# Elasticsearch

**URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=773

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 774

---

## [Java high-level REST client: There is no way to recover after a \`ContentTooLongException\` and \`IOReactorException\`](https://discuss.elastic.co/t/java-high-level-rest-client-there-is-no-way-to-recover-after-a-contenttoolongexception-and-ioreactorexception/254167)

<div class="topic-metadata">

**Author:** [@RomanWuattier](https://discuss.elastic.co/u/RomanWuattier)\
**Replies:** 0\
**Last updated:** [November 3, 2020, 2:49pm UTC](https://discuss.elastic.co/t/java-high-level-rest-client-there-is-no-way-to-recover-after-a-contenttoolongexception-and-ioreactorexception/254167 "2020-11-03T14:49:04Z")

</div>

Hi, version: 7.9.1 Context We are using the Java high-level REST client. When executing a search request, and the response's size exceeds the buffered heap, then a ContentTooLongException and IOReactorException are t…

---

## [Query documents to match a value in a sublist of a list](https://discuss.elastic.co/t/query-documents-to-match-a-value-in-a-sublist-of-a-list/253831)

<div class="topic-metadata">

**Author:** [@agonzalez](https://discuss.elastic.co/u/agonzalez)\
**Replies:** 2\
**Last updated:** [November 3, 2020, 2:44pm UTC](https://discuss.elastic.co/t/query-documents-to-match-a-value-in-a-sublist-of-a-list/253831 "2020-11-03T14:44:55Z")

</div>

I am storing windows folder permissions in elastic as a document per folder, then each folder has a list of users that has access to this folder, and each user has list of permissions (accessmask) that is stored as a lis…

---

## [Not getting any response on POST and BULK requests](https://discuss.elastic.co/t/not-getting-any-response-on-post-and-bulk-requests/254155)

<div class="topic-metadata">

**Author:** [@kpiyush](https://discuss.elastic.co/u/kpiyush)\
**Replies:** 3\
**Last updated:** [November 3, 2020, 2:43pm UTC](https://discuss.elastic.co/t/not-getting-any-response-on-post-and-bulk-requests/254155 "2020-11-03T14:43:20Z")

</div>

Hi, As the title says, any post or bulk request, basically any writes is not working. I checked the cluster health and the status is green. I also checked for disk usage and more than half is available. I ran following…

---

## [What's different between reindexing an exist document and updating some field of document?](https://discuss.elastic.co/t/whats-different-between-reindexing-an-exist-document-and-updating-some-field-of-document/254152)

<div class="topic-metadata">

**Author:** [@DumpCat](https://discuss.elastic.co/u/DumpCat)\
**Replies:** 3\
**Last updated:** [November 3, 2020, 2:33pm UTC](https://discuss.elastic.co/t/whats-different-between-reindexing-an-exist-document-and-updating-some-field-of-document/254152 "2020-11-03T14:33:06Z")

</div>

If I have an exist document，is reindexing whole new document better than updating some field of document?

---

## [How to get elasticsearch URI](https://discuss.elastic.co/t/how-to-get-elasticsearch-uri/254159)

<div class="topic-metadata">

**Author:** [@grynhtjnyuk](https://discuss.elastic.co/u/grynhtjnyuk)\
**Replies:** 3\
**Last updated:** [November 3, 2020, 2:31pm UTC](https://discuss.elastic.co/t/how-to-get-elasticsearch-uri/254159 "2020-11-03T14:31:09Z")

</div>

I have created an account on this website ( https://www.elastic.co/downloads/ ), I have an access to elastic-stack. But, could you please tell me how can I see elasticsearch Uri to use it in my own application.

---

## [Making a delay scripted field from a field containing several dates](https://discuss.elastic.co/t/making-a-delay-scripted-field-from-a-field-containing-several-dates/254063)

<div class="topic-metadata">

**Author:** [@Mike\_Di](https://discuss.elastic.co/u/Mike_Di)\
**Replies:** 0\
**Last updated:** [November 2, 2020, 5:45pm UTC](https://discuss.elastic.co/t/making-a-delay-scripted-field-from-a-field-containing-several-dates/254063 "2020-11-02T17:45:47Z")

</div>

Hello, i would like to make a scripted field of a delay process time from a field which contains several dates separated by a comma like this dates\_multi : 2020-07-17 04:02:00,2020-07-24 04:02:00,2020-07-31 04:02:00,20…

---

## [Elasticsearch: Max virtual memory areas vm.max\_map\_count \[65530\] is too low, increase to at least \[262144\] Helm](https://discuss.elastic.co/t/elasticsearch-max-virtual-memory-areas-vm-max-map-count-65530-is-too-low-increase-to-at-least-262144-helm/254150)

<div class="topic-metadata">

**Author:** [@Sanjeev\_kumar\_N](https://discuss.elastic.co/u/Sanjeev_kumar_N)\
**Replies:** 0\
**Last updated:** [November 3, 2020, 12:10pm UTC](https://discuss.elastic.co/t/elasticsearch-max-virtual-memory-areas-vm-max-map-count-65530-is-too-low-increase-to-at-least-262144-helm/254150 "2020-11-03T12:10:55Z")

</div>

Hi Team, Trying to configure elastic search via helm chart. Please find the below are steps. helm create ele cat values.yaml imageELE: repository: X.X.X.X:8085/elasticsearch pullPolicy: IfNotPresent Overrides the i…

---

## [More then one attached file in to index](https://discuss.elastic.co/t/more-then-one-attached-file-in-to-index/254133)

<div class="topic-metadata">

**Author:** [@lucrug](https://discuss.elastic.co/u/lucrug)\
**Replies:** 1\
**Last updated:** [November 3, 2020, 11:28am UTC](https://discuss.elastic.co/t/more-then-one-attached-file-in-to-index/254133 "2020-11-03T11:28:38Z")

</div>

Hi gays, can i define more then one attached (RFT) field in a index? This example is for one: PUT \_ingest/pipeline/attachment { "description" : "Extract attachment information", "processors" : \[ { "attac…

---

## [Mapping for dynamic JSON payload](https://discuss.elastic.co/t/mapping-for-dynamic-json-payload/254132)

<div class="topic-metadata">

**Author:** [@akihu](https://discuss.elastic.co/u/akihu)\
**Replies:** 4\
**Last updated:** [November 3, 2020, 11:22am UTC](https://discuss.elastic.co/t/mapping-for-dynamic-json-payload/254132 "2020-11-03T11:22:16Z")

</div>

Good day to everyone! I'm trying to send JSON formated data directly to elasticsearch by using elasticsearch python library but I'm having a fight here with the index mapping. How can one define dynamic mapping to JSON…

---

## [Unable to start Elasticsearch 7.6.2](https://discuss.elastic.co/t/unable-to-start-elasticsearch-7-6-2/254128)

<div class="topic-metadata">

**Author:** [@Laamimech\_Salah](https://discuss.elastic.co/u/Laamimech_Salah)\
**Replies:** 0\
**Last updated:** [November 3, 2020, 10:02am UTC](https://discuss.elastic.co/t/unable-to-start-elasticsearch-7-6-2/254128 "2020-11-03T10:02:45Z")

</div>

Hi, We are upgrading the ELK stack from v6.8.13 to v7.6.2 and we've encountered the following issue with OS Linux RHEL 7.1 : \[2020-11-02T15:44:00,757\]\[ERROR\]\[o.e.b.ElasticsearchUncaughtExceptionHandler\]fatal error …

---

## [Find maximum and minimum time difference](https://discuss.elastic.co/t/find-maximum-and-minimum-time-difference/254126)

<div class="topic-metadata">

**Author:** [@rohitarorait82](https://discuss.elastic.co/u/rohitarorait82)\
**Replies:** 0\
**Last updated:** [November 3, 2020, 9:51am UTC](https://discuss.elastic.co/t/find-maximum-and-minimum-time-difference/254126 "2020-11-03T09:51:59Z")

</div>

Hi All, Is there a way to find out the maximum and minimum time difference for 3rd column in the query below; whenever I am trying to order it by 3rd column I am getting below error Cannot order by non-grouped column Q…

---

## [.kibana Indices](https://discuss.elastic.co/t/kibana-indices/254120)

<div class="topic-metadata">

**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\
**Replies:** 2\
**Last updated:** [November 3, 2020, 9:21am UTC](https://discuss.elastic.co/t/kibana-indices/254120 "2020-11-03T09:21:26Z")

</div>

I want to change .kibana indices shards and replicas but nothing works PUT /\_template/custom\_kibana { "index\_patterns": ".kibana\*", "order": 1, "settings": { "number\_of\_shards": 3, "number\_of\_replicas": 1 …

---

## [Elasticsearch G1GC tuning](https://discuss.elastic.co/t/elasticsearch-g1gc-tuning/253964)

<div class="topic-metadata">

**Author:** [@James\_D](https://discuss.elastic.co/u/James_D)\
**Replies:** 5\
**Last updated:** [November 3, 2020, 8:20am UTC](https://discuss.elastic.co/t/elasticsearch-g1gc-tuning/253964 "2020-11-03T08:20:40Z")

</div>

We are trying to evaluate an Elasticsearch upgrade from 5.6 to 7.8 and are seeing some unexpected memory pressure on our test 7.8 cluster. Production Cluster: Elasticsearch 5.6 - 12 Nodes - 3 Hot 9 Warm - 64GB RAM, 31G…

---

## [Multiple index routing allocation with require and include](https://discuss.elastic.co/t/multiple-index-routing-allocation-with-require-and-include/253995)

<div class="topic-metadata">

**Author:** [@nopma](https://discuss.elastic.co/u/nopma)\
**Replies:** 4\
**Last updated:** [November 3, 2020, 8:02am UTC](https://discuss.elastic.co/t/multiple-index-routing-allocation-with-require-and-include/253995 "2020-11-03T08:02:50Z")

</div>

I am trying to set up index routing with require and include but is not working. I have 3 nodes, and I want one shard to be on node-1 and the second shard to be on node-2 or 3. But when I try with this index template o…

---

## [Sum of bucket script](https://discuss.elastic.co/t/sum-of-bucket-script/254110)

<div class="topic-metadata">

**Author:** [@gokul275](https://discuss.elastic.co/u/gokul275)\
**Replies:** 0\
**Last updated:** [November 3, 2020, 7:00am UTC](https://discuss.elastic.co/t/sum-of-bucket-script/254110 "2020-11-03T07:00:48Z")

</div>

I am trying to achieve sum of bucket script values, Is it possible? { "aggs": { "NAME": { "terms": { "field": "date", "size": 10 }, "aggs": { "bal": { "sum": { "field": "balance" } }, "rdb" : { "sum": { "…

---

## [Daily watcher is not running on its scheduled time](https://discuss.elastic.co/t/daily-watcher-is-not-running-on-its-scheduled-time/253896)

<div class="topic-metadata">

**Author:** [@Wilbert\_Silverio](https://discuss.elastic.co/u/Wilbert_Silverio)\
**Replies:** 1\
**Last updated:** [November 3, 2020, 2:06am UTC](https://discuss.elastic.co/t/daily-watcher-is-not-running-on-its-scheduled-time/253896 "2020-11-03T02:06:57Z")

</div>

Hi Everyone just wanted to ask questions here, I've created a watcher that would run from 23:00 to 08:00 am eastern, minute 30th, 59th { "trigger": { "schedule": { "daily": { "at": \[ { …

---

## [\[Watcher\] 550 Access denied - Invalid HELO name (See RFC2821 4.1.1.1)](https://discuss.elastic.co/t/watcher-550-access-denied-invalid-helo-name-see-rfc2821-4-1-1-1/253806)

<div class="topic-metadata">

**Author:** [@ylasri](https://discuss.elastic.co/u/ylasri)\
**Replies:** 3\
**Last updated:** [November 3, 2020, 1:32am UTC](https://discuss.elastic.co/t/watcher-550-access-denied-invalid-helo-name-see-rfc2821-4-1-1-1/253806 "2020-11-03T01:32:10Z")

</div>

When running watcher with email action, we are getting this error : 550 Access denied - Invalid HELO name (See RFC2821 4.1.1.1) We use a corporate SMTP server, elasticsearch.yml config looks like this xpack.notificati…

---

## [Elasticserach stuck](https://discuss.elastic.co/t/elasticserach-stuck/253735)

<div class="topic-metadata">

**Author:** [@Rafael\_Valverde](https://discuss.elastic.co/u/Rafael_Valverde)\
**Replies:** 2\
**Last updated:** [November 3, 2020, 1:27am UTC](https://discuss.elastic.co/t/elasticserach-stuck/253735 "2020-11-03T01:27:56Z")

</div>

Elasticsearch after restart it. I ran curl -u admin\_elasticsearch -X DELETE https://elasticsearch.bitbucket.com/bitbucket-search then I rebuilt it curl -u rxv112 -X POST -H 'Content-Type: application/json' -H 'Accept:…

---

## [Getting uniform results from ES](https://discuss.elastic.co/t/getting-uniform-results-from-es/253649)

<div class="topic-metadata">

**Author:** [@IliaIsakhin](https://discuss.elastic.co/u/IliaIsakhin)\
**Replies:** 1\
**Last updated:** [November 3, 2020, 12:23am UTC](https://discuss.elastic.co/t/getting-uniform-results-from-es/253649 "2020-11-03T00:23:10Z")

</div>

I would like to get flat and uniform results from my ES index. I have 3 different types of documents in one index and when user types search query I want to return up to 10 documents of each document type even if results…

---

## [Elasticsearch service throwing failed to parse exception while indexing content](https://discuss.elastic.co/t/elasticsearch-service-throwing-failed-to-parse-exception-while-indexing-content/253651)

<div class="topic-metadata">

**Author:** [@PravinC](https://discuss.elastic.co/u/PravinC)\
**Replies:** 1\
**Last updated:** [November 3, 2020, 12:15am UTC](https://discuss.elastic.co/t/elasticsearch-service-throwing-failed-to-parse-exception-while-indexing-content/253651 "2020-11-03T00:15:21Z")

</div>

We are trying to index document in Elasticsearch with below structure, { "data": { "blocks": \[ { "block": { "note": "\<p\>Test\</p\>", "digital-asset-service": "" } }, …

---

## [Watcher: How to extract @timestamp using transform map?](https://discuss.elastic.co/t/watcher-how-to-extract-timestamp-using-transform-map/253662)

<div class="topic-metadata">

**Author:** [@kelk](https://discuss.elastic.co/u/kelk)\
**Replies:** 0\
**Last updated:** [October 29, 2020, 9:20am UTC](https://discuss.elastic.co/t/watcher-how-to-extract-timestamp-using-transform-map/253662 "2020-10-29T09:20:00Z")

</div>

In Watcher, i'm trying to extract the @timestamp field from payload return \[ 'my\_group\_array': ctx.payload.hits.hits, 'my\_group\_fields': ctx.payload.hits.hits.stream() .map(t-\>…

---

## [Forcing ILM policy causing cluster to go RED](https://discuss.elastic.co/t/forcing-ilm-policy-causing-cluster-to-go-red/253687)

<div class="topic-metadata">

**Author:** [@Divit\_Sharma](https://discuss.elastic.co/u/Divit_Sharma)\
**Replies:** 1\
**Last updated:** [November 3, 2020, 12:10am UTC](https://discuss.elastic.co/t/forcing-ilm-policy-causing-cluster-to-go-red/253687 "2020-11-03T00:10:03Z")

</div>

I am using settings API to force the ILM policy to all my older indices around 4000k. When I run it, my cluster goes into Red state. I don't know why this would be. Any idea? We have 9 data nodes, 2 client nodes and 3 m…

---

## [How can i access the Kibana indices if i am connected to Kibana via SSH tunnel Putty](https://discuss.elastic.co/t/how-can-i-access-the-kibana-indices-if-i-am-connected-to-kibana-via-ssh-tunnel-putty/253705)

<div class="topic-metadata">

**Author:** [@Saket\_Shankar](https://discuss.elastic.co/u/Saket_Shankar)\
**Replies:** 1\
**Last updated:** [November 3, 2020, 12:09am UTC](https://discuss.elastic.co/t/how-can-i-access-the-kibana-indices-if-i-am-connected-to-kibana-via-ssh-tunnel-putty/253705 "2020-11-03T00:09:35Z")

</div>

Elasticsearch : localhost:9200 Kibana : connected via SSH Tunnel Putty Problem : Kibana Indices not reflecting in Elasticsearch

---

## [Watcher did not run](https://discuss.elastic.co/t/watcher-did-not-run/253832)

<div class="topic-metadata">

**Author:** [@Juan\_David\_Jaramillo](https://discuss.elastic.co/u/Juan_David_Jaramillo)\
**Replies:** 0\
**Last updated:** [October 30, 2020, 3:03pm UTC](https://discuss.elastic.co/t/watcher-did-not-run/253832 "2020-10-30T15:03:37Z")

</div>

hello i need help with this alert, I want to know why you didn't warn me when there was a fall at 5:45 am { "trigger": { "schedule": { "interval": "24h" } }, "input": { "search": { "req…

---

## [Is it time to rearchitect my clusters?](https://discuss.elastic.co/t/is-it-time-to-rearchitect-my-clusters/253863)

<div class="topic-metadata">

**Author:** [@reshippie](https://discuss.elastic.co/u/reshippie)\
**Replies:** 1\
**Last updated:** [November 2, 2020, 11:40pm UTC](https://discuss.elastic.co/t/is-it-time-to-rearchitect-my-clusters/253863 "2020-11-02T23:40:30Z")

</div>

I currently have 3 main clusters, 1 with 19 nodes and 2 with 15 nodes. In all 3 cases I've left things mostly in their default state, with all nodes as data and master eligible. After a disastrous upgrade followed by a…

---

## [Issues setting up basic Auth on open version of Elasticsearch 7.9.2 .. solved issues](https://discuss.elastic.co/t/issues-setting-up-basic-auth-on-open-version-of-elasticsearch-7-9-2-solved-issues/253908)

<div class="topic-metadata">

**Author:** [@PeterC](https://discuss.elastic.co/u/PeterC)\
**Replies:** 0\
**Last updated:** [October 31, 2020, 5:46pm UTC](https://discuss.elastic.co/t/issues-setting-up-basic-auth-on-open-version-of-elasticsearch-7-9-2-solved-issues/253908 "2020-10-31T17:46:03Z")

</div>

Finally solved the many issues in the docs on this. Here are a few pointers to help out., This was solved on a Linux build, so is linux related, abut could also help with Windows. I used this post as an instruction.., a…

---

## [How to manage elasticsearch logs: disk almost full](https://discuss.elastic.co/t/how-to-manage-elasticsearch-logs-disk-almost-full/254061)

<div class="topic-metadata">

**Author:** [@Mauro\_Tridici](https://discuss.elastic.co/u/Mauro_Tridici)\
**Replies:** 13\
**Last updated:** [November 2, 2020, 8:25pm UTC](https://discuss.elastic.co/t/how-to-manage-elasticsearch-logs-disk-almost-full/254061 "2020-11-02T20:25:11Z")

</div>

Dear Users, I'm a newbie and this is the first time I use ELK stack. I was able to deploy ELK stack and capture needed information. I created my first dashboard and visualizations. They are working as expected: we are …

---

## [Enabling Encryption for Nodes with basic license](https://discuss.elastic.co/t/enabling-encryption-for-nodes-with-basic-license/254071)

<div class="topic-metadata">

**Author:** [@nikeee](https://discuss.elastic.co/u/nikeee)\
**Replies:** 2\
**Last updated:** [November 2, 2020, 7:20pm UTC](https://discuss.elastic.co/t/enabling-encryption-for-nodes-with-basic-license/254071 "2020-11-02T19:20:18Z")

</div>

The license comparison matrix states: ...so I guess encrypted communication is included in the "basic" license. According to the docs, xpack.security.enabled must be set to true for this. Also according to the docs,…

---

## [Advice on query against nested objects](https://discuss.elastic.co/t/advice-on-query-against-nested-objects/254077)

<div class="topic-metadata">

**Author:** [@genericusername](https://discuss.elastic.co/u/genericusername)\
**Replies:** 0\
**Last updated:** [November 2, 2020, 7:41pm UTC](https://discuss.elastic.co/t/advice-on-query-against-nested-objects/254077 "2020-11-02T19:41:13Z")

</div>

We are using ElasticSearch 6.8, and performing searches against an index of "locations" that have nested "offers" within them. A location can have many nested offers and offers can be nested within many locations. Locati…

---

## [Elasticsearch 7.9: using a suggester for every field in multiple indexes](https://discuss.elastic.co/t/elasticsearch-7-9-using-a-suggester-for-every-field-in-multiple-indexes/254076)

<div class="topic-metadata">

**Author:** [@Alex11](https://discuss.elastic.co/u/Alex11)\
**Replies:** 0\
**Last updated:** [November 2, 2020, 7:37pm UTC](https://discuss.elastic.co/t/elasticsearch-7-9-using-a-suggester-for-every-field-in-multiple-indexes/254076 "2020-11-02T19:37:32Z")

</div>

I have indexed multiple documents for my website with Elasticsearch and would like to use a suggester on all of the fields in all of the indices. I'm trying to create a site wide search that searches all indexed content …

[Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=772)

[Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=774)
