# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=738 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 739 --- ## [Q: ILM and Beats index-template thoughts in a lab 7.10.x setup](https://discuss.elastic.co/t/q-ilm-and-beats-index-template-thoughts-in-a-lab-7-10-x-setup/259208)
**Author:** [@Andreas\_Falk](https://discuss.elastic.co/u/Andreas_Falk)\ **Replies:** 0\ **Last updated:** [December 20, 2020, 11:51pm UTC](https://discuss.elastic.co/t/q-ilm-and-beats-index-template-thoughts-in-a-lab-7-10-x-setup/259208 "2020-12-20T23:51:50Z")
Hi, We are setting up a new 7.10.1 cluster and are struggling with some ILM and beat stuff :slight\_smile: First up, when doing a simple template setup through Filebeat docker run \\ docker.elastic.co/beats/filebeat:7… --- ## [ES hadoop Spark query returns too many partitions](https://discuss.elastic.co/t/es-hadoop-spark-query-returns-too-many-partitions/259201)
**Author:** [@Greg\_Jensen](https://discuss.elastic.co/u/Greg_Jensen)\ **Replies:** 0\ **Last updated:** [December 20, 2020, 8:04pm UTC](https://discuss.elastic.co/t/es-hadoop-spark-query-returns-too-many-partitions/259201 "2020-12-20T20:04:51Z")
I have a Java Spark application that is querying 15K \_ids. The query is against an alias, that is backed by 15 or more indexes, each with ~ 9 shards. This query is taking far longer then is necessary because based on the… --- ## [CircuitBreaking Exception](https://discuss.elastic.co/t/circuitbreaking-exception/258568)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 17\ **Last updated:** [December 20, 2020, 1:21pm UTC](https://discuss.elastic.co/t/circuitbreaking-exception/258568 "2020-12-20T13:21:11Z")
I am using ELK cluster(3 master+3 data +2 coordinate) + kafka cluster.I am also using winlogbeat and packetbeat at client side.In kibana discover i saw that winlogbeat data was coming slow and packetbeat data was coming … --- ## [Term query with keyword mapping](https://discuss.elastic.co/t/term-query-with-keyword-mapping/259173)
**Author:** [@klapvee](https://discuss.elastic.co/u/klapvee)\ **Replies:** 1\ **Last updated:** [December 20, 2020, 1:17pm UTC](https://discuss.elastic.co/t/term-query-with-keyword-mapping/259173 "2020-12-20T13:17:36Z")
Hi, a very simple mappping: { "mappings": { "chat": { "properties": { "checksum": { "type": "keyword" }, "created": { "type": "date", "store": true… --- ## [IPv6 endpoint for S3 repository](https://discuss.elastic.co/t/ipv6-endpoint-for-s3-repository/259164)
**Author:** [@NominaSumpta](https://discuss.elastic.co/u/NominaSumpta)\ **Replies:** 5\ **Last updated:** [December 20, 2020, 10:17am UTC](https://discuss.elastic.co/t/ipv6-endpoint-for-s3-repository/259164 "2020-12-20T10:17:53Z")
How do I use an IPv6 endpoint for an S3 repository? Using a hostname that resolves to an IPv6 address and an IPv4 address results in: { "error": { "root\_cause": \[ { "type": "repository\_verification\_… --- ## [Cannot resolve method 'index' in 'RestClient'](https://discuss.elastic.co/t/cannot-resolve-method-index-in-restclient/259188)
**Author:** [@Murigipudi\_Revanth](https://discuss.elastic.co/u/Murigipudi_Revanth)\ **Replies:** 2\ **Last updated:** [December 20, 2020, 8:23am UTC](https://discuss.elastic.co/t/cannot-resolve-method-index-in-restclient/259188 "2020-12-20T08:23:50Z")
Hello, I'm using ElasticSearch 7.10 and trying to index a very sample document following the documentation from here - https://www.elastic.co/guide/en/elasticsearch/client/java-rest/current/java-rest-high-document-index… --- ## [High CPU Utilization](https://discuss.elastic.co/t/high-cpu-utilization/259174)
**Author:** [@Gokul6](https://discuss.elastic.co/u/Gokul6)\ **Replies:** 1\ **Last updated:** [December 20, 2020, 6:29am UTC](https://discuss.elastic.co/t/high-cpu-utilization/259174 "2020-12-20T06:29:51Z")
Hi, we have a single node cluster for elasticsearch running in elastic cloud. for the past two days the cpu utilization is 100%. what might be the issue here ?? please help :slightly\_smiling\_face: --- ## [Increased node timeouts after 7.7.0 to 7.10.1 upgrade](https://discuss.elastic.co/t/increased-node-timeouts-after-7-7-0-to-7-10-1-upgrade/258888)
**Author:** [@Aharon](https://discuss.elastic.co/u/Aharon)\ **Replies:** 2\ **Last updated:** [December 19, 2020, 7:58pm UTC](https://discuss.elastic.co/t/increased-node-timeouts-after-7-7-0-to-7-10-1-upgrade/258888 "2020-12-19T19:58:52Z")
We have a largish production cluster that is experiencing a high number of node timeouts (on our hot indexing nodes) since we upgraded to 7.10.1 (from 7.7.0). Prior to the upgrade, we did not experience these timeouts. O… --- ## [Elastic search is not working into ubuntu 18.04](https://discuss.elastic.co/t/elastic-search-is-not-working-into-ubuntu-18-04/259169)
**Author:** [@Balwinder\_Singh](https://discuss.elastic.co/u/Balwinder_Singh)\ **Replies:** 1\ **Last updated:** [December 19, 2020, 7:16pm UTC](https://discuss.elastic.co/t/elastic-search-is-not-working-into-ubuntu-18-04/259169 "2020-12-19T19:16:21Z")
Dear All, Please help me to sort out below mention problem. Dec 17 21:05:14 zammad091212020-Virtual-Machine systemd\[1\]: Starting Elasticsearch... Dec 17 21:06:29 zammad091212020-Virtual-Machine systemd\[1\]: elasticsear… --- ## [Missing fields in Kibana](https://discuss.elastic.co/t/missing-fields-in-kibana/256519)
**Author:** [@Atul\_Chadha](https://discuss.elastic.co/u/Atul_Chadha)\ **Replies:** 1\ **Last updated:** [December 19, 2020, 11:16am UTC](https://discuss.elastic.co/t/missing-fields-in-kibana/256519 "2020-12-19T11:16:40Z")
OS : Centos 7.4, ELK Version: 7.6.2 I am trying to count how many hosts are configured in the ELK stack and for some reason beat.hostname.keyword is not pulling any data. If i use the default metric without any other f… --- ## [Query to search multiple values in a single field with wildcard startswith condition](https://discuss.elastic.co/t/query-to-search-multiple-values-in-a-single-field-with-wildcard-startswith-condition/259155)
**Author:** [@subham\_p](https://discuss.elastic.co/u/subham_p)\ **Replies:** 0\ **Last updated:** [December 19, 2020, 9:52am UTC](https://discuss.elastic.co/t/query-to-search-multiple-values-in-a-single-field-with-wildcard-startswith-condition/259155 "2020-12-19T09:52:50Z")
Diseases: “fever, headache, cold cough” Diseases:” fever, infection” Diseases:” fever,covid\_19” I want to find out the (diseases:” fever,covid\_19”) with in a must with wildcard condition starts with. I have tried wit… --- ## [Host.os is missing in generated template when host is expected in a custom schema using ECS Tooling 1.6 and 1.7](https://discuss.elastic.co/t/host-os-is-missing-in-generated-template-when-host-is-expected-in-a-custom-schema-using-ecs-tooling-1-6-and-1-7/258786)
**Author:** [@mxu](https://discuss.elastic.co/u/mxu)\ **Replies:** 4\ **Last updated:** [December 18, 2020, 11:46pm UTC](https://discuss.elastic.co/t/host-os-is-missing-in-generated-template-when-host-is-expected-in-a-custom-schema-using-ecs-tooling-1-6-and-1-7/258786 "2020-12-18T23:46:18Z")
Hi, I am using ECS Tooling (1.6 and 1.7) to generate template, adding "host" to a custom schema "Link". Added host.yml as following. In the resulted template.json, while host.geo exists, host.os is missing. After I c… --- ## [How to delete documents older than 10 days - cant use daily indices](https://discuss.elastic.co/t/how-to-delete-documents-older-than-10-days-cant-use-daily-indices/259119)
**Author:** [@Jana\_P](https://discuss.elastic.co/u/Jana_P)\ **Replies:** 6\ **Last updated:** [December 18, 2020, 11:13pm UTC](https://discuss.elastic.co/t/how-to-delete-documents-older-than-10-days-cant-use-daily-indices/259119 "2020-12-18T23:13:14Z")
Hello, I'm trying to figure out how to delete documents older than 10 days. It sounds simple (curator etc.) - but my situation is quite complicated - I have 3 nodes cluster for DEV logs from about 30 environments. So … --- ## [Watcher not letting me pull a timestamp from a log and use it to search from there](https://discuss.elastic.co/t/watcher-not-letting-me-pull-a-timestamp-from-a-log-and-use-it-to-search-from-there/258636)
**Author:** [@cah-cborders](https://discuss.elastic.co/u/cah-cborders)\ **Replies:** 0\ **Last updated:** [December 14, 2020, 7:51pm UTC](https://discuss.elastic.co/t/watcher-not-letting-me-pull-a-timestamp-from-a-log-and-use-it-to-search-from-there/258636 "2020-12-14T19:51:20Z")
I'm trying to set up a Watcher in Kibana that will let me find an log with the message "Exit Status 1", then use the timestamp from that log to chain a new search and go back 20 logs or so from there so I can kind of cre… --- ## [Elasticsearch bucket\_script agg](https://discuss.elastic.co/t/elasticsearch-bucket-script-agg/259138)
**Author:** [@Alexkl](https://discuss.elastic.co/u/Alexkl)\ **Replies:** 0\ **Last updated:** [December 18, 2020, 8:23pm UTC](https://discuss.elastic.co/t/elasticsearch-bucket-script-agg/259138 "2020-12-18T20:23:03Z")
Hello, There is something i don't understand. I want to get a daily hit ratio calculated on the hit/miss stored in a particular field on my index. I tried to reproduce the doc example adding an extra agg. When i try … --- ## [Amazon\_s3\_exception: Access Denied Service: Amazon S3; Status Code: 403;](https://discuss.elastic.co/t/amazon-s3-exception-access-denied-service-amazon-s3-status-code-403/257267)
**Author:** [@kyle\_che](https://discuss.elastic.co/u/kyle_che)\ **Replies:** 5\ **Last updated:** [December 18, 2020, 8:11pm UTC](https://discuss.elastic.co/t/amazon-s3-exception-access-denied-service-amazon-s3-status-code-403/257267 "2020-12-18T20:11:30Z")
I have a 3 node ec2 dev cluster. I'm trying to setup a snapshot repository for elasticsearch to s3 but I'm getting the following error. AWS command line works for me but setting up through elasticsearch is not. any ide… --- ## [Search arrays with arrays](https://discuss.elastic.co/t/search-arrays-with-arrays/259132)
**Author:** [@Luca\_Frost](https://discuss.elastic.co/u/Luca_Frost)\ **Replies:** 4\ **Last updated:** [December 18, 2020, 7:07pm UTC](https://discuss.elastic.co/t/search-arrays-with-arrays/259132 "2020-12-18T19:07:32Z")
Hi all, I have an ES index where one of my mappings stores a simple array of named entities pre-set at the point of ingestion. I'm trying to search my index using a given array of entities, to return documents where co… --- ## [Index duplicate documents with the different routing id](https://discuss.elastic.co/t/index-duplicate-documents-with-the-different-routing-id/259124)
**Author:** [@Maksym1](https://discuss.elastic.co/u/Maksym1)\ **Replies:** 6\ **Last updated:** [December 18, 2020, 5:46pm UTC](https://discuss.elastic.co/t/index-duplicate-documents-with-the-different-routing-id/259124 "2020-12-18T17:46:22Z")
When I try to index two similar documents (in my case, these are customers) with the same id and a different routing id, I get the first document is created, but the second document is updated. As I know, I can index tw… --- ## [Dereference arrays in painless script field](https://discuss.elastic.co/t/dereference-arrays-in-painless-script-field/258382)
**Author:** [@wsalembi](https://discuss.elastic.co/u/wsalembi)\ **Replies:** 1\ **Last updated:** [December 18, 2020, 5:33pm UTC](https://discuss.elastic.co/t/dereference-arrays-in-painless-script-field/258382 "2020-12-18T17:33:30Z")
Given following document { "addresses": \[ {"city": "New York"}, {"city": "Brussels" } \] } Is it possible to dereference the first element in the array using a pain… --- ## [Own function in search template](https://discuss.elastic.co/t/own-function-in-search-template/259126)
**Author:** [@sundarcse1216](https://discuss.elastic.co/u/sundarcse1216)\ **Replies:** 0\ **Last updated:** [December 18, 2020, 4:56pm UTC](https://discuss.elastic.co/t/own-function-in-search-template/259126 "2020-12-18T16:56:59Z")
I need to write my own function inside the search template like toJson ............. "functions": \[ { "filter": { "terms": { "empId": {{#my\_own\_function}}PARAM\_VALUE{{/my\_own\_function}} } … --- ## [Elasticsearch Closing Index after removing read-only index block followed by Restart](https://discuss.elastic.co/t/elasticsearch-closing-index-after-removing-read-only-index-block-followed-by-restart/259065)
**Author:** [@dbakti7](https://discuss.elastic.co/u/dbakti7)\ **Replies:** 4\ **Last updated:** [December 18, 2020, 4:40pm UTC](https://discuss.elastic.co/t/elasticsearch-closing-index-after-removing-read-only-index-block-followed-by-restart/259065 "2020-12-18T16:40:02Z")
Hi, We are on Elasticsearch 6.0 and we need help on the following scenario: Index A is in "Open" state Elasticsearch crossed flood\_stage watermark, Index A got read-only index block Resolve flood\_stage watermark, Remo… --- ## [Viewing the docker image Dockerfiles?](https://discuss.elastic.co/t/viewing-the-docker-image-dockerfiles/259123)
**Author:** [@BigAl](https://discuss.elastic.co/u/BigAl)\ **Replies:** 0\ **Last updated:** [December 18, 2020, 4:31pm UTC](https://discuss.elastic.co/t/viewing-the-docker-image-dockerfiles/259123 "2020-12-18T16:31:27Z")
Hi, Is there a way to view the Dockerfiles that generate the docker images that we pull from elastic.co downloads. for example: https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-oss- Thanks! --- ## [Fleet AWS Integration Error - CloudTrail logs not searchable](https://discuss.elastic.co/t/fleet-aws-integration-error-cloudtrail-logs-not-searchable/258987)
**Author:** [@matt\_t1](https://discuss.elastic.co/u/matt_t1)\ **Replies:** 2\ **Last updated:** [December 18, 2020, 2:41pm UTC](https://discuss.elastic.co/t/fleet-aws-integration-error-cloudtrail-logs-not-searchable/258987 "2020-12-18T14:41:39Z")
AWS integration version 0.3.12 uses an ingestion node pipeline to set the event.ingested field to the ingestion timestamp. There is no mapping for this field in the index template so it defaults to keyword type, which b… --- ## [Painless - check if a log contains a certain field](https://discuss.elastic.co/t/painless-check-if-a-log-contains-a-certain-field/258718)
**Author:** [@yaelg](https://discuss.elastic.co/u/yaelg)\ **Replies:** 1\ **Last updated:** [December 18, 2020, 2:39pm UTC](https://discuss.elastic.co/t/painless-check-if-a-log-contains-a-certain-field/258718 "2020-12-18T14:39:55Z")
Hey everyone, I have the following fields in my logs: "module": String "audit": {"action": String, "user": String} "audit" does not appear in all logs. I wanted to create a visualization of tag-cloud which would show… --- ## [Using multi\_match from the start of fields](https://discuss.elastic.co/t/using-multi-match-from-the-start-of-fields/259110)
**Author:** [@rmbutler83](https://discuss.elastic.co/u/rmbutler83)\ **Replies:** 0\ **Last updated:** [December 18, 2020, 1:36pm UTC](https://discuss.elastic.co/t/using-multi-match-from-the-start-of-fields/259110 "2020-12-18T13:36:04Z")
Hi, I'm trying to search for drug names in my datastore, { "index": "drugs", "body": { "size": 20, "query": { "bool": { "must": \[ { "term": { "RouteOfAdmini… --- ## [Alerting and actions](https://discuss.elastic.co/t/alerting-and-actions/259109)
**Author:** [@Rafal\_Radziejewski](https://discuss.elastic.co/u/Rafal_Radziejewski)\ **Replies:** 0\ **Last updated:** [December 18, 2020, 1:33pm UTC](https://discuss.elastic.co/t/alerting-and-actions/259109 "2020-12-18T13:33:21Z")
Hello i am using version 7.9.3 of a stack i am wondering why after enabling security and setting 40 characters long key i am still unable to see alering and security tab ? Any ideas ? Regards, RR --- ## [Relational data](https://discuss.elastic.co/t/relational-data/259082)
**Author:** [@Jean-Marc\_Autexier](https://discuss.elastic.co/u/Jean-Marc_Autexier)\ **Replies:** 3\ **Last updated:** [December 18, 2020, 12:34pm UTC](https://discuss.elastic.co/t/relational-data/259082 "2020-12-18T12:34:44Z")
Hi, I think we all know the limits of elastic when having relational data.... There are things you can solve (using de-normalization, nested, parent-child, lookups) but sometimes your uses cases require query time join… --- ## [Indices per website or deleteByQuery](https://discuss.elastic.co/t/indices-per-website-or-deletebyquery/259088)
**Author:** [@adriaan](https://discuss.elastic.co/u/adriaan)\ **Replies:** 0\ **Last updated:** [December 18, 2020, 11:26am UTC](https://discuss.elastic.co/t/indices-per-website-or-deletebyquery/259088 "2020-12-18T11:26:50Z")
I have an analytics business called Simple Analytics. It's powered by Elasticsearch and it works great. We store analytics data for the websites of our customers. We give our customers to option to delete their account a… --- ## [Unsupported parameters for multi fields](https://discuss.elastic.co/t/unsupported-parameters-for-multi-fields/258423)
**Author:** [@S\_Hamdi](https://discuss.elastic.co/u/S_Hamdi)\ **Replies:** 1\ **Last updated:** [December 18, 2020, 11:24am UTC](https://discuss.elastic.co/t/unsupported-parameters-for-multi-fields/258423 "2020-12-18T11:24:23Z")
Hello, I am new to Elastic. I am getting the following error while uploading the ES index template. {"error":{"root\_cause":\[{"type":"mapper\_parsing\_exception","reason":"Mapping definition for \[path\] has unsupported pa… --- ## [Snapshot policy to include closed indices](https://discuss.elastic.co/t/snapshot-policy-to-include-closed-indices/258851)
**Author:** [@tomhe](https://discuss.elastic.co/u/tomhe)\ **Replies:** 10\ **Last updated:** [December 18, 2020, 11:00am UTC](https://discuss.elastic.co/t/snapshot-policy-to-include-closed-indices/258851 "2020-12-18T11:00:43Z")
The create snapshot API states that the default for expand\_wildcards is all, but our snapshots created through a snapshot policy does not include our closed indices. We have tried with wildcards: PUT \_slm/policy/daily-… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=737) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=739)