# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=742 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 743 --- ## [ConnectionClosedException: Connection is closed exception in secure elastic search](https://discuss.elastic.co/t/connectionclosedexception-connection-is-closed-exception-in-secure-elastic-search/258540)
**Author:** [@atulthakre](https://discuss.elastic.co/u/atulthakre)\ **Replies:** 8\ **Last updated:** [December 15, 2020, 6:55am UTC](https://discuss.elastic.co/t/connectionclosedexception-connection-is-closed-exception-in-secure-elastic-search/258540 "2020-12-15T06:55:45Z")
java-version: 1.8 elastic-version: 7.10 Ubuntu: 18.04LTS we created separate Machine for Elastic search 7.10.0 in Ubuntu.In the same machine ,we installed java1.8 and also install Kibana .we setup the security in el… --- ## [Searching local files/folders to test elastic search](https://discuss.elastic.co/t/searching-local-files-folders-to-test-elastic-search/258531)
**Author:** [@robo20](https://discuss.elastic.co/u/robo20)\ **Replies:** 4\ **Last updated:** [December 15, 2020, 4:36am UTC](https://discuss.elastic.co/t/searching-local-files-folders-to-test-elastic-search/258531 "2020-12-15T04:36:55Z")
Is there a simple way to do full text search on a bunch of files in various formats (e.g. PDF, EPUB, TXT, DOC) - on locally connected storage? I see the connectors for the cloud services, I just want to do local search. … --- ## [Elastitcsearch 7 : mapping types](https://discuss.elastic.co/t/elastitcsearch-7-mapping-types/258584)
**Author:** [@nages](https://discuss.elastic.co/u/nages)\ **Replies:** 3\ **Last updated:** [December 15, 2020, 3:55am UTC](https://discuss.elastic.co/t/elastitcsearch-7-mapping-types/258584 "2020-12-15T03:55:16Z")
I come across the following phrase and I am under impression that a valid 6.x query with type might give an error. I am using the cluster ES 7.10 Note that in 7.0, \_doc is a permanent part of the path, and represents t… --- ## [Getting unique results on highlight or multiple fields](https://discuss.elastic.co/t/getting-unique-results-on-highlight-or-multiple-fields/258650)
**Author:** [@sec\_r\_and\_d](https://discuss.elastic.co/u/sec_r_and_d)\ **Replies:** 2\ **Last updated:** [December 15, 2020, 3:41am UTC](https://discuss.elastic.co/t/getting-unique-results-on-highlight-or-multiple-fields/258650 "2020-12-15T03:41:53Z")
My indices contain various analyses of executable files. DELETE static\_index,strings\_index PUT static\_index/\_doc/1 { "md5": "85e9e2c4a9c0a7af309c906516aa4548", "static\_api": "ShellExecuteW" } PUT static\_index/\_doc/2… --- ## [How to calculate shard\_size](https://discuss.elastic.co/t/how-to-calculate-shard-size/258664)
**Author:** [@mohammad\_hanifah\_nur](https://discuss.elastic.co/u/mohammad_hanifah_nur)\ **Replies:** 4\ **Last updated:** [December 15, 2020, 2:41am UTC](https://discuss.elastic.co/t/how-to-calculate-shard-size/258664 "2020-12-15T02:41:20Z")
this issue came when i trying to find a top ten summary amount with aggregation by term variable A. variable A have a lot of unique data . that makes the result of the top ten summary amount is invalid. the first thing… --- ## [No need to set \`xpack.monitoring.collection.enabled\` to true when using metricbeat-based stack monitoring?](https://discuss.elastic.co/t/no-need-to-set-xpack-monitoring-collection-enabled-to-true-when-using-metricbeat-based-stack-monitoring/258237)
**Author:** [@tetsuyasodo](https://discuss.elastic.co/u/tetsuyasodo)\ **Replies:** 4\ **Last updated:** [December 15, 2020, 2:35am UTC](https://discuss.elastic.co/t/no-need-to-set-xpack-monitoring-collection-enabled-to-true-when-using-metricbeat-based-stack-monitoring/258237 "2020-12-15T02:35:26Z")
Reading this document, I'm testing stack monitoring using metricbeat not Legacy collection method. In this stack monitoring document, it says: 1.Enable the collection of monitoring data. Set xpack.monitoring.collec… --- ## [How to specify Default Quote Analyzer](https://discuss.elastic.co/t/how-to-specify-default-quote-analyzer/258659)
**Author:** [@jacksumit](https://discuss.elastic.co/u/jacksumit)\ **Replies:** 2\ **Last updated:** [December 15, 2020, 2:27am UTC](https://discuss.elastic.co/t/how-to-specify-default-quote-analyzer/258659 "2020-12-15T02:27:30Z")
Is there a way to specify default quote analyzer on index level? We can specify default index analyzer using analysis.analyzer.default. Similarly we can specify default search analyzer using analysis.analyzer.default\_se… --- ## [How to search for errors in logs of Elasticsearch (Cloud instance)](https://discuss.elastic.co/t/how-to-search-for-errors-in-logs-of-elasticsearch-cloud-instance/258656)
**Author:** [@pk.241011](https://discuss.elastic.co/u/pk.241011)\ **Replies:** 0\ **Last updated:** [December 15, 2020, 1:00am UTC](https://discuss.elastic.co/t/how-to-search-for-errors-in-logs-of-elasticsearch-cloud-instance/258656 "2020-12-15T01:00:27Z")
Hi, I have a cloud instance of Elasticsearch and I was intrested to see the error logs for the events which got rejected. In an in house instance the logs are availiable at the location I specify in Elasticsearch.yml, … --- ## [How can I delete all indices that don't have documents?](https://discuss.elastic.co/t/how-can-i-delete-all-indices-that-dont-have-documents/258571)
**Author:** [@mahalabobis](https://discuss.elastic.co/u/mahalabobis)\ **Replies:** 1\ **Last updated:** [December 15, 2020, 12:35am UTC](https://discuss.elastic.co/t/how-can-i-delete-all-indices-that-dont-have-documents/258571 "2020-12-15T00:35:09Z")
How can I delete all Elasticsearch that have no documents within? Also, is this safe ? I mean if an index has no documents then it's practically useless right? --- ## [Query Data in ELK](https://discuss.elastic.co/t/query-data-in-elk/258628)
**Author:** [@hassan.rana](https://discuss.elastic.co/u/hassan.rana)\ **Replies:** 4\ **Last updated:** [December 14, 2020, 11:56pm UTC](https://discuss.elastic.co/t/query-data-in-elk/258628 "2020-12-14T23:56:05Z")
I need to query messages that are sent from syslog server to logstash via filebeat . I need to curl some data out of the filebeat index. How can I write that query to get the field that what I need? Anyone? Thank you. --- ## [ES 8.0.0 Deletion with index lifecycle policy does nothing](https://discuss.elastic.co/t/es-8-0-0-deletion-with-index-lifecycle-policy-does-nothing/258346)
**Author:** [@nlavrov](https://discuss.elastic.co/u/nlavrov)\ **Replies:** 5\ **Last updated:** [December 14, 2020, 9:12pm UTC](https://discuss.elastic.co/t/es-8-0-0-deletion-with-index-lifecycle-policy-does-nothing/258346 "2020-12-14T21:12:26Z")
I am running an elk stack set up with helm chart running 8.0.0 version. I have a simple delete policy I created in the kibana dashboard that just deletes indices older than 1 minute (this is for testing). I then applied … --- ## [Indexing realtime data to elastic search](https://discuss.elastic.co/t/indexing-realtime-data-to-elastic-search/258486)
**Author:** [@pksinghal](https://discuss.elastic.co/u/pksinghal)\ **Replies:** 3\ **Last updated:** [December 14, 2020, 8:50pm UTC](https://discuss.elastic.co/t/indexing-realtime-data-to-elastic-search/258486 "2020-12-14T20:50:54Z")
Hi, I am creating a new user profiling system. I am using Elasticsearch to store user data for fast search. User profiles have various data like registration-data, comment-added-data, reply-data, etc. So whenever the … --- ## [Problems with Java and Elasticsearch: JVM flavor 'sun6' not understood](https://discuss.elastic.co/t/problems-with-java-and-elasticsearch-jvm-flavor-sun6-not-understood/258510)
**Author:** [@waynesmallman](https://discuss.elastic.co/u/waynesmallman)\ **Replies:** 1\ **Last updated:** [December 14, 2020, 7:56pm UTC](https://discuss.elastic.co/t/problems-with-java-and-elasticsearch-jvm-flavor-sun6-not-understood/258510 "2020-12-14T19:56:49Z")
Hello! I'm preparing a Raspberry Pi 4 as a development environment, and I've hit a snag having installed and configured Java. I've installed Elastic from the official documentation here on Elastic for Debian. However,… --- ## [How can i connect to cluster when master node changed?](https://discuss.elastic.co/t/how-can-i-connect-to-cluster-when-master-node-changed/258490)
**Author:** [@hamidreza\_ghadir](https://discuss.elastic.co/u/hamidreza_ghadir)\ **Replies:** 4\ **Last updated:** [December 14, 2020, 7:15pm UTC](https://discuss.elastic.co/t/how-can-i-connect-to-cluster-when-master-node-changed/258490 "2020-12-14T19:15:13Z")
Hi, I have a cluster with three nodes on docker. MasterNode: 0.0.0.0:9200, Node2: 0.0.0.0:9201, Node3: 0.0.0.0:9202 I use Nest in .NetCore Application. and i connect to cluster with http://:9200/ and this connection … --- ## [How to deal with non-auto generated ids while index](https://discuss.elastic.co/t/how-to-deal-with-non-auto-generated-ids-while-index/258626)
**Author:** [@arash\_rahimi](https://discuss.elastic.co/u/arash_rahimi)\ **Replies:** 3\ **Last updated:** [December 14, 2020, 6:56pm UTC](https://discuss.elastic.co/t/how-to-deal-with-non-auto-generated-ids-while-index/258626 "2020-12-14T18:56:55Z")
Hi, I read the elastic documents and saw there I should use auto-generated ids to speed up the search index but because of my data model & query model I cant use auto-generated ids and so after indexing a million documen… --- ## [Failed to find geo\_point field \[destination.geo.location\]](https://discuss.elastic.co/t/failed-to-find-geo-point-field-destination-geo-location/256966)
**Author:** [@secopsgeek](https://discuss.elastic.co/u/secopsgeek)\ **Replies:** 8\ **Last updated:** [December 14, 2020, 5:17pm UTC](https://discuss.elastic.co/t/failed-to-find-geo-point-field-destination-geo-location/256966 "2020-12-14T17:17:02Z")
Hello everyone, I am having some problems with geo.location showing up on that maps with errors. This is my errors" query\_shard\_exception at \`shard\` 0 \`index\` .ds-logs-windows.security-default-000001 \`node\` stUuKb8ZR4… --- ## [Elasticsearch Audit not supported, but still got entries](https://discuss.elastic.co/t/elasticsearch-audit-not-supported-but-still-got-entries/258337)
**Author:** [@djordan66](https://discuss.elastic.co/u/djordan66)\ **Replies:** 3\ **Last updated:** [December 14, 2020, 4:53pm UTC](https://discuss.elastic.co/t/elasticsearch-audit-not-supported-but-still-got-entries/258337 "2020-12-14T16:53:53Z")
We're running a cluster on Elasticsearch 7.9.3-1 We have 3 head/master nodes, 14 data nodes, and a kibana index node in the cluster. I was asked to get audit logging running on our cluster to keep an eye on users, but … --- ## [Is there a way to configure Elasticsearch for languages with 4 letters like DNA?](https://discuss.elastic.co/t/is-there-a-way-to-configure-elasticsearch-for-languages-with-4-letters-like-dna/258586)
**Author:** [@Popop\_Lldas](https://discuss.elastic.co/u/Popop_Lldas)\ **Replies:** 0\ **Last updated:** [December 14, 2020, 2:17pm UTC](https://discuss.elastic.co/t/is-there-a-way-to-configure-elasticsearch-for-languages-with-4-letters-like-dna/258586 "2020-12-14T14:17:13Z")
There was a question on this subject in 2018, but it hasn't been fully addressed yet. https://discuss.elastic.co/t/elasticsearch-for-dna-sequence-analysis The DNA is a two-bit system so I assume regualr full-text searc… --- ## [Analyzers at search/query time vs at index time](https://discuss.elastic.co/t/analyzers-at-search-query-time-vs-at-index-time/258175)
**Author:** [@John\_McAfee1](https://discuss.elastic.co/u/John_McAfee1)\ **Replies:** 3\ **Last updated:** [December 14, 2020, 3:24pm UTC](https://discuss.elastic.co/t/analyzers-at-search-query-time-vs-at-index-time/258175 "2020-12-14T15:24:50Z")
Hello! My team and I are using analyzers both at search/query and when data is indexed. After revewing the Elastic documentation and a few web searches, I have not found a conclusive answerto my questions. I have two q… --- ## [Elastic webhook output](https://discuss.elastic.co/t/elastic-webhook-output/258546)
**Author:** [@Abdelhalim](https://discuss.elastic.co/u/Abdelhalim)\ **Replies:** 2\ **Last updated:** [December 14, 2020, 3:15pm UTC](https://discuss.elastic.co/t/elastic-webhook-output/258546 "2020-12-14T15:15:53Z")
Hello, I wanna know please if the webhook in the watcher send output in a JSON format ? cause I am getting some errors in my webhook and I don't know if it's because the output is not in JSON format, or cause I didn't k… --- ## [Ideas to Normalize and join](https://discuss.elastic.co/t/ideas-to-normalize-and-join/258543)
**Author:** [@surphix](https://discuss.elastic.co/u/surphix)\ **Replies:** 2\ **Last updated:** [December 14, 2020, 2:08pm UTC](https://discuss.elastic.co/t/ideas-to-normalize-and-join/258543 "2020-12-14T14:08:43Z")
Hello everyone, I am working on a project to integrate two existing indexes (30-50M records each) into one by joining across a common field. Unfortunately as I understand Elasticsearch does not support joins like SQL. I… --- ## [Elastic cluster "Received ban for the parent \[channel closed\]", Apache Metron "listener timeout after waiting for"](https://discuss.elastic.co/t/elastic-cluster-received-ban-for-the-parent-channel-closed-apache-metron-listener-timeout-after-waiting-for/258535)
**Author:** [@ThreatInter](https://discuss.elastic.co/u/ThreatInter)\ **Replies:** 13\ **Last updated:** [December 14, 2020, 12:16pm UTC](https://discuss.elastic.co/t/elastic-cluster-received-ban-for-the-parent-channel-closed-apache-metron-listener-timeout-after-waiting-for/258535 "2020-12-14T12:16:32Z")
Hello, we using ES cluster with 3 nodes, each datanode. We faced with problem that sometimes we can't write into our cluster using Apache Metron : java.io.IOException: listener timeout after waiting for \[60000\] ms at or… --- ## [Elasticsearch Saved Search with Group By](https://discuss.elastic.co/t/elasticsearch-saved-search-with-group-by/257823)
**Author:** [@Kapila](https://discuss.elastic.co/u/Kapila)\ **Replies:** 15\ **Last updated:** [December 14, 2020, 11:47am UTC](https://discuss.elastic.co/t/elasticsearch-saved-search-with-group-by/257823 "2020-12-14T11:47:36Z")
index\_name: my\_data-2020-12-01 ticket\_number: T123 ticket\_status: OPEN ticket\_updated\_time: 2020-12-01 12:22:12 index\_name: my\_data-2020-12-01 ticket\_number: T124 ticket\_status: OPEN ticket\_updated\_time: 2020-12… --- ## [ILM Delete Phase not working](https://discuss.elastic.co/t/ilm-delete-phase-not-working/258559)
**Author:** [@Anabella\_Cristaldi](https://discuss.elastic.co/u/Anabella_Cristaldi)\ **Replies:** 4\ **Last updated:** [December 14, 2020, 10:21am UTC](https://discuss.elastic.co/t/ilm-delete-phase-not-working/258559 "2020-12-14T10:21:47Z")
Hi All, I have defined an ILM policy with hot, warm and delete phase. Hot are warm phase are working as expected, but in spite of the delete phase says "complete", the index is still there... Am I misunderstanding som… --- ## [ElasticsearchException: Concurrent modification of alias \[datastream\] during rollover](https://discuss.elastic.co/t/elasticsearchexception-concurrent-modification-of-alias-datastream-during-rollover/258547)
**Author:** [@altuhovsu](https://discuss.elastic.co/u/altuhovsu)\ **Replies:** 0\ **Last updated:** [December 14, 2020, 8:15am UTC](https://discuss.elastic.co/t/elasticsearchexception-concurrent-modification-of-alias-datastream-during-rollover/258547 "2020-12-14T08:15:20Z")
Hello. We have a datastream with ILM policy (50gb or 30 days). It works, but when rollover occurs we see some errors in a logs and some indices created! This problem occurs only with datastreams and not with simple ind… --- ## [Scan Snapshot Repository](https://discuss.elastic.co/t/scan-snapshot-repository/257511)
**Author:** [@EnriqueM](https://discuss.elastic.co/u/EnriqueM)\ **Replies:** 5\ **Last updated:** [December 14, 2020, 7:59am UTC](https://discuss.elastic.co/t/scan-snapshot-repository/257511 "2020-12-14T07:59:45Z")
Good morning. After a data corruption in a server we have the path of the Snapshots repository. When adding the repository on a new cluster, the Snapshots it contains do not appear. Is there any way to recover the inf… --- ## [How to enable SO\_KEEPALIVE with the Java HighLevel Rest client](https://discuss.elastic.co/t/how-to-enable-so-keepalive-with-the-java-highlevel-rest-client/188979)
**Author:** [@menardorama](https://discuss.elastic.co/u/menardorama)\ **Replies:** 1\ **Last updated:** [December 14, 2020, 7:05am UTC](https://discuss.elastic.co/t/how-to-enable-so-keepalive-with-the-java-highlevel-rest-client/188979 "2020-12-14T07:05:02Z")
Hi, First of all I am not a Java developper but a Sysadmin. We are hosting an java microservice application that is using Elasticsearch on a Kubernetes platform. We are facing some « Connection Reset » on the client s… --- ## [Ingest timestamp](https://discuss.elastic.co/t/ingest-timestamp/258526)
**Author:** [@hs01](https://discuss.elastic.co/u/hs01)\ **Replies:** 1\ **Last updated:** [December 14, 2020, 6:08am UTC](https://discuss.elastic.co/t/ingest-timestamp/258526 "2020-12-14T06:08:23Z")
Is it possible for ingest timestamp (introduced via ingest pipeline) to be out of order with respect to actual index time (when a document becomes queryable) i.e., doc\_1 =\> ingest\_time\_t1 doc\_2 =\> ingest\_time\_t2 ingest… --- ## [Is it possible to build elasticsearch-range-aggretaion-of-aggregation](https://discuss.elastic.co/t/is-it-possible-to-build-elasticsearch-range-aggretaion-of-aggregation/258537)
**Author:** [@Ju\_Cheng](https://discuss.elastic.co/u/Ju_Cheng)\ **Replies:** 0\ **Last updated:** [December 14, 2020, 5:34am UTC](https://discuss.elastic.co/t/is-it-possible-to-build-elasticsearch-range-aggretaion-of-aggregation/258537 "2020-12-14T05:34:42Z")
I am new to elasticsearch and my log are about users and the conferences they participate, like {"userid": "user1", "conferencesId": "c2", "action":"blabla" ... } {"userid": "user2", "conferencesId": "c2", "action":"bla… --- ## [Need help in writing DSL](https://discuss.elastic.co/t/need-help-in-writing-dsl/258451)
**Author:** [@Vikas\_Rathore](https://discuss.elastic.co/u/Vikas_Rathore)\ **Replies:** 1\ **Last updated:** [December 13, 2020, 1:47pm UTC](https://discuss.elastic.co/t/need-help-in-writing-dsl/258451 "2020-12-13T13:47:31Z")
I searched a lot but couldn't able to write a proper KQL. I am trying to search a string "error" in message field AND field kubernetes.pod.name must contain test-\* I tried this but it's not working { "size": 1, "qu… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=741) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=743)