# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=768 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 769 --- ## [CreateJavaVM Failed](https://discuss.elastic.co/t/createjavavm-failed/254928)
**Author:** [@Vitalii\_Kolomiichuk](https://discuss.elastic.co/u/Vitalii_Kolomiichuk)\ **Replies:** 0\ **Last updated:** [November 10, 2020, 3:10pm UTC](https://discuss.elastic.co/t/createjavavm-failed/254928 "2020-11-10T15:10:40Z")
Please help. Can't start elasticsearch service. All configured. JAVA\_HOME in system variables. I tried all solutions that found. Nothing helps. \[2020-11-10 16:28:28\] \[debug\] ( prunsrv.c:1729) \[ 7340\] Commons Daemon pro… --- ## [Get Logs From SAP Cloud Plateform Cockpit](https://discuss.elastic.co/t/get-logs-from-sap-cloud-plateform-cockpit/254910)
**Author:** [@med1](https://discuss.elastic.co/u/med1)\ **Replies:** 0\ **Last updated:** [November 10, 2020, 12:54pm UTC](https://discuss.elastic.co/t/get-logs-from-sap-cloud-plateform-cockpit/254910 "2020-11-10T12:54:37Z")
Hello Colleagues , I would like to extract logs from SAP cloud plateform cockpit using open source logging platform Elasticsearch, Logstash, Kibana . Did someone has any idea regarding this topic . Thanks . Mohamed … --- ## [Elasticsearch 7.9.3 on Mac dies when inserting documents fast](https://discuss.elastic.co/t/elasticsearch-7-9-3-on-mac-dies-when-inserting-documents-fast/254809)
**Author:** [@Toontje](https://discuss.elastic.co/u/Toontje)\ **Replies:** 7\ **Last updated:** [November 10, 2020, 12:41pm UTC](https://discuss.elastic.co/t/elasticsearch-7-9-3-on-mac-dies-when-inserting-documents-fast/254809 "2020-11-10T12:41:53Z")
I use node-red to transform an existing JSON document and insert individual small JSON document using the POST command. Apparently i do this too fast because after a few seconds port 9200 stops responding. What is best … --- ## [Elasticsearch is not started in server](https://discuss.elastic.co/t/elasticsearch-is-not-started-in-server/254888)
**Author:** [@nagaraju.sbd](https://discuss.elastic.co/u/nagaraju.sbd)\ **Replies:** 8\ **Last updated:** [November 10, 2020, 11:32am UTC](https://discuss.elastic.co/t/elasticsearch-is-not-started-in-server/254888 "2020-11-10T11:32:34Z")
elasticsearch.service: main process exited, code=exited, status=78/n/a Failed to start Elasticsearch. --- ## [Delete old documents](https://discuss.elastic.co/t/delete-old-documents/254591)
**Author:** [@smruthip](https://discuss.elastic.co/u/smruthip)\ **Replies:** 3\ **Last updated:** [November 10, 2020, 11:23am UTC](https://discuss.elastic.co/t/delete-old-documents/254591 "2020-11-10T11:23:46Z")
Is there a way to delete old documents based on a filed which has timestamp? What I want to do is just keep the latest document per id example id. timestamp 1 1pm 1 2pm 1 3pm 1 4pm 2. 3pm 2. 4pm 2. 6pm … --- ## [Missing Elasticsearch menu in Kibana](https://discuss.elastic.co/t/missing-elasticsearch-menu-in-kibana/254799)
**Author:** [@Lorenzo\_Allori](https://discuss.elastic.co/u/Lorenzo_Allori)\ **Replies:** 5\ **Last updated:** [November 10, 2020, 10:29am UTC](https://discuss.elastic.co/t/missing-elasticsearch-menu-in-kibana/254799 "2020-11-10T10:29:58Z")
Hello I created a new installation from docker using: elasticsearch:7.8.0 kibana:7.8.0 these two docker images. But when i use kibana I cannot see the Elasticsearch menu (access to index patterns etc.=). Is it possi… --- ## [\_async\_search thowing access denieds in elasticsearch audit logs](https://discuss.elastic.co/t/async-search-thowing-access-denieds-in-elasticsearch-audit-logs/254811)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 2\ **Last updated:** [November 10, 2020, 8:38am UTC](https://discuss.elastic.co/t/async-search-thowing-access-denieds-in-elasticsearch-audit-logs/254811 "2020-11-10T08:38:36Z")
Hello, So I made a SIEM rule which triggers on access\_denied in event.action on Elastic audit logs. And so I discovered the user \_async\_search triggers this rule. I guess I can safely exclude this, but I'm curious… --- ## [Search analyser + preserve special characters](https://discuss.elastic.co/t/search-analyser-preserve-special-characters/254883)
**Author:** [@Liam\_Aird](https://discuss.elastic.co/u/Liam_Aird)\ **Replies:** 0\ **Last updated:** [November 10, 2020, 9:19am UTC](https://discuss.elastic.co/t/search-analyser-preserve-special-characters/254883 "2020-11-10T09:19:07Z")
Hi, I am having somewhat of an issue here that I cannot seem to solve after a few different attempts and days worth of googling. I am using the synonyms filter - and read that it would be better to do so search time in… --- ## [Ingest nodes don't load balance the pipeline load](https://discuss.elastic.co/t/ingest-nodes-dont-load-balance-the-pipeline-load/254876)
**Author:** [@keshara](https://discuss.elastic.co/u/keshara)\ **Replies:** 0\ **Last updated:** [November 10, 2020, 9:01am UTC](https://discuss.elastic.co/t/ingest-nodes-dont-load-balance-the-pipeline-load/254876 "2020-11-10T09:01:46Z")
Hi, I have a ECK cluster where maintaining dedicated two ingest nodes, specially to isolate and get my pipelines working across them. While it is running I noticed only one node being utilized 100% cpu where the other o… --- ## [Delete by query](https://discuss.elastic.co/t/delete-by-query/254847)
**Author:** [@vikramaddagulla](https://discuss.elastic.co/u/vikramaddagulla)\ **Replies:** 1\ **Last updated:** [November 10, 2020, 8:40am UTC](https://discuss.elastic.co/t/delete-by-query/254847 "2020-11-10T08:40:34Z")
Hello, I would like to delete some data in the index older than a certain time... I am trying to use the delete by query index...However, before trying to delete the data, I am trying to view the data older than the ti… --- ## [Limit the age of documents in a rollup job](https://discuss.elastic.co/t/limit-the-age-of-documents-in-a-rollup-job/254865)
**Author:** [@Culme](https://discuss.elastic.co/u/Culme)\ **Replies:** 0\ **Last updated:** [November 10, 2020, 8:18am UTC](https://discuss.elastic.co/t/limit-the-age-of-documents-in-a-rollup-job/254865 "2020-11-10T08:18:15Z")
Hi Forum. Is it possible to limit the age of documents being included in a rollup? I have been experimenting a bit with rollups, and there's one thing I'm missing. When you create a new rollup job and schedule it to r… --- ## [Elasticsearch moving node out of cluster](https://discuss.elastic.co/t/elasticsearch-moving-node-out-of-cluster/254653)
**Author:** [@RAM\_NATHAN](https://discuss.elastic.co/u/RAM_NATHAN)\ **Replies:** 18\ **Last updated:** [November 10, 2020, 7:13am UTC](https://discuss.elastic.co/t/elasticsearch-moving-node-out-of-cluster/254653 "2020-11-10T07:13:08Z")
Hi I have a cluster by name "as\_elasticsearch" and I have deleted a node from that cluster as below curl -XPUT P.P.P.P:9200/\_cluster/settings -H 'Content-Type: application/json' -d '{ "transient" :{ "cluster.routing.… --- ## [Primary shard size higher than replicas](https://discuss.elastic.co/t/primary-shard-size-higher-than-replicas/254852)
**Author:** [@Susheem\_Koul](https://discuss.elastic.co/u/Susheem_Koul)\ **Replies:** 0\ **Last updated:** [November 10, 2020, 6:48am UTC](https://discuss.elastic.co/t/primary-shard-size-higher-than-replicas/254852 "2020-11-10T06:48:14Z")
Hi, We've been observing some strange behaviour on our ES Cluster for the last few weeks with the primary for a shard having a much higher size than the replica. Here's the output for shard details API. Notice shard 2 … --- ## [Implement collocation in ElasticSearch](https://discuss.elastic.co/t/implement-collocation-in-elasticsearch/254118)
**Author:** [@a22xel](https://discuss.elastic.co/u/a22xel)\ **Replies:** 1\ **Last updated:** [November 9, 2020, 10:16pm UTC](https://discuss.elastic.co/t/implement-collocation-in-elasticsearch/254118 "2020-11-09T22:16:16Z")
I am new in Elastic Search Usage I am trying to do an analyser or an ingest pipeline that would create collocations of words ( unigram, bigrams, trigrams with a step up to 2 ) . I am aware it's feasible in python but I a… --- ## [Memory & CPU stats for Xpack Monitoring plugin](https://discuss.elastic.co/t/memory-cpu-stats-for-xpack-monitoring-plugin/254810)
**Author:** [@valleram](https://discuss.elastic.co/u/valleram)\ **Replies:** 3\ **Last updated:** [November 9, 2020, 10:15pm UTC](https://discuss.elastic.co/t/memory-cpu-stats-for-xpack-monitoring-plugin/254810 "2020-11-09T22:15:13Z")
Hi All, Is there a way to know how much system resources(MEM and CPU) is xpack.monitoring consuming? Any help would be much appreciated Thank You --- ## [ILM policy behaviour with disk-based shard allocation settings](https://discuss.elastic.co/t/ilm-policy-behaviour-with-disk-based-shard-allocation-settings/254766)
**Author:** [@Tarasovych](https://discuss.elastic.co/u/Tarasovych)\ **Replies:** 1\ **Last updated:** [November 9, 2020, 10:14pm UTC](https://discuss.elastic.co/t/ilm-policy-behaviour-with-disk-based-shard-allocation-settings/254766 "2020-11-09T22:14:26Z")
Hi! I have a cluster with two host data nodes, one warm data node and one cold data node. I have a policy which moves indices from hot to warm, when index grows up to 1gb. I'd like to know, what will happen if warm data… --- ## [How to "recreate" events from an index by just changing time?](https://discuss.elastic.co/t/how-to-recreate-events-from-an-index-by-just-changing-time/254761)
**Author:** [@kelk](https://discuss.elastic.co/u/kelk)\ **Replies:** 1\ **Last updated:** [November 9, 2020, 10:06pm UTC](https://discuss.elastic.co/t/how-to-recreate-events-from-an-index-by-just-changing-time/254761 "2020-11-09T22:06:21Z")
hi We have some "enriched" events in an index from last month for a customer product checkout. The enrichment has happened in "elastic beats" && "logstash" and not entirely in my control. So I cannot simulate the \_raw e… --- ## [XPack encryption mechanism/Suite](https://discuss.elastic.co/t/xpack-encryption-mechanism-suite/254773)
**Author:** [@Pooja](https://discuss.elastic.co/u/Pooja)\ **Replies:** 1\ **Last updated:** [November 9, 2020, 9:57pm UTC](https://discuss.elastic.co/t/xpack-encryption-mechanism-suite/254773 "2020-11-09T21:57:14Z")
What kind of encryption methodology does Xpack use to encrypt data? Also, is the present version of ELK stack provide Xpack for free? --- ## [High load (\>3.0.0), 60% CPU and 30% heap usage](https://discuss.elastic.co/t/high-load-3-0-0-60-cpu-and-30-heap-usage/254278)
**Author:** [@amackenzie](https://discuss.elastic.co/u/amackenzie)\ **Replies:** 3\ **Last updated:** [November 9, 2020, 8:47pm UTC](https://discuss.elastic.co/t/high-load-3-0-0-60-cpu-and-30-heap-usage/254278 "2020-11-09T20:47:35Z")
Hi there, I'm wondering if someone could help me analyse this hot thread output. We have a number of data nodes. All of these data nodes also ingest and index too. We're using ES 5.6 Thank you, Ally --- ## [Foreach for bucket aggregation in watcher not working](https://discuss.elastic.co/t/foreach-for-bucket-aggregation-in-watcher-not-working/254523)
**Author:** [@priti](https://discuss.elastic.co/u/priti)\ **Replies:** 6\ **Last updated:** [November 9, 2020, 6:10pm UTC](https://discuss.elastic.co/t/foreach-for-bucket-aggregation-in-watcher-not-working/254523 "2020-11-09T18:10:58Z")
Hi , I am trying to logging according to user using foreach but it is giving exception "type" : "exception", "reason" : "specified foreach object was null: \[ctx.payload.aggregations.user.buckets.keys\]" } Foreach C… --- ## [ILM not executing DELETE phase](https://discuss.elastic.co/t/ilm-not-executing-delete-phase/254776)
**Author:** [@radw](https://discuss.elastic.co/u/radw)\ **Replies:** 1\ **Last updated:** [November 9, 2020, 4:38pm UTC](https://discuss.elastic.co/t/ilm-not-executing-delete-phase/254776 "2020-11-09T16:38:36Z")
Hi all! I'm using ELK stack v7.6.2 and v7.4.0. The same behaviour is happening on both versions. I've created an ILM policy together with timeseries indices and a template for an index. My ILM is rolling over my index… --- ## [Cat api nodes returning stale data?](https://discuss.elastic.co/t/cat-api-nodes-returning-stale-data/254656)
**Author:** [@falkenbt](https://discuss.elastic.co/u/falkenbt)\ **Replies:** 9\ **Last updated:** [November 9, 2020, 4:00pm UTC](https://discuss.elastic.co/t/cat-api-nodes-returning-stale-data/254656 "2020-11-09T16:00:46Z")
ES version: 7.7.1 In our startup/shutdown scripts we call \_cat/nodes in order to get the number of running nodes to decide if we need to change the shard allocation (only the first stop should change it). The script the… --- ## [Is there a mecanism to check that the data coming from the source (filebeat) is the same that we have in elastic](https://discuss.elastic.co/t/is-there-a-mecanism-to-check-that-the-data-coming-from-the-source-filebeat-is-the-same-that-we-have-in-elastic/253674)
**Author:** [@soufian.eldouqe](https://discuss.elastic.co/u/soufian.eldouqe)\ **Replies:** 6\ **Last updated:** [November 9, 2020, 3:46pm UTC](https://discuss.elastic.co/t/is-there-a-mecanism-to-check-that-the-data-coming-from-the-source-filebeat-is-the-same-that-we-have-in-elastic/253674 "2020-11-09T15:46:04Z")
Hello everyone, We are using logstash to parse our application log and index to elastic search. Following is the high level architecture file beat -----\> Logstash ----\> Elastic search ------\> kibana. How can we verify… --- ## [Handle Sepcial char in elasticsearch](https://discuss.elastic.co/t/handle-sepcial-char-in-elasticsearch/254785)
**Author:** [@Shivesh\_Srivastava](https://discuss.elastic.co/u/Shivesh_Srivastava)\ **Replies:** 0\ **Last updated:** [November 9, 2020, 3:46pm UTC](https://discuss.elastic.co/t/handle-sepcial-char-in-elasticsearch/254785 "2020-11-09T15:46:04Z")
My Elasticsearch version is 6.8.3 and I am trying to fetch data against the Lucene query which contains filter value as \\\\\\\\\*\\\\abc$ I have some code, which handles the special characters and the above filter value is c… --- ## [Elasticsearch cluster](https://discuss.elastic.co/t/elasticsearch-cluster/252379)
**Author:** [@bognad](https://discuss.elastic.co/u/bognad)\ **Replies:** 6\ **Last updated:** [November 9, 2020, 3:32pm UTC](https://discuss.elastic.co/t/elasticsearch-cluster/252379 "2020-11-09T15:32:46Z")
Good day! I am having difficulty to create 2 nodes cluster, each nodes has different "cluster.uuid". Why? How add node to cluster? Node A cluster.name: "elk-cluster" network.host: 0.0.0.0 node.name: primary cluster… --- ## [Convert scientific notation (ex: 7.533992951114973E-4) to float](https://discuss.elastic.co/t/convert-scientific-notation-ex-7-533992951114973e-4-to-float/254482)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 1\ **Last updated:** [November 9, 2020, 3:08pm UTC](https://discuss.elastic.co/t/convert-scientific-notation-ex-7-533992951114973e-4-to-float/254482 "2020-11-09T15:08:35Z")
Im trying to add the actual and typical field to the ML alerts on watcher, is there a method in painless to convert scientific notation to float? "actual" : \[ 7.533992951114973E-4 … --- ## [Indices gone after upgrade (7.8.0 to 7.9.1)](https://discuss.elastic.co/t/indices-gone-after-upgrade-7-8-0-to-7-9-1/254149)
**Author:** [@rcz](https://discuss.elastic.co/u/rcz)\ **Replies:** 5\ **Last updated:** [November 9, 2020, 3:05pm UTC](https://discuss.elastic.co/t/indices-gone-after-upgrade-7-8-0-to-7-9-1/254149 "2020-11-09T15:05:55Z")
Hello, I'm in a bit of a pickle. A lot of my indices are gone after an upgrade. I have a Logstash pumping in data into an alias. The alias still pointed to the same index name after upgrading, but the old data was gon… --- ## [Need help on "sum by group" aggregations on simple doc structure](https://discuss.elastic.co/t/need-help-on-sum-by-group-aggregations-on-simple-doc-structure/254672)
**Author:** [@ElasBon](https://discuss.elastic.co/u/ElasBon)\ **Replies:** 4\ **Last updated:** [November 9, 2020, 2:46pm UTC](https://discuss.elastic.co/t/need-help-on-sum-by-group-aggregations-on-simple-doc-structure/254672 "2020-11-09T14:46:56Z")
I'm using es 7.8.1, my data are pojo records like this: { "timestamp": "2020-11-07 08:00:00", "lineId": 532, "sn": "A2600101000005DF", "upBytes": 5927, "dlBytes": 13706 } … --- ## [Boolean similarity - is there a way to remove duplicates](https://discuss.elastic.co/t/boolean-similarity-is-there-a-way-to-remove-duplicates/253809)
**Author:** [@Miljenko\_Norsic](https://discuss.elastic.co/u/Miljenko_Norsic)\ **Replies:** 3\ **Last updated:** [November 9, 2020, 1:42pm UTC](https://discuss.elastic.co/t/boolean-similarity-is-there-a-way-to-remove-duplicates/253809 "2020-11-09T13:42:26Z")
Given the following index: { "mappings": { "properties": { "field1": { "type": "text", "analyzer": "whitespace", "similarity": "boolean" }, "field… --- ## [How to auto apply index policy to newly created indexes in AWS Elasticsearch](https://discuss.elastic.co/t/how-to-auto-apply-index-policy-to-newly-created-indexes-in-aws-elasticsearch/254734)
**Author:** [@nitin194](https://discuss.elastic.co/u/nitin194)\ **Replies:** 2\ **Last updated:** [November 9, 2020, 1:03pm UTC](https://discuss.elastic.co/t/how-to-auto-apply-index-policy-to-newly-created-indexes-in-aws-elasticsearch/254734 "2020-11-09T13:03:49Z")
We push Nginx logs to AWS Elasticsearch using Filebeat and Logstash. We have created an index pattern with the name nginx-error-logs\* & nginx-access-logs\*. We can see in Kibana that daily new indices are being created ba… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=767) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=769)