# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=745 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 746 --- ## [Sending metadata with external users (OIDC)](https://discuss.elastic.co/t/sending-metadata-with-external-users-oidc/258223)
**Author:** [@mahi2](https://discuss.elastic.co/u/mahi2)\ **Replies:** 0\ **Last updated:** [December 10, 2020, 7:04am UTC](https://discuss.elastic.co/t/sending-metadata-with-external-users-oidc/258223 "2020-12-10T07:04:50Z")
Hi, I have a scenario where the oidc users (external users) login to elastic search cloud. My question is , is there a way to add some metadata using an API along with the external user? --- ## [Is there a way to send logs from Elasticsearch to multiple Qradar IPs?](https://discuss.elastic.co/t/is-there-a-way-to-send-logs-from-elasticsearch-to-multiple-qradar-ips/258136)
**Author:** [@Pooja](https://discuss.elastic.co/u/Pooja)\ **Replies:** 3\ **Last updated:** [December 10, 2020, 6:41am UTC](https://discuss.elastic.co/t/is-there-a-way-to-send-logs-from-elasticsearch-to-multiple-qradar-ips/258136 "2020-12-10T06:41:16Z")
Is there a way to send logs from Elasticsearch to multiple Qradar IPs? --- ## [Ignore indexes with no hits during aggregation](https://discuss.elastic.co/t/ignore-indexes-with-no-hits-during-aggregation/258191)
**Author:** [@scarletfever](https://discuss.elastic.co/u/scarletfever)\ **Replies:** 3\ **Last updated:** [December 10, 2020, 6:27am UTC](https://discuss.elastic.co/t/ignore-indexes-with-no-hits-during-aggregation/258191 "2020-12-10T06:27:27Z")
Our ES cluster has a daily index with a field that previously was not saved with type = nested, but now is being saved with type = nested. Our search queries are against a wildcard index, not a specific index. So it's e… --- ## [Pagenation over 10,000 documents](https://discuss.elastic.co/t/pagenation-over-10-000-documents/258205)
**Author:** [@innze](https://discuss.elastic.co/u/innze)\ **Replies:** 1\ **Last updated:** [December 10, 2020, 6:23am UTC](https://discuss.elastic.co/t/pagenation-over-10-000-documents/258205 "2020-12-10T06:23:20Z")
I'm implementing a pagenation with an ElasticSearch over 10,000 documents. It is possible to bring the search results before and after the search by after\_search. But I would like to create a function to bring from a s… --- ## [No handler for type \[flattened\] declared on field \[host\]"](https://discuss.elastic.co/t/no-handler-for-type-flattened-declared-on-field-host/258177)
**Author:** [@voipas](https://discuss.elastic.co/u/voipas)\ **Replies:** 3\ **Last updated:** [December 10, 2020, 6:05am UTC](https://discuss.elastic.co/t/no-handler-for-type-flattened-declared-on-field-host/258177 "2020-12-10T06:05:17Z")
Hello, I'm taking some trainings on Elasticsearch, and I I receive an error if I try use flattened: ../bin/curl -XPUT "http://elastic.192.168.0.1.nip.io/demo-flattened/\_mapping" -d ' { "prope… --- ## [IOException when trying to create snapshot Unexpected end-of-input in VALUE\_STRING](https://discuss.elastic.co/t/ioexception-when-trying-to-create-snapshot-unexpected-end-of-input-in-value-string/258220)
**Author:** [@jbbasson](https://discuss.elastic.co/u/jbbasson)\ **Replies:** 0\ **Last updated:** [December 10, 2020, 5:56am UTC](https://discuss.elastic.co/t/ioexception-when-trying-to-create-snapshot-unexpected-end-of-input-in-value-string/258220 "2020-12-10T05:56:53Z")
We've a 6.8 elastisearch cluster using the gcp plugin to store snapshots running on a cron. We've been running a cron to periodically create snapshots of our elasticseearch 6.8 cluster using: http://...../\_snapshot/ind… --- ## [CircuitBreakingException\[\[parent\] Data too large on upgrading to elasticsearch 7.7 from 5.16](https://discuss.elastic.co/t/circuitbreakingexception-parent-data-too-large-on-upgrading-to-elasticsearch-7-7-from-5-16/258170)
**Author:** [@Rajesh99](https://discuss.elastic.co/u/Rajesh99)\ **Replies:** 3\ **Last updated:** [December 10, 2020, 5:19am UTC](https://discuss.elastic.co/t/circuitbreakingexception-parent-data-too-large-on-upgrading-to-elasticsearch-7-7-from-5-16/258170 "2020-12-10T05:19:13Z")
We have a 3 node elasticsearch cluster (with 16 cores, 64GB RAM) running on 7.7.1 version. Each elasticsearch instance was given heap memory of 4.6GB. We were indexing documents using bulk API. We are encountering the fo… --- ## [Can I combine a single fields search results and get a hash?](https://discuss.elastic.co/t/can-i-combine-a-single-fields-search-results-and-get-a-hash/258212)
**Author:** [@ChristoKiwi](https://discuss.elastic.co/u/ChristoKiwi)\ **Replies:** 1\ **Last updated:** [December 10, 2020, 5:06am UTC](https://discuss.elastic.co/t/can-i-combine-a-single-fields-search-results-and-get-a-hash/258212 "2020-12-10T05:06:59Z")
I have a large ES index (7.7) that has a couple of million rows. I want to be able to pull a days worth of data and using their UUID id values generate a hash (MD5 or SHA1 ideally). I can do this easily using SQL: SEL… --- ## [ISM policy for the AWS ES domain](https://discuss.elastic.co/t/ism-policy-for-the-aws-es-domain/257263)
**Author:** [@nikhilesh](https://discuss.elastic.co/u/nikhilesh)\ **Replies:** 4\ **Last updated:** [December 10, 2020, 4:25am UTC](https://discuss.elastic.co/t/ism-policy-for-the-aws-es-domain/257263 "2020-12-10T04:25:11Z")
Hi Team, I am using AWS ES domain of version 7.7. would like to create and apply a index management policy to delete the logs older than 30 days. so, for this i have created a policy and then applied the existing indic… --- ## [Jan 1, reindex, implement ILM on 2020 data, move forward into 2021](https://discuss.elastic.co/t/jan-1-reindex-implement-ilm-on-2020-data-move-forward-into-2021/258206)
**Author:** [@stcdarrell](https://discuss.elastic.co/u/stcdarrell)\ **Replies:** 1\ **Last updated:** [December 10, 2020, 1:21am UTC](https://discuss.elastic.co/t/jan-1-reindex-implement-ilm-on-2020-data-move-forward-into-2021/258206 "2020-12-10T01:21:21Z")
hi, i'm very new to ES.. i've been using it for about a year.. but have ALOT to learn. i have built a "system" (i use that term loosely) that sends a large amount of log data via filebeat to logstash for some enrichment… --- ## [Span\_near with a wildcard not finding an index](https://discuss.elastic.co/t/span-near-with-a-wildcard-not-finding-an-index/258204)
**Author:** [@Rvs](https://discuss.elastic.co/u/Rvs)\ **Replies:** 0\ **Last updated:** [December 10, 2020, 12:54am UTC](https://discuss.elastic.co/t/span-near-with-a-wildcard-not-finding-an-index/258204 "2020-12-10T00:54:48Z")
I am trying to search for a phrase where the one of the term i need to search using a wildcard. This is the index { "id": 2, "name": "Some Other Pizzaeria"} This is the query { "query": { "span\_near" : { … --- ## [How would I build a OR query for field exists](https://discuss.elastic.co/t/how-would-i-build-a-or-query-for-field-exists/258065)
**Author:** [@M\_Gibbs](https://discuss.elastic.co/u/M_Gibbs)\ **Replies:** 1\ **Last updated:** [December 10, 2020, 12:18am UTC](https://discuss.elastic.co/t/how-would-i-build-a-or-query-for-field-exists/258065 "2020-12-10T00:18:57Z")
Hey all, I've managed to create a query that searches for two fields, but both must exist. I'd like to build a query that requires field1 OR field2 to exist. Any pointers? I can't find anything in the docs related to t… --- ## [How to get start offset and end offset of a search string in search result in elasticsearch](https://discuss.elastic.co/t/how-to-get-start-offset-and-end-offset-of-a-search-string-in-search-result-in-elasticsearch/256879)
**Author:** [@Sreejith\_Pk](https://discuss.elastic.co/u/Sreejith_Pk)\ **Replies:** 3\ **Last updated:** [December 10, 2020, 12:08am UTC](https://discuss.elastic.co/t/how-to-get-start-offset-and-end-offset-of-a-search-string-in-search-result-in-elasticsearch/256879 "2020-12-10T00:08:41Z")
Hi team, I have a requirement to find the start and end position of a particular word in a text. --- ## [Enrich coordination queue at capacity](https://discuss.elastic.co/t/enrich-coordination-queue-at-capacity/258048)
**Author:** [@seanziee](https://discuss.elastic.co/u/seanziee)\ **Replies:** 14\ **Last updated:** [December 9, 2020, 11:48pm UTC](https://discuss.elastic.co/t/enrich-coordination-queue-at-capacity/258048 "2020-12-09T23:48:16Z")
I'm currently using the enrich processors to enrich my data coming in. It's been working great however more recently when I increase the indexing rate, I start to get the below error: \[16:47:15\] \[ELASTIC\] Row Error { ty… --- ## [Problem with a watcher run api ack when the clock runs](https://discuss.elastic.co/t/problem-with-a-watcher-run-api-ack-when-the-clock-runs/258196)
**Author:** [@Juan\_David\_Jaramillo](https://discuss.elastic.co/u/Juan_David_Jaramillo)\ **Replies:** 0\ **Last updated:** [December 9, 2020, 10:37pm UTC](https://discuss.elastic.co/t/problem-with-a-watcher-run-api-ack-when-the-clock-runs/258196 "2020-12-09T22:37:04Z")
hello, i have a problem with a watcher, it gives me an error when it runs, what i need is the following using the api ack so that a clock runs once and then, this in the state acked, but for it touches manually every tim… --- ## [Need help understanding index templates](https://discuss.elastic.co/t/need-help-understanding-index-templates/258127)
**Author:** [@madhan0618](https://discuss.elastic.co/u/madhan0618)\ **Replies:** 3\ **Last updated:** [December 9, 2020, 10:31pm UTC](https://discuss.elastic.co/t/need-help-understanding-index-templates/258127 "2020-12-09T22:31:35Z")
I have metricbeat installed/set up. I wanted my own index name so i put the below in metricbeat.yml file index: "adm\_jkafka" this gave me an error stating that when i want to use my own index, i need to mention the … --- ## [Elastic Parsing](https://discuss.elastic.co/t/elastic-parsing/258192)
**Author:** [@gcsrellis](https://discuss.elastic.co/u/gcsrellis)\ **Replies:** 1\ **Last updated:** [December 9, 2020, 9:59pm UTC](https://discuss.elastic.co/t/elastic-parsing/258192 "2020-12-09T21:59:25Z")
I'm using Security Onion 2 and it uses logstash to ingest logs and sends them to elasticsearch. Their documents say elastic parses the logs and the parsers are located under elasticsearch/ingest/. In that directory the… --- ## [Elasticsearch Audt logs are getting filled within 5-10 mins](https://discuss.elastic.co/t/elasticsearch-audt-logs-are-getting-filled-within-5-10-mins/258166)
**Author:** [@lnitin](https://discuss.elastic.co/u/lnitin)\ **Replies:** 0\ **Last updated:** [December 9, 2020, 5:14pm UTC](https://discuss.elastic.co/t/elasticsearch-audt-logs-are-getting-filled-within-5-10-mins/258166 "2020-12-09T17:14:48Z")
Elasticsearch Audit logs are getting filled up very quickly and it is getting filled up to 6-8GB within 5-10 minutes. I'm unable to keep any logrotate confifuration around this log. Is there any way we can tune this bett… --- ## [ELK and S3 input](https://discuss.elastic.co/t/elk-and-s3-input/257943)
**Author:** [@pavan45](https://discuss.elastic.co/u/pavan45)\ **Replies:** 5\ **Last updated:** [December 9, 2020, 9:20pm UTC](https://discuss.elastic.co/t/elk-and-s3-input/257943 "2020-12-09T21:20:14Z")
Hi, We have our application logs sent to AWS S3 in csv and text files. Looking to implement ELK with custom S3 plugins to create search and index patterns. --- ## [Curl: (7) Failed to connect to 172.16.128.208 port 9200: Connection refused](https://discuss.elastic.co/t/curl-7-failed-to-connect-to-172-16-128-208-port-9200-connection-refused/258067)
**Author:** [@danker00](https://discuss.elastic.co/u/danker00)\ **Replies:** 3\ **Last updated:** [December 9, 2020, 9:01pm UTC](https://discuss.elastic.co/t/curl-7-failed-to-connect-to-172-16-128-208-port-9200-connection-refused/258067 "2020-12-09T21:01:02Z")
Hi Everyone, I am installing elasticsearch on a VM (vmware workstation - NIC: bridged) Host machine (Windows Server) I am getting an error after trying to curl to the IP address of the machine running elasticsearch. I w… --- ## [ML unexplained results](https://discuss.elastic.co/t/ml-unexplained-results/258097)
**Author:** [@liorg2](https://discuss.elastic.co/u/liorg2)\ **Replies:** 2\ **Last updated:** [December 9, 2020, 6:15pm UTC](https://discuss.elastic.co/t/ml-unexplained-results/258097 "2020-12-09T18:15:19Z")
Hello, I'm having unexplained results in an anomaly detection job. Attached an image, where you can see clearly that the typical value is 216 - it's almost a straight line. (for the past 2 months) The model in the oth… --- ## [Elasticsearch Aggregation - Return a list of array from documents found](https://discuss.elastic.co/t/elasticsearch-aggregation-return-a-list-of-array-from-documents-found/257990)
**Author:** [@KuntalP](https://discuss.elastic.co/u/KuntalP)\ **Replies:** 3\ **Last updated:** [December 9, 2020, 6:01pm UTC](https://discuss.elastic.co/t/elasticsearch-aggregation-return-a-list-of-array-from-documents-found/257990 "2020-12-09T18:01:37Z")
Hi All, I am querying a time series data using the aggregation functionality. The data to be queried is of categorical nature. I use date histogram to first create buckets. From these generated buckets, I wish to extra… --- ## [ELK Update - can not be imported as a dangling index, as index with same name already exists in cluster metadata](https://discuss.elastic.co/t/elk-update-can-not-be-imported-as-a-dangling-index-as-index-with-same-name-already-exists-in-cluster-metadata/256530)
**Author:** [@snolfi](https://discuss.elastic.co/u/snolfi)\ **Replies:** 3\ **Last updated:** [December 9, 2020, 5:33pm UTC](https://discuss.elastic.co/t/elk-update-can-not-be-imported-as-a-dangling-index-as-index-with-same-name-already-exists-in-cluster-metadata/256530 "2020-12-09T17:33:31Z")
Hello, we have updated an old version of elk from 5.6.4 to 6.8.13 (aiming to upgrade to 7.x). But when we restarted elasticsearch we had this error: \`\[2020-11-24T16:29:45,854\]\[WARN \]\[o.e.g.DanglingIndicesState\] \[coll01… --- ## [Setting up a watcher is seems harder than it should be](https://discuss.elastic.co/t/setting-up-a-watcher-is-seems-harder-than-it-should-be/258046)
**Author:** [@mc1392](https://discuss.elastic.co/u/mc1392)\ **Replies:** 10\ **Last updated:** [December 9, 2020, 4:29pm UTC](https://discuss.elastic.co/t/setting-up-a-watcher-is-seems-harder-than-it-should-be/258046 "2020-12-09T16:29:47Z")
1 I used the following command to enable Watcher: PUT \_cluster/settings { "persistent": { "xpack.monitoring.collection.enabled": true } } When I goto the Watcher to create a watcher, ther… --- ## [How to Analyze field with elasticsearch](https://discuss.elastic.co/t/how-to-analyze-field-with-elasticsearch/258143)
**Author:** [@111417](https://discuss.elastic.co/u/111417)\ **Replies:** 2\ **Last updated:** [December 9, 2020, 3:48pm UTC](https://discuss.elastic.co/t/how-to-analyze-field-with-elasticsearch/258143 "2020-12-09T15:48:46Z")
I want to parse field with spacial format (like Json) with using elasticsearch without logstash , is that possible with using elasticsearch analyze? If it's possible,where can i start? Or there is another way? exampl… --- ## [Update dynamic/static properties with CCR](https://discuss.elastic.co/t/update-dynamic-static-properties-with-ccr/258144)
**Author:** [@Armen\_Petrosyan](https://discuss.elastic.co/u/Armen_Petrosyan)\ **Replies:** 0\ **Last updated:** [December 9, 2020, 3:17pm UTC](https://discuss.elastic.co/t/update-dynamic-static-properties-with-ccr/258144 "2020-12-09T15:17:08Z")
Hi. In the section replication mechanics here I see below quote The follower index automatically retrieves some updates applied to the leader index, while other updates are retrieved as needed I don't sure what is… --- ## [Prefix query not analyzed](https://discuss.elastic.co/t/prefix-query-not-analyzed/257901)
**Author:** [@davide-martins](https://discuss.elastic.co/u/davide-martins)\ **Replies:** 3\ **Last updated:** [December 9, 2020, 3:11pm UTC](https://discuss.elastic.co/t/prefix-query-not-analyzed/257901 "2020-12-09T15:11:31Z")
Dear team, I'm trying to setup a query that contain a specific prefix in a provided text (not a keyword). PUT my-index { "mappings": { "properties": { "title": { "type": "text", … --- ## [CCR exception/warning issue. RetentionLeaseNotFoundException](https://discuss.elastic.co/t/ccr-exception-warning-issue-retentionleasenotfoundexception/257977)
**Author:** [@Armen\_Petrosyan](https://discuss.elastic.co/u/Armen_Petrosyan)\ **Replies:** 5\ **Last updated:** [December 9, 2020, 3:00pm UTC](https://discuss.elastic.co/t/ccr-exception-warning-issue-retentionleasenotfoundexception/257977 "2020-12-09T15:00:36Z")
Scenario Create leader cluster Create index with index.soft\_deletes.retention\_lease.period = 5s (\*\*\*). This period I choose only for test purposes. Index document and wait 5s before next step so retention lease expire C… --- ## [CCR follower for large index fails](https://discuss.elastic.co/t/ccr-follower-for-large-index-fails/258043)
**Author:** [@toryohanson](https://discuss.elastic.co/u/toryohanson)\ **Replies:** 0\ **Last updated:** [December 8, 2020, 7:40pm UTC](https://discuss.elastic.co/t/ccr-follower-for-large-index-fails/258043 "2020-12-08T19:40:11Z")
Hello! I'w trying to configure Elasticsearch CCR using manuals at elastic.co Everything works fine for small indexes. But, when it comes to indexes large then 2 GB, something strange happens - index following is pause… --- ## [Value got nulled when ingesting to ES from Hadoop using Spark](https://discuss.elastic.co/t/value-got-nulled-when-ingesting-to-es-from-hadoop-using-spark/258135)
**Author:** [@anung](https://discuss.elastic.co/u/anung)\ **Replies:** 0\ **Last updated:** [December 9, 2020, 1:53pm UTC](https://discuss.elastic.co/t/value-got-nulled-when-ingesting-to-es-from-hadoop-using-spark/258135 "2020-12-09T13:53:22Z")
my env: cloudera hadoop 6.3 es 7.10 spark 2.4.0 elasticsearch-spark-20\_2.11-7.10.0.jar my code very simple: import org.elasticsearch.spark.rdd.api.java.JavaEsSpark; JavaEsSpark.saveToEs(rdd\_tJava\_1, "nyc\_yellow\_taxi… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=744) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=746)