# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=743 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 744 --- ## [Need help in writing DSL](https://discuss.elastic.co/t/need-help-in-writing-dsl/258451)
**Author:** [@Vikas\_Rathore](https://discuss.elastic.co/u/Vikas_Rathore)\ **Replies:** 1\ **Last updated:** [December 13, 2020, 1:47pm UTC](https://discuss.elastic.co/t/need-help-in-writing-dsl/258451 "2020-12-13T13:47:31Z")
I searched a lot but couldn't able to write a proper KQL. I am trying to search a string "error" in message field AND field kubernetes.pod.name must contain test-\* I tried this but it's not working { "size": 1, "qu… --- ## [Stop Words something missing](https://discuss.elastic.co/t/stop-words-something-missing/258504)
**Author:** [@ElGringo](https://discuss.elastic.co/u/ElGringo)\ **Replies:** 0\ **Last updated:** [December 13, 2020, 12:54pm UTC](https://discuss.elastic.co/t/stop-words-something-missing/258504 "2020-12-13T12:54:07Z")
Hi, I'm trying to use stop words with ELK, everything seems ok but when I'm inserting a new value the filter does not apply. Using \_analyze it works ... I think something is wrong in my mapping but I don't find what. Th… --- ## [How should I use keystore?](https://discuss.elastic.co/t/how-should-i-use-keystore/258475)
**Author:** [@Farid\_N](https://discuss.elastic.co/u/Farid_N)\ **Replies:** 3\ **Last updated:** [December 13, 2020, 9:32am UTC](https://discuss.elastic.co/t/how-should-i-use-keystore/258475 "2020-12-13T09:32:47Z")
Hi I am using a cluster and also using x-pack security for passwords and... I have also activate transfer layer security between Elasticsearch nodes and Kibana (HTTPS) My question is: How can I hide all of my passwor… --- ## [No data alert for special field](https://discuss.elastic.co/t/no-data-alert-for-special-field/255070)
**Author:** [@lstoneir](https://discuss.elastic.co/u/lstoneir)\ **Replies:** 1\ **Last updated:** [December 13, 2020, 6:41am UTC](https://discuss.elastic.co/t/no-data-alert-for-special-field/255070 "2020-12-13T06:41:48Z")
Hi every one, I have 5 machines that send logs into test index without logstash. my test index is like : { "id" : "Machine\_1", "services\_is\_ok" : true, "delta" : 60, "time" : 16… --- ## [Node joining docker](https://discuss.elastic.co/t/node-joining-docker/257742)
**Author:** [@Bonzo](https://discuss.elastic.co/u/Bonzo)\ **Replies:** 3\ **Last updated:** [December 12, 2020, 3:56pm UTC](https://discuss.elastic.co/t/node-joining-docker/257742 "2020-12-12T15:56:51Z")
Hi I have problem joining a data node to the cluster. I m using docker in 2 separate machines. Both machines can talk to each other. My first docker: -- Master docker run -d --name elastic -p 9200:9200 -p 9300:93… --- ## [Detect epoch as Date field](https://discuss.elastic.co/t/detect-epoch-as-date-field/258477)
**Author:** [@lstoneir](https://discuss.elastic.co/u/lstoneir)\ **Replies:** 1\ **Last updated:** [December 12, 2020, 3:24pm UTC](https://discuss.elastic.co/t/detect-epoch-as-date-field/258477 "2020-12-12T15:24:17Z")
Hi every one, i have an index (name: x-001) with a date field: { "time": { "type": "date" } } I insert docs into index like this: time: 1607782041000 elasticsearch automatically convert epoch to dateti… --- ## [Aggregate every field](https://discuss.elastic.co/t/aggregate-every-field/258467)
**Author:** [@5minutes](https://discuss.elastic.co/u/5minutes)\ **Replies:** 0\ **Last updated:** [December 12, 2020, 6:14am UTC](https://discuss.elastic.co/t/aggregate-every-field/258467 "2020-12-12T06:14:39Z")
hi, lets consider we have 2 records: { "@timestamp": "2020-12-11T11:13:00", "time": { "a": 200, "b": 2 } } { "@timestamp": "2020-12-11T12:13:00", "time": { … --- ## [How to avoid syntax errors when writing DSL statements](https://discuss.elastic.co/t/how-to-avoid-syntax-errors-when-writing-dsl-statements/258463)
**Author:** [@wajika](https://discuss.elastic.co/u/wajika)\ **Replies:** 0\ **Last updated:** [December 12, 2020, 3:46am UTC](https://discuss.elastic.co/t/how-to-avoid-syntax-errors-when-writing-dsl-statements/258463 "2020-12-12T03:46:23Z")
GET index/\_search { "query": { "range": { "@timestamp": { "gte": "now-1d/d", "lt": "now/d" } }, "query\_string": { "query": "\*" } } } { "error" : { "… --- ## [Restore snapshot with different index name](https://discuss.elastic.co/t/restore-snapshot-with-different-index-name/258450)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 0\ **Last updated:** [December 11, 2020, 8:26pm UTC](https://discuss.elastic.co/t/restore-snapshot-with-different-index-name/258450 "2020-12-11T20:26:38Z")
I have a snapshot and name of the index is my\_index1 I did copy whole tar ball and transfer to new cluster here I put this snpshot. Now I can see that when I do GET status I am trying to restore this index here with n… --- ## [Multi Search Elastic](https://discuss.elastic.co/t/multi-search-elastic/257196)
**Author:** [@daviddavid](https://discuss.elastic.co/u/daviddavid)\ **Replies:** 10\ **Last updated:** [December 11, 2020, 6:45pm UTC](https://discuss.elastic.co/t/multi-search-elastic/257196 "2020-12-11T18:45:29Z")
Hi, Is there any way to bring common result from two different indices with search on different fields distributed on these two indices and the fields are different and not linked to each other. --- ## [Index lifecycle error: security\_exception: action \[indices:monitor/stats\] is unauthorized for user \[template\_manager\]](https://discuss.elastic.co/t/index-lifecycle-error-security-exception-action-indices-monitor-stats-is-unauthorized-for-user-template-manager/258334)
**Author:** [@prolbrakels](https://discuss.elastic.co/u/prolbrakels)\ **Replies:** 1\ **Last updated:** [December 11, 2020, 6:06pm UTC](https://discuss.elastic.co/t/index-lifecycle-error-security-exception-action-indices-monitor-stats-is-unauthorized-for-user-template-manager/258334 "2020-12-11T18:06:07Z")
According to Kibana, the wait-for-shard-history-leases step failed when trying to delete an index due to ILM policy. The template\_manager user/role is one I recently created for the purpose of automating updates to the t… --- ## [Running two clusters in a single node](https://discuss.elastic.co/t/running-two-clusters-in-a-single-node/258301)
**Author:** [@Ondescone](https://discuss.elastic.co/u/Ondescone)\ **Replies:** 3\ **Last updated:** [December 11, 2020, 6:05pm UTC](https://discuss.elastic.co/t/running-two-clusters-in-a-single-node/258301 "2020-12-11T18:05:36Z")
Greetings, I'm trying to set up the Cross Cluster Replication locally in a single node. I have been using one elasticsearch/kibana instance running as a service (version 7.9.3) with default settings and everything works… --- ## [Filter by multiple fields in one document (one field more than other field)](https://discuss.elastic.co/t/filter-by-multiple-fields-in-one-document-one-field-more-than-other-field/258427)
**Author:** [@Delagardi1](https://discuss.elastic.co/u/Delagardi1)\ **Replies:** 1\ **Last updated:** [December 11, 2020, 5:11pm UTC](https://discuss.elastic.co/t/filter-by-multiple-fields-in-one-document-one-field-more-than-other-field/258427 "2020-12-11T17:11:10Z")
Hi! I am pretty new to elasticsearch. Is there is a way to filter my search results by comparing two values in one document? I have two fields in my document: inStock, inOtherStock and 3 filter values like: show me all… --- ## [Elasticsearch-oss-7.10.1-1.x86\_64: installation: startup issue](https://discuss.elastic.co/t/elasticsearch-oss-7-10-1-1-x86-64-installation-startup-issue/258436)
**Author:** [@vmanohar1](https://discuss.elastic.co/u/vmanohar1)\ **Replies:** 5\ **Last updated:** [December 11, 2020, 5:07pm UTC](https://discuss.elastic.co/t/elasticsearch-oss-7-10-1-1-x86-64-installation-startup-issue/258436 "2020-12-11T17:07:40Z")
When elastic instance start is attempted, I see exception as - \[2020-12-11T10:12:32,933\]\[WARN \]\[o.e.i.m.MapperService \] \[fully-qualified-host-name\] \[.kibana\_1\] \[\[.kibana\_1/9r8cU43FQlWzDMRvN-dxHA\]\] failed to apply map… --- ## [Taming ElasticSearch Field Explosion](https://discuss.elastic.co/t/taming-elasticsearch-field-explosion/258433)
**Author:** [@tjohnell](https://discuss.elastic.co/u/tjohnell)\ **Replies:** 1\ **Last updated:** [December 11, 2020, 4:41pm UTC](https://discuss.elastic.co/t/taming-elasticsearch-field-explosion/258433 "2020-12-11T16:41:39Z")
Hello all, I recently created a post on how my company, Handy, reduced the number of fields within our main ES index, and I wanted to share with the ES community. Any feedback is appreciated! Best, Tom --- ## [Error when creating email alert in Cloud](https://discuss.elastic.co/t/error-when-creating-email-alert-in-cloud/258168)
**Author:** [@mc1392](https://discuss.elastic.co/u/mc1392)\ **Replies:** 2\ **Last updated:** [December 11, 2020, 3:10pm UTC](https://discuss.elastic.co/t/error-when-creating-email-alert-in-cloud/258168 "2020-12-11T15:10:10Z")
When attempting to create an email alert I get the following error: Action failed to run The following error was found: error sending email Details: 139794888578880:error:1408F10B:SSL routines:ssl3\_get\_record:wrong ver… --- ## [Reindexing: Move mapping up a level](https://discuss.elastic.co/t/reindexing-move-mapping-up-a-level/258327)
**Author:** [@F\_Doe\_FW](https://discuss.elastic.co/u/F_Doe_FW)\ **Replies:** 2\ **Last updated:** [December 11, 2020, 2:59pm UTC](https://discuss.elastic.co/t/reindexing-move-mapping-up-a-level/258327 "2020-12-11T14:59:44Z")
Greetings! I am trying to remap an index that inadvertently had a top level 'doc' node. So, the documents were indexed like this : "\_source" : { "doc" : { "week\_starting" : "2020-05-24", … --- ## [Restore snapshot from remote fails to find snapshot](https://discuss.elastic.co/t/restore-snapshot-from-remote-fails-to-find-snapshot/258411)
**Author:** [@haarts](https://discuss.elastic.co/u/haarts)\ **Replies:** 3\ **Last updated:** [December 11, 2020, 2:19pm UTC](https://discuss.elastic.co/t/restore-snapshot-from-remote-fails-to-find-snapshot/258411 "2020-12-11T14:19:48Z")
Dear readers, I have two clusters. One I'll call 'remote', the other 'local'. I have successfully created a snapshot called 'snapshot\_1' in the repository 'my\_backup' on the remote cluster. I'm trying to follow the in… --- ## [Field value ACL](https://discuss.elastic.co/t/field-value-acl/258417)
**Author:** [@dgovergun](https://discuss.elastic.co/u/dgovergun)\ **Replies:** 0\ **Last updated:** [December 11, 2020, 1:22pm UTC](https://discuss.elastic.co/t/field-value-acl/258417 "2020-12-11T13:22:01Z")
I have a database with basic people data like name, last name, address, etc. And for those people I have a table with contact data like email, phone, cellphone, etc. I have that information indexed already. But now I ha… --- ## [Unable to access data from elastic search](https://discuss.elastic.co/t/unable-to-access-data-from-elastic-search/257258)
**Author:** [@DENMODSupport](https://discuss.elastic.co/u/DENMODSupport)\ **Replies:** 19\ **Last updated:** [December 11, 2020, 12:28pm UTC](https://discuss.elastic.co/t/unable-to-access-data-from-elastic-search/257258 "2020-12-11T12:28:19Z")
In elastic search, when checking index health link, we could see that each index is having huge amount of data as per the size. But when running api \/\_search, it is retrieving only only one alias data. We are… --- ## [Forcefully reindex more than 1000 properties](https://discuss.elastic.co/t/forcefully-reindex-more-than-1000-properties/258407)
**Author:** [@Pankaj\_Jadhav](https://discuss.elastic.co/u/Pankaj_Jadhav)\ **Replies:** 0\ **Last updated:** [December 11, 2020, 11:47am UTC](https://discuss.elastic.co/t/forcefully-reindex-more-than-1000-properties/258407 "2020-12-11T11:47:41Z")
Hi Team, I have to do reindex in ES. My index containts total 278 records where 7 records having properties more than 1000. Am not able to reindex by running kibana query POST \_reindex { "source": { "index": "roche… --- ## [Elasticsearch on AWS ECS - Master node itself unable to discover master](https://discuss.elastic.co/t/elasticsearch-on-aws-ecs-master-node-itself-unable-to-discover-master/256091)
**Author:** [@s0umen](https://discuss.elastic.co/u/s0umen)\ **Replies:** 9\ **Last updated:** [December 11, 2020, 11:38am UTC](https://discuss.elastic.co/t/elasticsearch-on-aws-ecs-master-node-itself-unable-to-discover-master/256091 "2020-12-11T11:38:45Z")
Hi I am trying to run elasticsearch on ECS. I am using simple elasticsearch.yml as below for the docker I am using for the Master Service. =================== Start Elasticsearch YML ==================== cluster.name:… --- ## [Match query with minimum field should match](https://discuss.elastic.co/t/match-query-with-minimum-field-should-match/258403)
**Author:** [@Tomasz\_Kutyla](https://discuss.elastic.co/u/Tomasz_Kutyla)\ **Replies:** 0\ **Last updated:** [December 11, 2020, 11:19am UTC](https://discuss.elastic.co/t/match-query-with-minimum-field-should-match/258403 "2020-12-11T11:19:47Z")
Hi, I have an question in regards of match query. Lets imagine we have an index with below data: POST /\_bulk {"index": {"\_index": "composers"}} {"name": "Johann Sebastian Bach", "phone": "543987111"} {"index": {"\_index… --- ## [Same code on query script and sort script](https://discuss.elastic.co/t/same-code-on-query-script-and-sort-script/258402)
**Author:** [@SergioRodenas](https://discuss.elastic.co/u/SergioRodenas)\ **Replies:** 0\ **Last updated:** [December 11, 2020, 11:17am UTC](https://discuss.elastic.co/t/same-code-on-query-script-and-sort-script/258402 "2020-12-11T11:17:07Z")
Hi, how can I avoid this? GET /repository/\_search { "query": { "script": { "script": { "source": "6371 \* Math.acos( Math.cos((Math.PI / 180)\*(39.9874542)) \* Math.cos((Math.PI / 180)\*(doc\['destination… --- ## [Automatic copying of document](https://discuss.elastic.co/t/automatic-copying-of-document/257687)
**Author:** [@pskhanapur](https://discuss.elastic.co/u/pskhanapur)\ **Replies:** 4\ **Last updated:** [December 11, 2020, 10:07am UTC](https://discuss.elastic.co/t/automatic-copying-of-document/257687 "2020-12-11T10:07:14Z")
I have two indices, let's say index1 index2 (clone of index1) I always write documents to index1. Is there a way to automatically trigger a copy of the document from index1 to index2, every time I write a document in… --- ## [Automatically remove older indexes from alias](https://discuss.elastic.co/t/automatically-remove-older-indexes-from-alias/258267)
**Author:** [@rahulkothanath](https://discuss.elastic.co/u/rahulkothanath)\ **Replies:** 2\ **Last updated:** [December 11, 2020, 9:40am UTC](https://discuss.elastic.co/t/automatically-remove-older-indexes-from-alias/258267 "2020-12-11T09:40:36Z")
I have an elastic search alias named "enrich" and it is defined in index template. How can I remove indices older than 15 days from "enrich" alias automatically? I am aware of below command but this is manual and I am … --- ## [How smooth we can upgrade Elasticsearch to 8.0](https://discuss.elastic.co/t/how-smooth-we-can-upgrade-elasticsearch-to-8-0/257986)
**Author:** [@guest123](https://discuss.elastic.co/u/guest123)\ **Replies:** 3\ **Last updated:** [December 11, 2020, 9:00am UTC](https://discuss.elastic.co/t/how-smooth-we-can-upgrade-elasticsearch-to-8-0/257986 "2020-12-11T09:00:06Z")
we are trying upgrade Elasticsearch from 6.7 to 7.7, as per the docs index creation, template and mapping requests are need to be passing parameter "include\_type\_name" in the request uri. but in 8.0 this is gone be rem… --- ## [Why cannot restore index from snapshot if an open index with same name exists in the cluster?](https://discuss.elastic.co/t/why-cannot-restore-index-from-snapshot-if-an-open-index-with-same-name-exists-in-the-cluster/258374)
**Author:** [@Simolx](https://discuss.elastic.co/u/Simolx)\ **Replies:** 3\ **Last updated:** [December 11, 2020, 8:55am UTC](https://discuss.elastic.co/t/why-cannot-restore-index-from-snapshot-if-an-open-index-with-same-name-exists-in-the-cluster/258374 "2020-12-11T08:55:47Z")
Why cannot restore index from snapshot if an open index with same name exists in the cluster? In Elasticsearch Source Code server/src/main/java/org/elasticsearch/snapshots/RestoreService.java method validateExisting… --- ## [Elastic regular peaks between 03:00-04:00](https://discuss.elastic.co/t/elastic-regular-peaks-between-0300/258385)
**Author:** [@jimmyvalmer19](https://discuss.elastic.co/u/jimmyvalmer19)\ **Replies:** 0\ **Last updated:** [December 11, 2020, 8:22am UTC](https://discuss.elastic.co/t/elastic-regular-peaks-between-0300/258385 "2020-12-11T08:22:33Z")
Hi, I noticed regular peaks in indexing rate every night between 03:00 and 04:00. I think it's something like cluster maintenance, rolling out indices, moving indices from one node to another, but I don't know what it i… --- ## [Hosted Elasticserach in GCP managed by Elastic](https://discuss.elastic.co/t/hosted-elasticserach-in-gcp-managed-by-elastic/258363)
**Author:** [@Shalinicts](https://discuss.elastic.co/u/Shalinicts)\ **Replies:** 1\ **Last updated:** [December 11, 2020, 6:25am UTC](https://discuss.elastic.co/t/hosted-elasticserach-in-gcp-managed-by-elastic/258363 "2020-12-11T06:25:31Z")
What are the key features of Hosted Elastic Stack in GCP (Managed ElasticSearch in GCP) https://www.elastic.co/google-cloud Where is the Elastic indices getting stored ?What is the level of access ELK developer has on E… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=742) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=744)