# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=739 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 740 --- ## [Geo\_shape index cannot convert by avro (nifi)](https://discuss.elastic.co/t/geo-shape-index-cannot-convert-by-avro-nifi/259064)
**Author:** [@SenalChen](https://discuss.elastic.co/u/SenalChen)\ **Replies:** 2\ **Last updated:** [December 18, 2020, 10:24am UTC](https://discuss.elastic.co/t/geo-shape-index-cannot-convert-by-avro-nifi/259064 "2020-12-18T10:24:28Z")
I use json like this: \[{"scene\_id":"LC81121092020347LGN00","data\_path":112,"data\_row":109,"upper\_left\_lon":95.20724,"upper\_left\_lat":-68.44105,"upper\_right\_lon":99.64702,"upper\_right\_lat":-69.16904,"lower\_right\_lon":97.… --- ## [Query to get the last x values](https://discuss.elastic.co/t/query-to-get-the-last-x-values/259078)
**Author:** [@grra](https://discuss.elastic.co/u/grra)\ **Replies:** 0\ **Last updated:** [December 18, 2020, 10:01am UTC](https://discuss.elastic.co/t/query-to-get-the-last-x-values/259078 "2020-12-18T10:01:28Z")
Hi, Is there a way to query for the last x Values in a field? --- ## [How can we convert Splunk query into Elastic Query](https://discuss.elastic.co/t/how-can-we-convert-splunk-query-into-elastic-query/259075)
**Author:** [@Sajal](https://discuss.elastic.co/u/Sajal)\ **Replies:** 0\ **Last updated:** [December 18, 2020, 9:12am UTC](https://discuss.elastic.co/t/how-can-we-convert-splunk-query-into-elastic-query/259075 "2020-12-18T09:12:38Z")
Hi Folks, Can you please help me to convert below splunk query into elastic query ? It has single index and we need to put two time ranges on similar field(ChannelSessionId) and calculate percentage in both counts. in… --- ## [Elasticsearch SQL ORDER BY Month](https://discuss.elastic.co/t/elasticsearch-sql-order-by-month/256716)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 7\ **Last updated:** [December 18, 2020, 7:57am UTC](https://discuss.elastic.co/t/elasticsearch-sql-order-by-month/256716 "2020-12-18T07:57:10Z")
Hello, I'm almost there getting my vertical bar to work in Canvas based on a SQL query, but I'm having a hard time ordering the monthly buckets chronologically. My SQL query: SELECT COUNT(DISTINCT user.name) AS UniqueU… --- ## [What if all filter not applied ? filter with null FIELD VALUE not NULL value in DOC](https://discuss.elastic.co/t/what-if-all-filter-not-applied-filter-with-null-field-value-not-null-value-in-doc/259063)
**Author:** [@Kajal\_Pandya](https://discuss.elastic.co/u/Kajal_Pandya)\ **Replies:** 0\ **Last updated:** [December 18, 2020, 7:10am UTC](https://discuss.elastic.co/t/what-if-all-filter-not-applied-filter-with-null-field-value-not-null-value-in-doc/259063 "2020-12-18T07:10:01Z")
I have search for subjects..Teacher can add multiple subjects and students can search thode subject and can apply filter on resulted data..student can filter by LEVEL, CURRICULUM, LOCATION.. My query is what if student … --- ## [Reset Built-in users](https://discuss.elastic.co/t/reset-built-in-users/259003)
**Author:** [@Charly\_ROCH](https://discuss.elastic.co/u/Charly_ROCH)\ **Replies:** 1\ **Last updated:** [December 18, 2020, 3:57am UTC](https://discuss.elastic.co/t/reset-built-in-users/259003 "2020-12-18T03:57:34Z")
I am building elasticsearch cluster with SSL following this tutorial : My first node is a debian with elastic running as a service. I ran the command : bin/elasticsearch-setup-passwords auto But when listing users w… --- ## [Effective Way to Remove Existing Duplicate Documents in ElasticSearch](https://discuss.elastic.co/t/effective-way-to-remove-existing-duplicate-documents-in-elasticsearch/258798)
**Author:** [@test\_tester](https://discuss.elastic.co/u/test_tester)\ **Replies:** 11\ **Last updated:** [December 17, 2020, 11:31pm UTC](https://discuss.elastic.co/t/effective-way-to-remove-existing-duplicate-documents-in-elasticsearch/258798 "2020-12-17T23:31:15Z")
Hi Everyone, Using aggregation, I am able query out doc\_count: 272152 of duplicates instances in my elasticsearch database. The problem now is if I were to simply run a \_delete\_by\_query, it will delete everything inclu… --- ## [Ingested Pipelines](https://discuss.elastic.co/t/ingested-pipelines/259037)
**Author:** [@Cosmin\_Ciobanu1](https://discuss.elastic.co/u/Cosmin_Ciobanu1)\ **Replies:** 15\ **Last updated:** [December 17, 2020, 10:47pm UTC](https://discuss.elastic.co/t/ingested-pipelines/259037 "2020-12-17T22:47:57Z")
Hi! I've updated Elastic Stack and now I have an error and I don't know how to manage it. Before I was using ingested pipelines and everything was just fine and now when I want to use them again I get this error Cause… --- ## [Master node not discovered yet after upgrade from 6.8 to 7.10](https://discuss.elastic.co/t/master-node-not-discovered-yet-after-upgrade-from-6-8-to-7-10/258915)
**Author:** [@David\_Tomasheski](https://discuss.elastic.co/u/David_Tomasheski)\ **Replies:** 1\ **Last updated:** [December 17, 2020, 8:01pm UTC](https://discuss.elastic.co/t/master-node-not-discovered-yet-after-upgrade-from-6-8-to-7-10/258915 "2020-12-17T20:01:28Z")
In order to deal with the Chrome Samesite cookies issue I have just upgraded ES and Kibana from 6.7 to 6.8 and that went fine. I then went to upgrade ES to 7.10 and now I am getting The below error message. I had followe… --- ## [Using ILM for Timeseries Data with a Static Write Index](https://discuss.elastic.co/t/using-ilm-for-timeseries-data-with-a-static-write-index/259023)
**Author:** [@Karl\_Falconer](https://discuss.elastic.co/u/Karl_Falconer)\ **Replies:** 1\ **Last updated:** [December 17, 2020, 7:27pm UTC](https://discuss.elastic.co/t/using-ilm-for-timeseries-data-with-a-static-write-index/259023 "2020-12-17T19:27:43Z")
We are using a Ruby wrapper library called Searchkick which provides great functionality for searching within our application environment. However it is not great with managing Timeseries data. Our objective is to be ab… --- ## [Filtering Nested Child Objects](https://discuss.elastic.co/t/filtering-nested-child-objects/258791)
**Author:** [@mgncl](https://discuss.elastic.co/u/mgncl)\ **Replies:** 5\ **Last updated:** [December 17, 2020, 7:16pm UTC](https://discuss.elastic.co/t/filtering-nested-child-objects/258791 "2020-12-17T19:16:21Z")
I am trying to fine tune the query on a nested collection. The nested collection should match all the criteria and the size of the collection. I created a sample data set to the mimic my use case. Index { "map… --- ## [Snapsot Deletion Times Out](https://discuss.elastic.co/t/snapsot-deletion-times-out/259029)
**Author:** [@pooja\_shukla](https://discuss.elastic.co/u/pooja_shukla)\ **Replies:** 0\ **Last updated:** [December 17, 2020, 6:58pm UTC](https://discuss.elastic.co/t/snapsot-deletion-times-out/259029 "2020-12-17T18:58:10Z")
1) Snapshot deletion is timing out using elasticsearch python client client.snapshot.delete(repository="repo\_name", snapshot="snapshot\_name") 2) We are using curator to delete old snapshot beyond a certain date, curato… --- ## [How to config hot-warm arch in elasticsearch 7.9.1](https://discuss.elastic.co/t/how-to-config-hot-warm-arch-in-elasticsearch-7-9-1/258904)
**Author:** [@hiruni.insyncit.net](https://discuss.elastic.co/u/hiruni.insyncit.net)\ **Replies:** 4\ **Last updated:** [December 17, 2020, 6:52pm UTC](https://discuss.elastic.co/t/how-to-config-hot-warm-arch-in-elasticsearch-7-9-1/258904 "2020-12-17T18:52:20Z")
Configurations of hot-warm arch in elasticsearch is only changing elasticsearch.yml? --- ## [Internals of array of strings vs. concatenated string](https://discuss.elastic.co/t/internals-of-array-of-strings-vs-concatenated-string/257640)
**Author:** [@mitar](https://discuss.elastic.co/u/mitar)\ **Replies:** 1\ **Last updated:** [December 17, 2020, 5:59pm UTC](https://discuss.elastic.co/t/internals-of-array-of-strings-vs-concatenated-string/257640 "2020-12-17T17:59:42Z")
I am trying to better understand internals of ElasticSearch, so I would like to know if there are any differences in how ElasticSearch internally computes term statistics for the following two cases. The first case is w… --- ## [Populate geo\_shape values with ingest pipeline using lat/lon column values](https://discuss.elastic.co/t/populate-geo-shape-values-with-ingest-pipeline-using-lat-lon-column-values/258998)
**Author:** [@vmanohar1](https://discuss.elastic.co/u/vmanohar1)\ **Replies:** 1\ **Last updated:** [December 17, 2020, 4:51pm UTC](https://discuss.elastic.co/t/populate-geo-shape-values-with-ingest-pipeline-using-lat-lon-column-values/258998 "2020-12-17T16:51:34Z")
If input data has lat/lon columns, is it possible to populate geo\_shape value using lat/long columns with ingest pipeline? Imagine original index has only lat/lon column mappings and data is populated. Now using reind… --- ## [Elastic-Agent deb package invalid init script](https://discuss.elastic.co/t/elastic-agent-deb-package-invalid-init-script/258994)
**Author:** [@matt\_t1](https://discuss.elastic.co/u/matt_t1)\ **Replies:** 2\ **Last updated:** [December 17, 2020, 3:56pm UTC](https://discuss.elastic.co/t/elastic-agent-deb-package-invalid-init-script/258994 "2020-12-17T15:56:57Z")
The deb package for elastic-agent v7.10.1 creates /etc/init.d/elastic-agent which is not a valid init script and interferes with the proper systemd unit at /lib/systemd/system/elastic-agent.service. --- ## [Fleet AWS Integration Error - API keys not configured for metricbeat](https://discuss.elastic.co/t/fleet-aws-integration-error-api-keys-not-configured-for-metricbeat/258992)
**Author:** [@matt\_t1](https://discuss.elastic.co/u/matt_t1)\ **Replies:** 1\ **Last updated:** [December 17, 2020, 2:39pm UTC](https://discuss.elastic.co/t/fleet-aws-integration-error-api-keys-not-configured-for-metricbeat/258992 "2020-12-17T14:39:14Z")
AWS integration version 0.3.12 allows Access and Secret keys to be specified, both for log and metric ingestion. This works for logs, but for metrics the values are not propagated to elastic-agent.yml. Configuring a sh… --- ## [Changing UTC to local time zone in a machine learning watcher](https://discuss.elastic.co/t/changing-utc-to-local-time-zone-in-a-machine-learning-watcher/258911)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 2\ **Last updated:** [December 17, 2020, 1:52pm UTC](https://discuss.elastic.co/t/changing-utc-to-local-time-zone-in-a-machine-learning-watcher/258911 "2020-12-17T13:52:40Z")
Im trying to get the time of the alert to local time, but when I add the transform to the watcher I get the mail and the date, but the results are gone, it seems that the transform alters the entire result, what can I do… --- ## [ELS Watcher script free disc space](https://discuss.elastic.co/t/els-watcher-script-free-disc-space/258997)
**Author:** [@vaclav1](https://discuss.elastic.co/u/vaclav1)\ **Replies:** 0\ **Last updated:** [December 17, 2020, 1:12pm UTC](https://discuss.elastic.co/t/els-watcher-script-free-disc-space/258997 "2020-12-17T13:12:32Z")
Dear team, we have used a script from the els repository to set up a watcher for free disc space ratio, unfortunately script execution ends with errors but watcher interface show all is ok, we got an NPE: "script\_stack… --- ## [Relationship between hot-warm arch and node roles](https://discuss.elastic.co/t/relationship-between-hot-warm-arch-and-node-roles/258977)
**Author:** [@hiruni.insyncit.net](https://discuss.elastic.co/u/hiruni.insyncit.net)\ **Replies:** 4\ **Last updated:** [December 17, 2020, 12:18pm UTC](https://discuss.elastic.co/t/relationship-between-hot-warm-arch-and-node-roles/258977 "2020-12-17T12:18:33Z")
when a node config as a hot node, then what should be the node role such as master, ingest, data? also when a node is warm what should be the node role? what is the relationship? between hot-warm arch and node roles? T… --- ## [Underlying file changed by an external force](https://discuss.elastic.co/t/underlying-file-changed-by-an-external-force/258648)
**Author:** [@sandeepkanabar](https://discuss.elastic.co/u/sandeepkanabar)\ **Replies:** 2\ **Last updated:** [December 17, 2020, 12:13pm UTC](https://discuss.elastic.co/t/underlying-file-changed-by-an-external-force/258648 "2020-12-17T12:13:10Z")
Hi Team, Of late, I've started seeing these errors in ES 6.8.6 cluster. I have this cluster since March but these errors started appearing only recently: \[2020-12-14T00:00:04,122\]\[WARN \]\[o.e.c.r.a.AllocationService\] \[n… --- ## [Geo\_shape, geo\_point - Can they be added on the fly?](https://discuss.elastic.co/t/geo-shape-geo-point-can-they-be-added-on-the-fly/258910)
**Author:** [@vmanohar1](https://discuss.elastic.co/u/vmanohar1)\ **Replies:** 2\ **Last updated:** [December 17, 2020, 11:32am UTC](https://discuss.elastic.co/t/geo-shape-geo-point-can-they-be-added-on-the-fly/258910 "2020-12-17T11:32:54Z")
If the original index has just lat/lon values, is it possible to create additional columns of type geo\_shape and geo\_point using values from lat/lon column in the elastic query itself? I am curious to know.. Thanks. --- ## [Kibana is not allowing to select data of more than 35 days, for Predictions using Machine Learning](https://discuss.elastic.co/t/kibana-is-not-allowing-to-select-data-of-more-than-35-days-for-predictions-using-machine-learning/258951)
**Author:** [@mohammadawaisjavaid](https://discuss.elastic.co/u/mohammadawaisjavaid)\ **Replies:** 1\ **Last updated:** [December 17, 2020, 11:11am UTC](https://discuss.elastic.co/t/kibana-is-not-allowing-to-select-data-of-more-than-35-days-for-predictions-using-machine-learning/258951 "2020-12-17T11:11:29Z")
Hello all whenever I select more than 35 days of data in Machine Learning feature for the predictions then it is not allowing me to do this? I want to ask that why is this so? Is this the restriction of ML model of Kiban… --- ## [Searching Document (NEST) with Selecting fields to return](https://discuss.elastic.co/t/searching-document-nest-with-selecting-fields-to-return/258967)
**Author:** [@mohannad](https://discuss.elastic.co/u/mohannad)\ **Replies:** 0\ **Last updated:** [December 17, 2020, 9:05am UTC](https://discuss.elastic.co/t/searching-document-nest-with-selecting-fields-to-return/258967 "2020-12-17T09:05:43Z")
Hi, I am quite new in Elasticsearch and I have some questions. The case is "FS-Crawler" is used with Elastic to index a group of documents. I am trying to search (using NEST) the content of the documents with filtration… --- ## [Snapshot & Restore on Windows can not access directory](https://discuss.elastic.co/t/snapshot-restore-on-windows-can-not-access-directory/257472)
**Author:** [@azeiner](https://discuss.elastic.co/u/azeiner)\ **Replies:** 3\ **Last updated:** [December 17, 2020, 8:04am UTC](https://discuss.elastic.co/t/snapshot-restore-on-windows-can-not-access-directory/257472 "2020-12-17T08:04:23Z")
We've got a 3 Node Elastic Cluster on Windows 10 (Customer Request) and i would like to configure the snapshot restore ability for the cluster. What i've done is to create a share on one of the Node (seperate Harddisk),… --- ## [Would ES reindex API ignore all updates post reindex is triggered](https://discuss.elastic.co/t/would-es-reindex-api-ignore-all-updates-post-reindex-is-triggered/258948)
**Author:** [@the123saurav](https://discuss.elastic.co/u/the123saurav)\ **Replies:** 3\ **Last updated:** [December 17, 2020, 7:32am UTC](https://discuss.elastic.co/t/would-es-reindex-api-ignore-all-updates-post-reindex-is-triggered/258948 "2020-12-17T07:32:49Z")
I read that ES' reindex API works by taking a snapshot of the source index. So let's say i triggered reindexing at T0 and this finished at T2. So if say any create/update/delete came for any document at T1 (T0 \< T1 \< T… --- ## [Does close index free up disk or memory](https://discuss.elastic.co/t/does-close-index-free-up-disk-or-memory/258868)
**Author:** [@divya\_lakshmi](https://discuss.elastic.co/u/divya_lakshmi)\ **Replies:** 2\ **Last updated:** [December 17, 2020, 6:40am UTC](https://discuss.elastic.co/t/does-close-index-free-up-disk-or-memory/258868 "2020-12-17T06:40:14Z")
Hi, I am using elasticsearch6.5 as single node, using 8GB of JVM and just 3% of memory is free. Will closing index using close API help to free heap memory .please tell what are the advantages of close index --- ## [Understanding RestClient.java and its use of DEFAULT\_MAX\_CONN\_TOTAL](https://discuss.elastic.co/t/understanding-restclient-java-and-its-use-of-default-max-conn-total/258583)
**Author:** [@bdbusches](https://discuss.elastic.co/u/bdbusches)\ **Replies:** 4\ **Last updated:** [December 17, 2020, 6:07am UTC](https://discuss.elastic.co/t/understanding-restclient-java-and-its-use-of-default-max-conn-total/258583 "2020-12-17T06:07:13Z")
We're having difficulty with RestClient against a large 700 node ES cluster. Under a moderate search load (47 concurrent searches) we see extensive use of I/O Dispatchers (based on the default I/O Recator configs in th… --- ## [Mapping fields xxx cannot be replaced during template composition](https://discuss.elastic.co/t/mapping-fields-xxx-cannot-be-replaced-during-template-composition/258938)
**Author:** [@amingo123](https://discuss.elastic.co/u/amingo123)\ **Replies:** 0\ **Last updated:** [December 17, 2020, 2:44am UTC](https://discuss.elastic.co/t/mapping-fields-xxx-cannot-be-replaced-during-template-composition/258938 "2020-12-17T02:44:06Z")
When i try to create new index as below, PUT /message202010 { "mappings": { "properties": { "CrashStatus": { "type": "keyword"}}}} i got the error message: { "error" : { "root\_cause" : \[ { "type" : "illegal\_a… --- ## [Watcher upgrade API run required (7.10)](https://discuss.elastic.co/t/watcher-upgrade-api-run-required-7-10/256751)
**Author:** [@mutt13y](https://discuss.elastic.co/u/mutt13y)\ **Replies:** 5\ **Last updated:** [December 16, 2020, 8:30pm UTC](https://discuss.elastic.co/t/watcher-upgrade-api-run-required-7-10/256751 "2020-12-16T20:30:45Z")
Hi I have not starting watcher, upgrade API run required: .watches\[false\] in my logs on 7.10 This Implies that the issue occurs between 5x and 6x but this cluster was built this year and has never been 5x or 6x ho… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=738) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=740)