# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=756 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 757 --- ## [\[Query DSL\] Get documents which don't have a sepcific value (in array, object/nested)](https://discuss.elastic.co/t/query-dsl-get-documents-which-dont-have-a-sepcific-value-in-array-object-nested/256637)
**Author:** [@ThibautSF](https://discuss.elastic.co/u/ThibautSF)\ **Replies:** 0\ **Last updated:** [November 25, 2020, 10:38am UTC](https://discuss.elastic.co/t/query-dsl-get-documents-which-dont-have-a-sepcific-value-in-array-object-nested/256637 "2020-11-25T10:38:31Z")
I will explain with examples, it should be better. I have 3 documents A, B and C (to be precise, in fact it's 3 type of document, there is more documents) Each document has a nested field of objects (with some fields),… --- ## [ES node find master, but can't join the cluster](https://discuss.elastic.co/t/es-node-find-master-but-cant-join-the-cluster/256591)
**Author:** [@Todd](https://discuss.elastic.co/u/Todd)\ **Replies:** 4\ **Last updated:** [November 25, 2020, 10:37am UTC](https://discuss.elastic.co/t/es-node-find-master-but-cant-join-the-cluster/256591 "2020-11-25T10:37:04Z")
Hi, These days I have found such a situation: one data node of the cluster has discoveried three master nodes, but it can't join the cluster. However, when I restart it, the data node joins successful !!! ES version: 7… --- ## [High refresh time in cluster nodes](https://discuss.elastic.co/t/high-refresh-time-in-cluster-nodes/256635)
**Author:** [@sahere37](https://discuss.elastic.co/u/sahere37)\ **Replies:** 0\ **Last updated:** [November 25, 2020, 10:28am UTC](https://discuss.elastic.co/t/high-refresh-time-in-cluster-nodes/256635 "2020-11-25T10:28:17Z")
Hi all, I have a three node cluster elasticsearch version 6.5.4. Some times data in visualize and dashboard falling behind and it takes hours to back. Based on monitoring dashboard of elasticsearch, index latency incre… --- ## [Kibana time-out errors](https://discuss.elastic.co/t/kibana-time-out-errors/255479)
**Author:** [@TheHunter1](https://discuss.elastic.co/u/TheHunter1)\ **Replies:** 5\ **Last updated:** [November 25, 2020, 9:45am UTC](https://discuss.elastic.co/t/kibana-time-out-errors/255479 "2020-11-25T09:45:29Z")
Hello, I am testing ELasticsearch to deploy it in production cluster. The first days it was working perfectly, and then I began having trouble when I try to search logs using Kibana, and the response was taking a long t… --- ## [Transforms updates fields from data that exists from before even a filter condition was not met](https://discuss.elastic.co/t/transforms-updates-fields-from-data-that-exists-from-before-even-a-filter-condition-was-not-met/256020)
**Author:** [@syunusic](https://discuss.elastic.co/u/syunusic)\ **Replies:** 3\ **Last updated:** [November 25, 2020, 10:03am UTC](https://discuss.elastic.co/t/transforms-updates-fields-from-data-that-exists-from-before-even-a-filter-condition-was-not-met/256020 "2020-11-25T10:03:58Z")
I have an index (client\_index) that has three fields: @timestamp, user, ip. I have a transform like this: { "id": "my\_transform", "source": { "index": \[ "client\_index" \], "query": { "match\_al… --- ## [Using field name other than "message" in grok match](https://discuss.elastic.co/t/using-field-name-other-than-message-in-grok-match/256563)
**Author:** [@Muhammad\_Faisal](https://discuss.elastic.co/u/Muhammad_Faisal)\ **Replies:** 5\ **Last updated:** [November 25, 2020, 10:03am UTC](https://discuss.elastic.co/t/using-field-name-other-than-message-in-grok-match/256563 "2020-11-25T10:03:40Z")
i have log like below, in line 2 , i have stored custom filter value in field "method"...in line 3 , i want to use "method" field and apply it another custom filter and store this result in method 2...i don't want to cha… --- ## [Indexing best practice](https://discuss.elastic.co/t/indexing-best-practice/256564)
**Author:** [@Elitlogik](https://discuss.elastic.co/u/Elitlogik)\ **Replies:** 3\ **Last updated:** [November 25, 2020, 9:52am UTC](https://discuss.elastic.co/t/indexing-best-practice/256564 "2020-11-25T09:52:19Z")
Just finished my first ELK deployment. On a HP EliteDesk i5, 8 GB, 120 GB SSD for $90. It was done with CentOS 8 Minimal, Docker, Docker Compose, Cockpit, Portainer and Deviantony/Docker-ELK. A few tweaks, adding Beats … --- ## [Scripted terms always returns stringified values](https://discuss.elastic.co/t/scripted-terms-always-returns-stringified-values/256623)
**Author:** [@APic](https://discuss.elastic.co/u/APic)\ **Replies:** 0\ **Last updated:** [November 25, 2020, 9:17am UTC](https://discuss.elastic.co/t/scripted-terms-always-returns-stringified-values/256623 "2020-11-25T09:17:01Z")
Hello, we are using script to execute terms on fields that are run-time created by source and we don't know their name in advance. Source documents: { "@timestamp": "2020-11-24T06:06:14.0058521+01:00"… --- ## [Content\_tier](https://discuss.elastic.co/t/content-tier/256513)
**Author:** [@mutt13y](https://discuss.elastic.co/u/mutt13y)\ **Replies:** 2\ **Last updated:** [November 25, 2020, 7:49am UTC](https://discuss.elastic.co/t/content-tier/256513 "2020-11-25T07:49:47Z")
Hello, with reference to 7.10 and Data tiers | Elasticsearch Guide \[master\] | Elastic Content tier nodes are usually optimized for query performance—​they prioritize processing power over IO throughput so they can proc… --- ## [Data Stop ingesting after deleting index](https://discuss.elastic.co/t/data-stop-ingesting-after-deleting-index/256027)
**Author:** [@bhijay](https://discuss.elastic.co/u/bhijay)\ **Replies:** 7\ **Last updated:** [November 25, 2020, 7:27am UTC](https://discuss.elastic.co/t/data-stop-ingesting-after-deleting-index/256027 "2020-11-25T07:27:33Z")
Hello, I mistakenly deleted the winlogbeat index. However, new data stopped ingesting after deletion. What can I do? Regards. --- ## [Query on too many scroll contexts](https://discuss.elastic.co/t/query-on-too-many-scroll-contexts/256606)
**Author:** [@skandimalla](https://discuss.elastic.co/u/skandimalla)\ **Replies:** 0\ **Last updated:** [November 25, 2020, 6:55am UTC](https://discuss.elastic.co/t/query-on-too-many-scroll-contexts/256606 "2020-11-25T06:55:59Z")
We are using ES version 6.4 and we want to upgrade to 7.4. While testing the up-gradation to do a paginated search using Scroll we are facing the below issue: Trying to create too many scroll contexts. Must be less than… --- ## [Shard in es cluster](https://discuss.elastic.co/t/shard-in-es-cluster/256512)
**Author:** [@RAM\_NATHAN](https://discuss.elastic.co/u/RAM_NATHAN)\ **Replies:** 2\ **Last updated:** [November 25, 2020, 5:48am UTC](https://discuss.elastic.co/t/shard-in-es-cluster/256512 "2020-11-25T05:48:15Z")
I had a single node default "Elasticsearch" cluster so far. It had one index and two alias associated with that curl -s -X PUT $elasticsearchURL/$indexName?pretty -H 'Content-Type: application/json' -d '{"settings":{"in… --- ## [DNS enablement in elastic search on gcp kubernetes](https://discuss.elastic.co/t/dns-enablement-in-elastic-search-on-gcp-kubernetes/256600)
**Author:** [@sathish.mtech01](https://discuss.elastic.co/u/sathish.mtech01)\ **Replies:** 2\ **Last updated:** [November 25, 2020, 5:47am UTC](https://discuss.elastic.co/t/dns-enablement-in-elastic-search-on-gcp-kubernetes/256600 "2020-11-25T05:47:39Z")
Please share the link to refer --- ## [Elasticsearch monitoring sometime not showing indexing rate](https://discuss.elastic.co/t/elasticsearch-monitoring-sometime-not-showing-indexing-rate/256594)
**Author:** [@heric](https://discuss.elastic.co/u/heric)\ **Replies:** 0\ **Last updated:** [November 25, 2020, 3:49am UTC](https://discuss.elastic.co/t/elasticsearch-monitoring-sometime-not-showing-indexing-rate/256594 "2020-11-25T03:49:41Z")
Hi, Sometimes i saw the indexing rate in the monitoring is showing as below: Normally it is showing as below : Is there anything abnormal with above 1st indexing rate trend, in which direction i need to look at … --- ## [Elasticsearch and syslog-ng](https://discuss.elastic.co/t/elasticsearch-and-syslog-ng/256474)
**Author:** [@atamc3rb3r](https://discuss.elastic.co/u/atamc3rb3r)\ **Replies:** 1\ **Last updated:** [November 25, 2020, 12:56am UTC](https://discuss.elastic.co/t/elasticsearch-and-syslog-ng/256474 "2020-11-25T00:56:01Z")
Hello, I have deployed my elasticsearch (ver. 7.10.0 on Linux) with Kibana and syslog-ng. Syslog-ng server receives logs data from network devices on port UDP/514 and using module elasticsearch-http() to send all data t… --- ## [Security: Data at rest encryption with SaaS service](https://discuss.elastic.co/t/security-data-at-rest-encryption-with-saas-service/256517)
**Author:** [@stijnvr](https://discuss.elastic.co/u/stijnvr)\ **Replies:** 1\ **Last updated:** [November 25, 2020, 12:43am UTC](https://discuss.elastic.co/t/security-data-at-rest-encryption-with-saas-service/256517 "2020-11-25T00:43:42Z")
What are the possibilities to encrypt data at rest in AWS with the SaaS service? Can an AWS KMS cross-account (customer-managed/AWS-managed/AWS-owned) CMKs be used that is provided by the customer? Other possibilities? … --- ## [Understanding Joint Probability of Less Likely Samples :: calculate method](https://discuss.elastic.co/t/understanding-joint-probability-of-less-likely-samples-calculate-method/256562)
**Author:** [@ProfSimoes](https://discuss.elastic.co/u/ProfSimoes)\ **Replies:** 2\ **Last updated:** [November 24, 2020, 8:34pm UTC](https://discuss.elastic.co/t/understanding-joint-probability-of-less-likely-samples-calculate-method/256562 "2020-11-24T20:34:09Z")
I bought great Collier's book, I've read the Prelert paper about APM monitoring, and then I've been trough the ML-CPP code at github... A tiny sense of curiosity sparkled inside me about the method: ProbabilityAggrega… --- ## [Elastic \_count returns incorrect count?](https://discuss.elastic.co/t/elastic-count-returns-incorrect-count/256545)
**Author:** [@witchlightning](https://discuss.elastic.co/u/witchlightning)\ **Replies:** 0\ **Last updated:** [November 24, 2020, 5:04pm UTC](https://discuss.elastic.co/t/elastic-count-returns-incorrect-count/256545 "2020-11-24T17:04:28Z")
I just added a bunch of documents to my index but when I run a count query I see that the count hasn't changed. I've queried the index and seen that the new documents have been added. Here's the query: GET /listings/\_co… --- ## [Match all fields tokens](https://discuss.elastic.co/t/match-all-fields-tokens/256546)
**Author:** [@Anton00](https://discuss.elastic.co/u/Anton00)\ **Replies:** 0\ **Last updated:** [November 24, 2020, 5:07pm UTC](https://discuss.elastic.co/t/match-all-fields-tokens/256546 "2020-11-24T17:07:01Z")
I want to have match when all tokens from query match all field token. For example: field contains text "Red Blue Green" and query that match it should contain 3 token in any order "red", "blue", "green". I've searched a… --- ## [Config mails to send me notification of a watcher alert](https://discuss.elastic.co/t/config-mails-to-send-me-notification-of-a-watcher-alert/256540)
**Author:** [@Juan\_David\_Jaramillo](https://discuss.elastic.co/u/Juan_David_Jaramillo)\ **Replies:** 0\ **Last updated:** [November 24, 2020, 4:41pm UTC](https://discuss.elastic.co/t/config-mails-to-send-me-notification-of-a-watcher-alert/256540 "2020-11-24T16:41:16Z")
\*\*good day \*\* I'm trying to configure the emails to send me notification of a watcher alert, and configure in elasticsearch.yml, runs it without error, but when I run the alert I get this error, also configure the passw… --- ## [\[hadoop\] - Snapshots on Sonatype refer to zip instead of jar](https://discuss.elastic.co/t/hadoop-snapshots-on-sonatype-refer-to-zip-instead-of-jar/256532)
**Author:** [@jeroenst](https://discuss.elastic.co/u/jeroenst)\ **Replies:** 0\ **Last updated:** [November 24, 2020, 3:44pm UTC](https://discuss.elastic.co/t/hadoop-snapshots-on-sonatype-refer-to-zip-instead-of-jar/256532 "2020-11-24T15:44:47Z")
Hi, I'm trying to get snapshot versions for elasticsearch-hadoop, however the maven-metadata.xml refers to a zip. It seems everyday 2 releases are made, 1 jar and 1 zip, but only the zip build is referred to. https://o… --- ## [Index .tasks missing](https://discuss.elastic.co/t/index-tasks-missing/255687)
**Author:** [@aurimas](https://discuss.elastic.co/u/aurimas)\ **Replies:** 3\ **Last updated:** [November 24, 2020, 3:20pm UTC](https://discuss.elastic.co/t/index-tasks-missing/255687 "2020-11-24T15:20:37Z")
Hi, I am trying to track problematic tasks in Elasticsearch 6.8. And as I understast such tasks should be visable in .tasks index. But it is non existing and I can not find any documentation how to enable it. \_tasks AP… --- ## [Daily index and monthly index query performance difference](https://discuss.elastic.co/t/daily-index-and-monthly-index-query-performance-difference/256522)
**Author:** [@nyquillus](https://discuss.elastic.co/u/nyquillus)\ **Replies:** 2\ **Last updated:** [November 24, 2020, 2:54pm UTC](https://discuss.elastic.co/t/daily-index-and-monthly-index-query-performance-difference/256522 "2020-11-24T14:54:36Z")
Hi, I'm wondering the performance difference between daily monthly indices. Lets say i have an index named test and logstash output is configured like this: output { elasticsearch { hosts =\> \["esnode1:9200… --- ## [Using "fields.type" in logstash 7.6](https://discuss.elastic.co/t/using-fields-type-in-logstash-7-6/255105)
**Author:** [@Atul\_Chadha](https://discuss.elastic.co/u/Atul_Chadha)\ **Replies:** 2\ **Last updated:** [November 24, 2020, 2:31pm UTC](https://discuss.elastic.co/t/using-fields-type-in-logstash-7-6/255105 "2020-11-24T14:31:50Z")
Upgrading from 5.6 to 7.6, how can i use the "fields.type" in logstash to filter out data and also in output section. We had "type" field earlier configured however i believe its not longer supported now. input { beat… --- ## [Return missing ids from given list](https://discuss.elastic.co/t/return-missing-ids-from-given-list/256365)
**Author:** [@hariskhalique](https://discuss.elastic.co/u/hariskhalique)\ **Replies:** 5\ **Last updated:** [November 24, 2020, 2:29pm UTC](https://discuss.elastic.co/t/return-missing-ids-from-given-list/256365 "2020-11-24T14:29:40Z")
Hi, Is there a way, we can return only those ids which is not found in a given list. For eaxample list to search \[1,2,3,4,5,6,7,8,9,10\] and query will return etc \[2,3,8,10\] list of missing ids in ES index. Thanks in … --- ## [Metrics and Alerts for Elasticsearch](https://discuss.elastic.co/t/metrics-and-alerts-for-elasticsearch/256319)
**Author:** [@Chen\_Levi](https://discuss.elastic.co/u/Chen_Levi)\ **Replies:** 3\ **Last updated:** [November 24, 2020, 2:08pm UTC](https://discuss.elastic.co/t/metrics-and-alerts-for-elasticsearch/256319 "2020-11-24T14:08:24Z")
Hi Im trying to do pretty simple thing for our ElasticSearch cluster (Elastic.co) and i cant seems to find the right way of doing so. i have an Elasticsearch cluster managed by Elastic.co and i've used to monitor it us… --- ## [How can I check how many shards I have for an index?](https://discuss.elastic.co/t/how-can-i-check-how-many-shards-i-have-for-an-index/256510)
**Author:** [@mahalabobis](https://discuss.elastic.co/u/mahalabobis)\ **Replies:** 3\ **Last updated:** [November 24, 2020, 1:50pm UTC](https://discuss.elastic.co/t/how-can-i-check-how-many-shards-i-have-for-an-index/256510 "2020-11-24T13:50:17Z")
I'm using this command curl -X GET http://elasticsearch:9200/my-index-\*/\_settings?pretty and I'm getting "number\_of\_shards": "1". Which doesn't make much sense, because when the index is created on runtime, no settin… --- ## [Elasticsearch service times out, although cluster appears to be working properly](https://discuss.elastic.co/t/elasticsearch-service-times-out-although-cluster-appears-to-be-working-properly/256391)
**Author:** [@jtbis](https://discuss.elastic.co/u/jtbis)\ **Replies:** 6\ **Last updated:** [November 24, 2020, 12:28pm UTC](https://discuss.elastic.co/t/elasticsearch-service-times-out-although-cluster-appears-to-be-working-properly/256391 "2020-11-24T12:28:04Z")
I am facing an issue where systemd doesn't appear to realize that Elasticsearch has started successfully after updating to 6.8.0. The cluster shows green, the application can write to it and there are no errors in the l… --- ## [Average of a string text variable](https://discuss.elastic.co/t/average-of-a-string-text-variable/256166)
**Author:** [@amitvermancl](https://discuss.elastic.co/u/amitvermancl)\ **Replies:** 1\ **Last updated:** [November 24, 2020, 12:27pm UTC](https://discuss.elastic.co/t/average-of-a-string-text-variable/256166 "2020-11-24T12:27:46Z")
Hi All, I am new to elastic search SQL , and canvas side of world. I have a variable 'message' in which data comes in 't' text format and it has time duration coming in. I need to take the average of that variable an… --- ## [Packetbeat does not point to a write index](https://discuss.elastic.co/t/packetbeat-does-not-point-to-a-write-index/256478)
**Author:** [@TheHunter1](https://discuss.elastic.co/u/TheHunter1)\ **Replies:** 0\ **Last updated:** [November 24, 2020, 9:56am UTC](https://discuss.elastic.co/t/packetbeat-does-not-point-to-a-write-index/256478 "2020-11-24T09:56:43Z")
Hello, I tried to edit packetbeat Policy, and then from index management on Kibana I removed the policy from that index and then added it again (to take on consideration the new configuration), unfortunately I a gettin… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=755) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=757)