin… --- ## [Cluster Health RED unassigned primary and replica shards](https://discuss.elastic.co/t/cluster-health-red-unassigned-primary-and-replica-shards/258891)
**Author:** [@RusseL](https://discuss.elastic.co/u/RusseL)\ **Replies:** 2\ **Last updated:** [December 21, 2020, 7:08am UTC](https://discuss.elastic.co/t/cluster-health-red-unassigned-primary-and-replica-shards/258891 "2020-12-21T07:08:54Z")
Hello to everyone, Cluster health turned red when a node fell from the cluster. When I re-add the node, some directories automatically turned from red to green, but there is an index still red and I don't know what to d… --- ## [FileBeat/Modules for SNMP Trap](https://discuss.elastic.co/t/filebeat-modules-for-snmp-trap/259214)
**Author:** [@sreekeshava\_srihari](https://discuss.elastic.co/u/sreekeshava_srihari)\ **Replies:** 0\ **Last updated:** [December 21, 2020, 5:41am UTC](https://discuss.elastic.co/t/filebeat-modules-for-snmp-trap/259214 "2020-12-21T05:41:41Z")
Hi All Does Elastic Beats/Modules provide to consume SNMP Traps so that Logstash can be avoided to consume SNMP Traps. Thanks in Advance Sreekeshava S --- ## [Is this an error in documentation of "numeric\_detection"](https://discuss.elastic.co/t/is-this-an-error-in-documentation-of-numeric-detection/258944)
**Author:** [@pk.241011](https://discuss.elastic.co/u/pk.241011)\ **Replies:** 5\ **Last updated:** [December 21, 2020, 4:50am UTC](https://discuss.elastic.co/t/is-this-an-error-in-documentation-of-numeric-detection/258944 "2020-12-21T04:50:57Z")
Hi, I was going through the documentation of Dynamic Field Mapping. In the table I see the last entry: JSON data type.......................................Elasticsearch data type string..............................… --- ## [Kibana queries time out for some directories](https://discuss.elastic.co/t/kibana-queries-time-out-for-some-directories/258684)
**Author:** [@RusseL](https://discuss.elastic.co/u/RusseL)\ **Replies:** 1\ **Last updated:** [December 21, 2020, 3:29am UTC](https://discuss.elastic.co/t/kibana-queries-time-out-for-some-directories/258684 "2020-12-21T03:29:20Z")
Kibana queries timed out for some directories. Stack Tracking is not working. I know that when I only query on one directory, the query times out. I have 12 nodes(9 data - 3 master). kibana 7.4.2 elasticsearch 7.4.2 --- ## [Getting MasterNotDiscoveredException: null in client nodes](https://discuss.elastic.co/t/getting-masternotdiscoveredexception-null-in-client-nodes/258699)
**Author:** [@nchalise](https://discuss.elastic.co/u/nchalise)\ **Replies:** 1\ **Last updated:** [December 21, 2020, 3:23am UTC](https://discuss.elastic.co/t/getting-masternotdiscoveredexception-null-in-client-nodes/258699 "2020-12-21T03:23:43Z")
We have 3 master nodes, 2 client nodes, and 8 data nodes. And client nodes ES logs show below mentioned error even though resource usage(JVM and CPU ) looks fine at that time. And cluster went unresponsive mode. ALL node… --- ## [How to store service account file into embedded ES keystore?](https://discuss.elastic.co/t/how-to-store-service-account-file-into-embedded-es-keystore/258956)
**Author:** [@balakrishnan](https://discuss.elastic.co/u/balakrishnan)\ **Replies:** 1\ **Last updated:** [December 21, 2020, 3:13am UTC](https://discuss.elastic.co/t/how-to-store-service-account-file-into-embedded-es-keystore/258956 "2020-12-21T03:13:14Z")
We are using embedded ES (version 5.6) and am exploring the snapshot & restore options with GCS as snapshot repository. The repository-gcs plugin expects that the service account JSON file must be added into the elastics… --- ## [Print Count of any particular field in watcher email body along with total Payload](https://discuss.elastic.co/t/print-count-of-any-particular-field-in-watcher-email-body-along-with-total-payload/259170)
**Author:** [@Sajal](https://discuss.elastic.co/u/Sajal)\ **Replies:** 0\ **Last updated:** [December 19, 2020, 5:04pm UTC](https://discuss.elastic.co/t/print-count-of-any-particular-field-in-watcher-email-body-along-with-total-payload/259170 "2020-12-19T17:04:19Z")
Hi Folks , I am able to get ctx.payload.hits.total in an index but i want to print count of any particular feild(like how many channel session ID occured in an index) in watcher email body. How should i get that ? Than… --- ## [Visual C++ Redistributable error](https://discuss.elastic.co/t/visual-c-redistributable-error/259210)
**Author:** [@nameisnotimportant](https://discuss.elastic.co/u/nameisnotimportant)\ **Replies:** 0\ **Last updated:** [December 21, 2020, 2:35am UTC](https://discuss.elastic.co/t/visual-c-redistributable-error/259210 "2020-12-21T02:35:46Z")
Trying to install the ODBC driver but the esodbc driver keeps asking for Visual C++ 2017 Redistributable, which, i already installed. Any idea wheat is wrong ? --- ## [How to filter and narrow the data before aggregation](https://discuss.elastic.co/t/how-to-filter-and-narrow-the-data-before-aggregation/259147)
**Author:** [@jun\_miao](https://discuss.elastic.co/u/jun_miao)\ **Replies:** 2\ **Last updated:** [December 21, 2020, 1:44am UTC](https://discuss.elastic.co/t/how-to-filter-and-narrow-the-data-before-aggregation/259147 "2020-12-21T01:44:37Z")
Hello, all I have a query which group by groupId. { "aggs":{ "result":{ "terms":{ "field":"groupId", "size": 100 } } }, "size": 0 } Because the index co… --- ## [Should we create New Index or Use the same index for all application logs(number of app ~ 5)](https://discuss.elastic.co/t/should-we-create-new-index-or-use-the-same-index-for-all-application-logs-number-of-app-5/259011)
**Author:** [@SHOAIB\_AHMED](https://discuss.elastic.co/u/SHOAIB_AHMED)\ **Replies:** 3\ **Last updated:** [December 20, 2020, 11:52pm UTC](https://discuss.elastic.co/t/should-we-create-new-index-or-use-the-same-index-for-all-application-logs-number-of-app-5/259011 "2020-12-20T23:52:13Z")
I have about 5 apps to monitor using log parsing with ELK. Does it make sense to create new index for each application log or only one index is sufficient to store all app logs. The logs for these apps would also contai… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=736) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=738)