# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=759 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 760 --- ## [Using custom JVM options files in jvm.options.d/ shows duplicate JVM args](https://discuss.elastic.co/t/using-custom-jvm-options-files-in-jvm-options-d-shows-duplicate-jvm-args/256188)
**Author:** [@ben-charles](https://discuss.elastic.co/u/ben-charles)\ **Replies:** 0\ **Last updated:** [November 20, 2020, 8:43pm UTC](https://discuss.elastic.co/t/using-custom-jvm-options-files-in-jvm-options-d-shows-duplicate-jvm-args/256188 "2020-11-20T20:43:42Z")
I have a custom.options file in my config/jvm.options.d/ directory with the following contents: -Xms2g -Xmx2g When looking at the running Elasticsearch process, I see that there are two sets of command line parameters … --- ## [Filter with criteria before sum aggregation](https://discuss.elastic.co/t/filter-with-criteria-before-sum-aggregation/256051)
**Author:** [@erv](https://discuss.elastic.co/u/erv)\ **Replies:** 0\ **Last updated:** [November 19, 2020, 11:17pm UTC](https://discuss.elastic.co/t/filter-with-criteria-before-sum-aggregation/256051 "2020-11-19T23:17:35Z")
Hey everyone! I'm having a hard time with the following issue. Suppose I have the following three documents: { "entity\_id": "A", "stringField1": "SF1A", "stringField2": "SF2", "numericField": 10, … --- ## [Unable to do Cross Cluster Searching in AWS with Instances in Separate Regions](https://discuss.elastic.co/t/unable-to-do-cross-cluster-searching-in-aws-with-instances-in-separate-regions/252707)
**Author:** [@jim1](https://discuss.elastic.co/u/jim1)\ **Replies:** 5\ **Last updated:** [November 20, 2020, 5:53pm UTC](https://discuss.elastic.co/t/unable-to-do-cross-cluster-searching-in-aws-with-instances-in-separate-regions/252707 "2020-11-20T17:53:08Z")
Hello, I have two clusters installed on EC2 instances in separate regions in AWS. I am trying to use the cross cluster search feature in order to query both clusters from one central location. When I try to connect to t… --- ## [Match single keyword search term against multiple index keywords](https://discuss.elastic.co/t/match-single-keyword-search-term-against-multiple-index-keywords/256145)
**Author:** [@duncRed](https://discuss.elastic.co/u/duncRed)\ **Replies:** 0\ **Last updated:** [November 20, 2020, 3:41pm UTC](https://discuss.elastic.co/t/match-single-keyword-search-term-against-multiple-index-keywords/256145 "2020-11-20T15:41:06Z")
We are looking to match a search term keyword against multiple keywords in the index. For example if someone searches on "1780pixel" the intention would be that this matches both the keywords "1780" and "pixel" in the i… --- ## [How to find problematic search which contributes to high load and CPU usages?](https://discuss.elastic.co/t/how-to-find-problematic-search-which-contributes-to-high-load-and-cpu-usages/254091)
**Author:** [@smlbiobot](https://discuss.elastic.co/u/smlbiobot)\ **Replies:** 10\ **Last updated:** [November 20, 2020, 3:21pm UTC](https://discuss.elastic.co/t/how-to-find-problematic-search-which-contributes-to-high-load-and-cpu-usages/254091 "2020-11-20T15:21:51Z")
Recently our cluster has seen spikes of high load on some nodes. My hunch is that it has to do with some specific searches, but how do you determine which searches are causing it? I have seen some posts here saying that… --- ## [Elasticsearch hadpop error :java.lang.NoClassDefFoundError: Could not initialize class org.elasticsearch.spark.serialization.ScalaMetadataExtractor](https://discuss.elastic.co/t/elasticsearch-hadpop-error-java-lang-noclassdeffounderror-could-not-initialize-class-org-elasticsearch-spark-serialization-scalametadataextractor/256136)
**Author:** [@Vishnu\_Singhal](https://discuss.elastic.co/u/Vishnu_Singhal)\ **Replies:** 0\ **Last updated:** [November 20, 2020, 3:00pm UTC](https://discuss.elastic.co/t/elasticsearch-hadpop-error-java-lang-noclassdeffounderror-could-not-initialize-class-org-elasticsearch-spark-serialization-scalametadataextractor/256136 "2020-11-20T15:00:52Z")
Receiving following error after upgrading to spark 3.0.0 with any of the version of elasticsearch-hadoop jar \ \org.elasticsearch\ \elasticsearch-hadoop\ **Author:** [@Gauti](https://discuss.elastic.co/u/Gauti)\ **Replies:** 3\ **Last updated:** [November 20, 2020, 2:57pm UTC](https://discuss.elastic.co/t/scripted-field-for-same-month-data/256121 "2020-11-20T14:57:34Z") Hi All, We are trying to build a dashboard for a new scenario,like we are ingesting data from servicenow using logstash, the data has ticket information like opened and closed, we want to build a dashboard for monthly… --- ## [Kibana search appearing as json object?](https://discuss.elastic.co/t/kibana-search-appearing-as-json-object/255289)
**Author:** [@sandeep1-0](https://discuss.elastic.co/u/sandeep1-0)\ **Replies:** 4\ **Last updated:** [November 20, 2020, 2:48pm UTC](https://discuss.elastic.co/t/kibana-search-appearing-as-json-object/255289 "2020-11-20T14:48:30Z")
Hi, I have metricbeat data indexing to kibana but the same is appearing as json object object instead of showing it as different field. Is this due to some template issue or missed any setting. Currently coming in the … --- ## [Replicas allocation issue in a hot cold architecture](https://discuss.elastic.co/t/replicas-allocation-issue-in-a-hot-cold-architecture/255953)
**Author:** [@Travis](https://discuss.elastic.co/u/Travis)\ **Replies:** 6\ **Last updated:** [November 20, 2020, 2:45pm UTC](https://discuss.elastic.co/t/replicas-allocation-issue-in-a-hot-cold-architecture/255953 "2020-11-20T14:45:29Z")
Hello ! I have the following cluster : node1 with attributes box\_type: hot and zone: zone1 node2 with attributes box\_type: hot and zone: zone1 node3 with attributes box\_type: hot and zone: zone2 node4 with attributes b… --- ## [Matching multiple phrases to specific fields in Nest](https://discuss.elastic.co/t/matching-multiple-phrases-to-specific-fields-in-nest/256124)
**Author:** [@adiksl](https://discuss.elastic.co/u/adiksl)\ **Replies:** 0\ **Last updated:** [November 20, 2020, 1:47pm UTC](https://discuss.elastic.co/t/matching-multiple-phrases-to-specific-fields-in-nest/256124 "2020-11-20T13:47:19Z")
I have built an application in C# which searches my Elasticsearch documents and this all works fine using this code.... List\ resultsList = Client.SearchAsync\(s =\> s .From(0) .Take(noRows) … --- ## [No cached mapping for this field after upgrading to 7.10](https://discuss.elastic.co/t/no-cached-mapping-for-this-field-after-upgrading-to-7-10/256123)
**Author:** [@datawrangler](https://discuss.elastic.co/u/datawrangler)\ **Replies:** 0\ **Last updated:** [November 20, 2020, 1:29pm UTC](https://discuss.elastic.co/t/no-cached-mapping-for-this-field-after-upgrading-to-7-10/256123 "2020-11-20T13:29:35Z")
Hello all, I had some issues when upgrading to 7.9.3 that I had to upgrade to 7.10 and unfortunately I had to delete my "filebeat-\*" index pattern. After recreating the filebeat-\* index pattern, I am now unable to upda… --- ## [Rollup Fail: Existing mapping for field must be of type object](https://discuss.elastic.co/t/rollup-fail-existing-mapping-for-field-must-be-of-type-object/256122)
**Author:** [@cawoodm](https://discuss.elastic.co/u/cawoodm)\ **Replies:** 0\ **Last updated:** [November 20, 2020, 1:13pm UTC](https://discuss.elastic.co/t/rollup-fail-existing-mapping-for-field-must-be-of-type-object/256122 "2020-11-20T13:13:00Z")
Our rollup job will not run and we are getting the following error log: \[991\]: index \[issues-prod1\], type \[\_doc\], id \[issues-prod1$ONEl7qIplbk6ayAuSYbUkA\], message \[MapperParsingException\[Could not dynamically add mappi… --- ## [Master not discovered or elected yet, an election requires 2 nodes with ids](https://discuss.elastic.co/t/master-not-discovered-or-elected-yet-an-election-requires-2-nodes-with-ids/256116)
**Author:** [@xziten](https://discuss.elastic.co/u/xziten)\ **Replies:** 1\ **Last updated:** [November 20, 2020, 12:42pm UTC](https://discuss.elastic.co/t/master-not-discovered-or-elected-yet-an-election-requires-2-nodes-with-ids/256116 "2020-11-20T12:42:00Z")
Hi, I'm trying to setup an elasticsearch Cluster. I know that this is a common topic but I would like to understand what I'm doing wrong. Here are some informations : OS : RHEL 7.8 ES Version : 7.10 Nodes : 3 Mast… --- ## [Unexpected exception \[\_license\] error](https://discuss.elastic.co/t/unexpected-exception-license-error/256106)
**Author:** [@ThreatInter](https://discuss.elastic.co/u/ThreatInter)\ **Replies:** 1\ **Last updated:** [November 20, 2020, 11:49am UTC](https://discuss.elastic.co/t/unexpected-exception-license-error/256106 "2020-11-20T11:49:29Z")
Hello, everyone! We have strange error in our elasticsearch log: \[2020-11-20T15:41:59,294\]\[ERROR\]\[c.a.o.s.f.OpenDistroSecurityFilter\] \[\\] Unexpected exception \[\_license\] InvalidIndexNameException\[Invalid index… --- ## [Execute Cosine Similarity inside script\_score function if field is present in the document](https://discuss.elastic.co/t/execute-cosine-similarity-inside-script-score-function-if-field-is-present-in-the-document/253006)
**Author:** [@SatyaAditya](https://discuss.elastic.co/u/SatyaAditya)\ **Replies:** 3\ **Last updated:** [November 20, 2020, 10:56am UTC](https://discuss.elastic.co/t/execute-cosine-similarity-inside-script-score-function-if-field-is-present-in-the-document/253006 "2020-11-20T10:56:10Z")
I am trying to use cosine similarity in script\_score function. The query is breaking when the dense vector field is missing in the document against which I am trying to measure similarity is missing. I spent a lot of ti… --- ## [Unable to start Elastic search when i delete jar from lang-mustache and place it in lib](https://discuss.elastic.co/t/unable-to-start-elastic-search-when-i-delete-jar-from-lang-mustache-and-place-it-in-lib/256090)
**Author:** [@rakeshdkaatkar](https://discuss.elastic.co/u/rakeshdkaatkar)\ **Replies:** 3\ **Last updated:** [November 20, 2020, 9:06am UTC](https://discuss.elastic.co/t/unable-to-start-elastic-search-when-i-delete-jar-from-lang-mustache-and-place-it-in-lib/256090 "2020-11-20T09:06:21Z")
Im getting below error java.lang.IllegalStateException: Plugin \[lang-mustache\] must reference a class loader local Plugin class \[org.elasticsearch.script.mustache.MustachePlugin\] (class loader \[sun.misc.Launcher$AppClas… --- ## [Managing "is\_write\_index"](https://discuss.elastic.co/t/managing-is-write-index/256089)
**Author:** [@koos](https://discuss.elastic.co/u/koos)\ **Replies:** 2\ **Last updated:** [November 20, 2020, 8:50am UTC](https://discuss.elastic.co/t/managing-is-write-index/256089 "2020-11-20T08:50:38Z")
Hi there, We've created a Lambda function (python) in order to steam logs from AWS CloudWatch to our ELK stack. I'm also making use of life cycle policies to rotate the index on a specific size and delete after the spe… --- ## [Find documents which is older then specified date range based on list of ids](https://discuss.elastic.co/t/find-documents-which-is-older-then-specified-date-range-based-on-list-of-ids/255843)
**Author:** [@sibasish.palo](https://discuss.elastic.co/u/sibasish.palo)\ **Replies:** 2\ **Last updated:** [November 20, 2020, 8:23am UTC](https://discuss.elastic.co/t/find-documents-which-is-older-then-specified-date-range-based-on-list-of-ids/255843 "2020-11-20T08:23:13Z")
After searching for sometime and seeing some answer not able to quite figure out the query for my requirement My requirement is i have a list of document ids, what i need to find is the documents which are older than a … --- ## [Add \_routing via document not query string](https://discuss.elastic.co/t/add-routing-via-document-not-query-string/255458)
**Author:** [@pcb](https://discuss.elastic.co/u/pcb)\ **Replies:** 1\ **Last updated:** [November 20, 2020, 8:11am UTC](https://discuss.elastic.co/t/add-routing-via-document-not-query-string/255458 "2020-11-20T08:11:08Z")
Hi ya, I'm attempting to use Elasticsearch custom routing in conjunction with Confluent's Kafka Elasticsearch Sink. Every thing is going well until I've run into custom routing which it doesn't seem to support. I can't… --- ## [Ingest pipeline with enrich policy that matches by \_id - not supported?](https://discuss.elastic.co/t/ingest-pipeline-with-enrich-policy-that-matches-by-id-not-supported/255543)
**Author:** [@djmcgreal](https://discuss.elastic.co/u/djmcgreal)\ **Replies:** 1\ **Last updated:** [November 20, 2020, 8:08am UTC](https://discuss.elastic.co/t/ingest-pipeline-with-enrich-policy-that-matches-by-id-not-supported/255543 "2020-11-20T08:08:41Z")
Hi, I'd like to deduplicate data. We're hashing a subset of fields of the events into the document identifier. To do this in an ingest pipeline, I'd like to have an enrich policy like so: PUT /\_enrich/policy/event-… --- ## [Sql query giving null ouput](https://discuss.elastic.co/t/sql-query-giving-null-ouput/255945)
**Author:** [@rohitarorait82](https://discuss.elastic.co/u/rohitarorait82)\ **Replies:** 5\ **Last updated:** [November 20, 2020, 7:44am UTC](https://discuss.elastic.co/t/sql-query-giving-null-ouput/255945 "2020-11-20T07:44:52Z")
Hi All, I am stuck with sql query output, can anyone please help POST \_sql?format=txt { "query": "SELECT SERVICE\_NAME,CASE WHEN MSA\_STATUS.keyword ='PUBLISH' AND MSA\_FLOW\_DIR.keyword ='EAI - SCRM specific processing' … --- ## [How to find out if password of elastic user is already set or not](https://discuss.elastic.co/t/how-to-find-out-if-password-of-elastic-user-is-already-set-or-not/254872)
**Author:** [@MartinG](https://discuss.elastic.co/u/MartinG)\ **Replies:** 1\ **Last updated:** [November 20, 2020, 7:08am UTC](https://discuss.elastic.co/t/how-to-find-out-if-password-of-elastic-user-is-already-set-or-not/254872 "2020-11-20T07:08:48Z")
Hi there, I am building up Elasticsearch clusters automatically with Ansible and have a problem with the initial setting of the "elastic" user password. As described in the documentation a initial and transient bootstr… --- ## [Having read-only shard greater than 50 GB](https://discuss.elastic.co/t/having-read-only-shard-greater-than-50-gb/256061)
**Author:** [@sandeepkanabar](https://discuss.elastic.co/u/sandeepkanabar)\ **Replies:** 2\ **Last updated:** [November 20, 2020, 5:32am UTC](https://discuss.elastic.co/t/having-read-only-shard-greater-than-50-gb/256061 "2020-11-20T05:32:39Z")
I recently re-indexed past 18 months of day-wise indices (18 months \*30 days = 540 indices with 1 primary shard per index) into 18 monthly indices (18 indices with 12 primary shards per index). No indexing happens on th… --- ## [Failed to set password for user \[apm\_system\] with elastic password](https://discuss.elastic.co/t/failed-to-set-password-for-user-apm-system-with-elastic-password/256005)
**Author:** [@xziten](https://discuss.elastic.co/u/xziten)\ **Replies:** 3\ **Last updated:** [November 20, 2020, 5:12am UTC](https://discuss.elastic.co/t/failed-to-set-password-for-user-apm-system-with-elastic-password/256005 "2020-11-20T05:12:24Z")
Hi, I'm trying to setup an elasticsearch cluster. 3 nodes : 1 master, 1 master / data\_hot, 1 data\_warm Elastic Version : 7.10 System : RHEL 8.3 Step by step : Installing Configuring nodes and test if everything… --- ## [Config SSL/TLS Kibana and Elasticsearch](https://discuss.elastic.co/t/config-ssl-tls-kibana-and-elasticsearch/255820)
**Author:** [@aloalo2242](https://discuss.elastic.co/u/aloalo2242)\ **Replies:** 4\ **Last updated:** [November 20, 2020, 2:37am UTC](https://discuss.elastic.co/t/config-ssl-tls-kibana-and-elasticsearch/255820 "2020-11-20T02:37:23Z")
Hi, Im trying to enable Fleet in Ingest Manager. And it say I have to enable this xpack.security.authc.api\_key.enabled: true in elasticsearch.yml. But if add that line, I have to add bellow line too: xpack.security.en… --- ## [Policy to automatically delete indexes with max days and size](https://discuss.elastic.co/t/policy-to-automatically-delete-indexes-with-max-days-and-size/255995)
**Author:** [@cruizba](https://discuss.elastic.co/u/cruizba)\ **Replies:** 2\ **Last updated:** [November 20, 2020, 12:28am UTC](https://discuss.elastic.co/t/policy-to-automatically-delete-indexes-with-max-days-and-size/255995 "2020-11-20T00:28:14Z")
Hello to all the Elastic Stack community and developers :slight\_smile: We have a server that use Elasticsearch to store logs, events and metrics. This server configure a policy which delete an Index if it is older that … --- ## [Action Shrink n Reindex with Curator](https://discuss.elastic.co/t/action-shrink-n-reindex-with-curator/256028)
**Author:** [@Beuhlet\_Reseau](https://discuss.elastic.co/u/Beuhlet_Reseau)\ **Replies:** 0\ **Last updated:** [November 19, 2020, 6:25pm UTC](https://discuss.elastic.co/t/action-shrink-n-reindex-with-curator/256028 "2020-11-19T18:25:18Z")
Hello, I need to shrink an index called log\_index\_ARC (too many shards/replicas). Also, i want after shrink process, add an alias on new shrink index (log\_index\_ARC-shrink) to log\_index\_ARC (original value so). Here m… --- ## [Is it possible to use payload as input to an exec output command?](https://discuss.elastic.co/t/is-it-possible-to-use-payload-as-input-to-an-exec-output-command/256042)
**Author:** [@esguy](https://discuss.elastic.co/u/esguy)\ **Replies:** 1\ **Last updated:** [November 19, 2020, 10:18pm UTC](https://discuss.elastic.co/t/is-it-possible-to-use-payload-as-input-to-an-exec-output-command/256042 "2020-11-19T22:18:14Z")
Hello, I have a watcher set up with multiple email actions where each email action has a conditional checking whats in the user field of the payload. For example, if user = 'userGroupA', then it will execute the action … --- ## [Integration Office365](https://discuss.elastic.co/t/integration-office365/256023)
**Author:** [@nottellingyou](https://discuss.elastic.co/u/nottellingyou)\ **Replies:** 1\ **Last updated:** [November 19, 2020, 9:13pm UTC](https://discuss.elastic.co/t/integration-office365/256023 "2020-11-19T21:13:55Z")
Has anyone successfully integrated o365 with integrations in ElasticCloud? --- ## [Elasticsearch 7.7.1 shards getting unassigned](https://discuss.elastic.co/t/elasticsearch-7-7-1-shards-getting-unassigned/256006)
**Author:** [@Deb](https://discuss.elastic.co/u/Deb)\ **Replies:** 5\ **Last updated:** [November 19, 2020, 6:37pm UTC](https://discuss.elastic.co/t/elasticsearch-7-7-1-shards-getting-unassigned/256006 "2020-11-19T18:37:53Z")
We recently upgraded our elasticsearch cluster from 5.6.16 to 7.7.1. After that sometimes I am observing that few of the shards not getting assigned. My node stats is placed here. The allocation explanation for an una… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=758) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=760)