# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=746 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 747 --- ## [Index attributes from a multiline json string](https://discuss.elastic.co/t/index-attributes-from-a-multiline-json-string/258132)
**Author:** [@Luca\_P](https://discuss.elastic.co/u/Luca_P)\ **Replies:** 0\ **Last updated:** [December 9, 2020, 1:43pm UTC](https://discuss.elastic.co/t/index-attributes-from-a-multiline-json-string/258132 "2020-12-09T13:43:12Z")
Hi All, I need some advice here, I don't want to reinvent the wheel. With Filebeat 6.7.0 I'm picking up logs in typical docker format, , i.e. json strings with "log", "stream" and "time" attributes. In the logs, each … --- ## [Memory issue in elasticsearch](https://discuss.elastic.co/t/memory-issue-in-elasticsearch/258027)
**Author:** [@prat](https://discuss.elastic.co/u/prat)\ **Replies:** 11\ **Last updated:** [December 9, 2020, 12:50pm UTC](https://discuss.elastic.co/t/memory-issue-in-elasticsearch/258027 "2020-12-09T12:50:11Z")
Hi Team, I deployed multi-node cluster few days back and it was working fine. Today I saw elasticsearch service went down due to less memory availability. It is running fine on other two elasticsearch nodes. System ha… --- ## [docFreq for multi\_match with type cross\_fields](https://discuss.elastic.co/t/docfreq-for-multi-match-with-type-cross-fields/258121)
**Author:** [@Lea\_Lacoste](https://discuss.elastic.co/u/Lea_Lacoste)\ **Replies:** 1\ **Last updated:** [December 9, 2020, 12:48pm UTC](https://discuss.elastic.co/t/docfreq-for-multi-match-with-type-cross-fields/258121 "2020-12-09T12:48:49Z")
I am having problems understanding the docFreq for multi\_match queries when using the type cross\_fields. I created a one shard test index, onto which I pushed 4 documents: { "random0": "banana", "random1": "banana", "r… --- ## [Performance Issues during data-ingestion](https://discuss.elastic.co/t/performance-issues-during-data-ingestion/258092)
**Author:** [@M-O](https://discuss.elastic.co/u/M-O)\ **Replies:** 3\ **Last updated:** [December 9, 2020, 12:42pm UTC](https://discuss.elastic.co/t/performance-issues-during-data-ingestion/258092 "2020-12-09T12:42:10Z")
Hi everyone, i am currently testing the elastic stack for observerability use-cases in my company. For testing purposes we build a small elasticsearch cluster (3 nodes) and ingesting http-logs with filebeat. Our PoC-se… --- ## [Elasticsearch - error while trying to start service on OpenShift](https://discuss.elastic.co/t/elasticsearch-error-while-trying-to-start-service-on-openshift/258088)
**Author:** [@Aniket\_Salvi](https://discuss.elastic.co/u/Aniket_Salvi)\ **Replies:** 7\ **Last updated:** [December 9, 2020, 11:27am UTC](https://discuss.elastic.co/t/elasticsearch-error-while-trying-to-start-service-on-openshift/258088 "2020-12-09T11:27:38Z")
Hi, I got following error in Elasticsearch. Elasticsearch is installed on Openshift. Elasticsearch version - 6.4.3. OSS Elasticsearch logs: OpenJDK 64-Bit Server VM warning: Option UseConcMarkSweepGC was deprecated i… --- ## [Nodes constantly turn off and on again](https://discuss.elastic.co/t/nodes-constantly-turn-off-and-on-again/257808)
**Author:** [@RusseL](https://discuss.elastic.co/u/RusseL)\ **Replies:** 6\ **Last updated:** [December 9, 2020, 11:24am UTC](https://discuss.elastic.co/t/nodes-constantly-turn-off-and-on-again/257808 "2020-12-09T11:24:04Z")
Hi guys, I have a 14 nodes of cluster (11 data, 3 master).I am using Elasticsearch and kibana version 7.4.2. When everything is going well, suddenly the nodes started to shut down and the kibana status turns red or yello… --- ## [Scoring plugin, unexpected behavior](https://discuss.elastic.co/t/scoring-plugin-unexpected-behavior/258105)
**Author:** [@iva3682](https://discuss.elastic.co/u/iva3682)\ **Replies:** 0\ **Last updated:** [December 9, 2020, 10:21am UTC](https://discuss.elastic.co/t/scoring-plugin-unexpected-behavior/258105 "2020-12-09T10:21:16Z")
Hey. I am writing a plugin for calculating the distance of the EMD vector for Elastic 7.10.0. I took the repository as an example https://github.com/elastic/elasticsearch/tree/master/plugins/examples/script-expert-scorin… --- ## [Please help with elapsed plugin and timestap difference](https://discuss.elastic.co/t/please-help-with-elapsed-plugin-and-timestap-difference/257628)
**Author:** [@fabryx87](https://discuss.elastic.co/u/fabryx87)\ **Replies:** 2\ **Last updated:** [December 9, 2020, 10:28am UTC](https://discuss.elastic.co/t/please-help-with-elapsed-plugin-and-timestap-difference/257628 "2020-12-09T10:28:03Z")
Hello everyone and thanks for this great Forum! I would need a hand with elastic, I have to make a difference between 2 timestamps that have the logonid in common, but different event.action. unfortunately I don't even… --- ## [Elasticsearch mapping ES2.3 -\> ES 7.8](https://discuss.elastic.co/t/elasticsearch-mapping-es2-3-es-7-8/258078)
**Author:** [@Pete\_Watcharawit](https://discuss.elastic.co/u/Pete_Watcharawit)\ **Replies:** 2\ **Last updated:** [December 9, 2020, 10:13am UTC](https://discuss.elastic.co/t/elasticsearch-mapping-es2-3-es-7-8/258078 "2020-12-09T10:13:50Z")
Assume that the defined mapping in ES2.3 has this format. "properties": { "accountId": { "type": "string", "index": "not\_analyzed" } } Is it equivalent to this in ES 7.8 version? "properties": { … --- ## [Transforms -how to add common fields (i.e. geoip-fields) to the transform output?](https://discuss.elastic.co/t/transforms-how-to-add-common-fields-i-e-geoip-fields-to-the-transform-output/257915)
**Author:** [@hevi](https://discuss.elastic.co/u/hevi)\ **Replies:** 6\ **Last updated:** [December 9, 2020, 9:30am UTC](https://discuss.elastic.co/t/transforms-how-to-add-common-fields-i-e-geoip-fields-to-the-transform-output/257915 "2020-12-09T09:30:56Z")
Basically I have thousands of embedded devices that periodically upload logfiles to a backend we've created and after some preprocessing the log files are ingested into elasticserach using the geoip igestion pipeline. At… --- ## [ES 7.x : Setting threshold for document size and collecting metrics exceeding the same](https://discuss.elastic.co/t/es-7-x-setting-threshold-for-document-size-and-collecting-metrics-exceeding-the-same/258077)
**Author:** [@dinesh\_gnanasamy](https://discuss.elastic.co/u/dinesh_gnanasamy)\ **Replies:** 2\ **Last updated:** [December 9, 2020, 9:29am UTC](https://discuss.elastic.co/t/es-7-x-setting-threshold-for-document-size-and-collecting-metrics-exceeding-the-same/258077 "2020-12-09T09:29:59Z")
Hi, Is there any way of setting a global parameter across indices in ES to the effect of defining the limit of size of each document and if the document size in any index exceeding this limit (either as result of indexi… --- ## [Algorithmic complexity of bool queries](https://discuss.elastic.co/t/algorithmic-complexity-of-bool-queries/258084)
**Author:** [@rex-remind](https://discuss.elastic.co/u/rex-remind)\ **Replies:** 1\ **Last updated:** [December 9, 2020, 8:46am UTC](https://discuss.elastic.co/t/algorithmic-complexity-of-bool-queries/258084 "2020-12-09T08:46:15Z")
I've been searching all over the net to get an understanding of the algorithmic complexity / rough big-O of bool queries for Elasticsearch, but I have come up dry so I'm asking here. (Note: this is not a question about c… --- ## [Unable to get gte and lte from elastic Java API in range query](https://discuss.elastic.co/t/unable-to-get-gte-and-lte-from-elastic-java-api-in-range-query/257781)
**Author:** [@AKASH\_DUBEY1](https://discuss.elastic.co/u/AKASH_DUBEY1)\ **Replies:** 22\ **Last updated:** [December 9, 2020, 8:47am UTC](https://discuss.elastic.co/t/unable-to-get-gte-and-lte-from-elastic-java-api-in-range-query/257781 "2020-12-09T08:47:57Z")
Hi , I am using RestHighLevelclient to get data from elastic.I am using below query BoolQueryBuilder boolQuery=QueryBuilders.boolQuery(); boolQuery.must(QueryBuilders.rangeQuery("ipFromLong").gte(ipLong)); boolQuery.… --- ## [Resource upper bounds on keyword sorting](https://discuss.elastic.co/t/resource-upper-bounds-on-keyword-sorting/258095)
**Author:** [@rex-remind](https://discuss.elastic.co/u/rex-remind)\ **Replies:** 0\ **Last updated:** [December 9, 2020, 8:47am UTC](https://discuss.elastic.co/t/resource-upper-bounds-on-keyword-sorting/258095 "2020-12-09T08:47:26Z")
I was reading through the docs on fielddata and came about this: It usually doesn’t make sense to enable fielddata on text fields. Field data is stored in the heap with the field data cache because it is expensive to c… --- ## [EdgeGram Search trouble](https://discuss.elastic.co/t/edgegram-search-trouble/258070)
**Author:** [@murilozilli](https://discuss.elastic.co/u/murilozilli)\ **Replies:** 1\ **Last updated:** [December 9, 2020, 8:30am UTC](https://discuss.elastic.co/t/edgegram-search-trouble/258070 "2020-12-09T08:30:15Z")
I am very new to ES so I am probably getting something wrong but this is my mapping and settings: { "locations":{ "mappings":{ "locations":{ "\_meta":{ … --- ## [Price sort not working in elasticsearch 7.9.3 version](https://discuss.elastic.co/t/price-sort-not-working-in-elasticsearch-7-9-3-version/257970)
**Author:** [@magesh\_kumar](https://discuss.elastic.co/u/magesh_kumar)\ **Replies:** 11\ **Last updated:** [December 9, 2020, 8:27am UTC](https://discuss.elastic.co/t/price-sort-not-working-in-elasticsearch-7-9-3-version/257970 "2020-12-09T08:27:12Z")
Hi everyone, Currently I am using the Elasticsearch 7.9.3 version. the issue is price sort works wrong after upgrading the old version. Price data's are mixed with double , integer. Please let me know what happened in t… --- ## [How to calculate weighted score depending on order of an array field](https://discuss.elastic.co/t/how-to-calculate-weighted-score-depending-on-order-of-an-array-field/258071)
**Author:** [@taichi](https://discuss.elastic.co/u/taichi)\ **Replies:** 2\ **Last updated:** [December 9, 2020, 8:12am UTC](https://discuss.elastic.co/t/how-to-calculate-weighted-score-depending-on-order-of-an-array-field/258071 "2020-12-09T08:12:26Z")
I would like to search by an array field, and give weight depending on where the value appears in the arrays. For example, I have 3 documents like this: { "foo": \[1, 2, 3\] } { "foo": \[2, 3, 4\] } { "foo": \[3, 4, 5\] } a… --- ## [Downgrade elasticsearch to previous version](https://discuss.elastic.co/t/downgrade-elasticsearch-to-previous-version/258083)
**Author:** [@rohitarorait82](https://discuss.elastic.co/u/rohitarorait82)\ **Replies:** 1\ **Last updated:** [December 9, 2020, 7:42am UTC](https://discuss.elastic.co/t/downgrade-elasticsearch-to-previous-version/258083 "2020-12-09T07:42:44Z")
Hi All, I am planning to upgrade my 6 node elk cluster from 7.7 to 7.10. I am just looking for a scenario when two nodes are upgraded and 3rd node fails. So is there a way to downgrade all the nodes back to v7.7 --- ## [Elasticsearch muat\_not match on all elemets of array](https://discuss.elastic.co/t/elasticsearch-muat-not-match-on-all-elemets-of-array/257997)
**Author:** [@roy\_einhorn](https://discuss.elastic.co/u/roy_einhorn)\ **Replies:** 6\ **Last updated:** [December 9, 2020, 6:58am UTC](https://discuss.elastic.co/t/elasticsearch-muat-not-match-on-all-elemets-of-array/257997 "2020-12-09T06:58:01Z")
i have multiple documents with a field containing an array : for example: "person1" : \[ { "network" : "A" }, { "network" : "B" }, \] "person2" : \[ { "network" : "A" }, { "network" : "C" } \] i want to look… --- ## [Minimum Elasticsearch Hardware Requirement](https://discuss.elastic.co/t/minimum-elasticsearch-hardware-requirement/258074)
**Author:** [@Rohit\_Kumbhar](https://discuss.elastic.co/u/Rohit_Kumbhar)\ **Replies:** 1\ **Last updated:** [December 9, 2020, 6:57am UTC](https://discuss.elastic.co/t/minimum-elasticsearch-hardware-requirement/258074 "2020-12-09T06:57:37Z")
Hi Experts, I want to configure Elasticsearch Cluster from Data Ingested per day and retention period. Is there any formula to calculate Number of Nodes required , Minimum Ram and Processor cores and storage Requiremen… --- ## [General information regarding ELK](https://discuss.elastic.co/t/general-information-regarding-elk/258073)
**Author:** [@shiv97](https://discuss.elastic.co/u/shiv97)\ **Replies:** 1\ **Last updated:** [December 9, 2020, 6:36am UTC](https://discuss.elastic.co/t/general-information-regarding-elk/258073 "2020-12-09T06:36:10Z")
Hello Team, I wanted to know some of the information regarding elk as I am new to this topic a) Difference between ELK self vs ELk managed b) Approach for pushing logs into ELK to meet near / real-time requirement ki… --- ## [Translated SQL query to SearchRequest](https://discuss.elastic.co/t/translated-sql-query-to-searchrequest/254087)
**Author:** [@yuriy.kasterin](https://discuss.elastic.co/u/yuriy.kasterin)\ **Replies:** 7\ **Last updated:** [November 4, 2020, 11:20am UTC](https://discuss.elastic.co/t/translated-sql-query-to-searchrequest/254087 "2020-11-04T11:20:40Z")
Hello I want to create a search request from a translated SQL query. Here is the code that i use to translate the SQL query to json ES query: RestClient restClient = RestClient.builder( new HttpHost("local… --- ## [Elasticsearch server could not be reached](https://discuss.elastic.co/t/elasticsearch-server-could-not-be-reached/257937)
**Author:** [@webapps](https://discuss.elastic.co/u/webapps)\ **Replies:** 5\ **Last updated:** [December 9, 2020, 3:57am UTC](https://discuss.elastic.co/t/elasticsearch-server-could-not-be-reached/257937 "2020-12-09T03:57:31Z")
I just want to integrate external https Elasticsearch server URI with Drupal 8 version. I got an external https Elasticsearch server URI and got the credentials for it. When I’m accessing the https Elasticsearch server … --- ## [Query seach in elasticsearch](https://discuss.elastic.co/t/query-seach-in-elasticsearch/257939)
**Author:** [@111411](https://discuss.elastic.co/u/111411)\ **Replies:** 6\ **Last updated:** [December 8, 2020, 7:24am UTC](https://discuss.elastic.co/t/query-seach-in-elasticsearch/257939 "2020-12-08T07:24:24Z")
I'm trying to search in elasticsearch by query. I'm want to get uuid = 002A13AC-93E6-4141-AA28-0A86F1B5E5C2 of device index. GET device/\_search? { "query": { "match": { "uuid" : "0aaa02A13AC-93E6-4141-AA28-0A86F1B5… --- ## [Kibana authentication](https://discuss.elastic.co/t/kibana-authentication/257824)
**Author:** [@humartinez](https://discuss.elastic.co/u/humartinez)\ **Replies:** 4\ **Last updated:** [December 9, 2020, 12:56am UTC](https://discuss.elastic.co/t/kibana-authentication/257824 "2020-12-09T00:56:57Z")
Hi all, Lets say I want to use authentication with kibana but I don't want to encript or authenticate my elasticsearch cluster. How cant I do that? --- ## [Elasticsearch 7.9 will spend long time to forcemerge](https://discuss.elastic.co/t/elasticsearch-7-9-will-spend-long-time-to-forcemerge/257983)
**Author:** [@gaocx2000cn](https://discuss.elastic.co/u/gaocx2000cn)\ **Replies:** 2\ **Last updated:** [December 8, 2020, 11:43pm UTC](https://discuss.elastic.co/t/elasticsearch-7-9-will-spend-long-time-to-forcemerge/257983 "2020-12-08T23:43:26Z")
Elasticsearch 7.9 will spend long time to forcemerge. curl -s -XPOST http://:9200/\_forcemerge?max\_num\_segments=1 Elasticsearch 6.2 will spend less time to forcemerge. We have same data source on Elasticsearch 6.2 and … --- ## [Can we create custom datastream types?](https://discuss.elastic.co/t/can-we-create-custom-datastream-types/258060)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 0\ **Last updated:** [December 8, 2020, 10:34pm UTC](https://discuss.elastic.co/t/can-we-create-custom-datastream-types/258060 "2020-12-08T22:34:57Z")
Hello, So the new datastream concepts are slightly confusing. I'd like to play a bit with the details and possible configurations. Can I create my own datastream type? For example some documentations say only logs and m… --- ## [What do you think is more critical? To allocate more resources or change architecture?](https://discuss.elastic.co/t/what-do-you-think-is-more-critical-to-allocate-more-resources-or-change-architecture/258003)
**Author:** [@mahalabobis](https://discuss.elastic.co/u/mahalabobis)\ **Replies:** 12\ **Last updated:** [December 8, 2020, 10:29pm UTC](https://discuss.elastic.co/t/what-do-you-think-is-more-critical-to-allocate-more-resources-or-change-architecture/258003 "2020-12-08T22:29:29Z")
I have multiple issues with Elasticsearch right now. I'm running out of disk I'm running out of memory Architecture may need to change since I have more than 600 shards per node. For sure, I will add a new node to the … --- ## [Cannot connect to elasticsearch server instance on port 9200](https://discuss.elastic.co/t/cannot-connect-to-elasticsearch-server-instance-on-port-9200/257728)
**Author:** [@freshlinx](https://discuss.elastic.co/u/freshlinx)\ **Replies:** 3\ **Last updated:** [December 8, 2020, 9:54pm UTC](https://discuss.elastic.co/t/cannot-connect-to-elasticsearch-server-instance-on-port-9200/257728 "2020-12-08T21:54:12Z")
I have installed Elasticsearch and when I run a curl localhost:9200 request on the machine it returns the expected response showing that Elasticsearch is running. I have a Wordpress site on another server and I want to … --- ## [Elasticsearch ODBC Connector (AWS ES domain) Does Not Work with IAM Credentials](https://discuss.elastic.co/t/elasticsearch-odbc-connector-aws-es-domain-does-not-work-with-iam-credentials/258050)
**Author:** [@mcburn13](https://discuss.elastic.co/u/mcburn13)\ **Replies:** 2\ **Last updated:** [December 8, 2020, 9:41pm UTC](https://discuss.elastic.co/t/elasticsearch-odbc-connector-aws-es-domain-does-not-work-with-iam-credentials/258050 "2020-12-08T21:41:41Z")
I installed the 64bit ODBC connector, and was able to connect to my AWS Elasticsearch domain when i turned off it's access policy. I created an IAM user, added to the policy and it then cannot connect to it. [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=745) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=747)