# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=775 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 776 --- ## [Documents deleted from all indices](https://discuss.elastic.co/t/documents-deleted-from-all-indices/253900)
**Author:** [@venku](https://discuss.elastic.co/u/venku)\ **Replies:** 6\ **Last updated:** [October 31, 2020, 4:22pm UTC](https://discuss.elastic.co/t/documents-deleted-from-all-indices/253900 "2020-10-31T16:22:55Z")
I am running a single ElasticSearch node for past week and half and my ILM policy was to delete the index if it is 10 days old after the rollover. I have a day or 5GB limit to move from hot to delete phase. However when … --- ## [Upgrade from 7.9.0 to 7.9.3](https://discuss.elastic.co/t/upgrade-from-7-9-0-to-7-9-3/253779)
**Author:** [@fadjar340](https://discuss.elastic.co/u/fadjar340)\ **Replies:** 2\ **Last updated:** [October 31, 2020, 2:06am UTC](https://discuss.elastic.co/t/upgrade-from-7-9-0-to-7-9-3/253779 "2020-10-31T02:06:59Z")
Hi all, I have issue when I'm trying to upgrde from 7.9.0 to 7.9.3, the elasticsearch can't start. After several minutes to investigate, I think it related to the jvm.options, because I have several times upgrading ela… --- ## [How to aggregate (nested) product attributes](https://discuss.elastic.co/t/how-to-aggregate-nested-product-attributes/253882)
**Author:** [@itscaiquearaujo](https://discuss.elastic.co/u/itscaiquearaujo)\ **Replies:** 0\ **Last updated:** [October 31, 2020, 1:19am UTC](https://discuss.elastic.co/t/how-to-aggregate-nested-product-attributes/253882 "2020-10-31T01:19:30Z")
I have a really simple index with the following mapping: PUT /localindex-products { "mappings": { "properties": { "name": { "type": "text" }, "sku": { "type": "keyword" }, "description": { "type"… --- ## [Snapshot completed with success but archive creation failed](https://discuss.elastic.co/t/snapshot-completed-with-success-but-archive-creation-failed/253866)
**Author:** [@alita](https://discuss.elastic.co/u/alita)\ **Replies:** 0\ **Last updated:** [October 30, 2020, 9:15pm UTC](https://discuss.elastic.co/t/snapshot-completed-with-success-but-archive-creation-failed/253866 "2020-10-30T21:15:20Z")
Hi folks, I created a snapshot using the following curl command: curl -X PUT "localhost:9200/\_snapshot/my\_backup/snapshot\_1?wait\_for\_completion=true&pretty" After the snapshot completed with success, I execute a simp… --- ## [Setting up Okta instegration for Cloud Elastic](https://discuss.elastic.co/t/setting-up-okta-instegration-for-cloud-elastic/253734)
**Author:** [@Beefstew](https://discuss.elastic.co/u/Beefstew)\ **Replies:** 1\ **Last updated:** [October 30, 2020, 8:10pm UTC](https://discuss.elastic.co/t/setting-up-okta-instegration-for-cloud-elastic/253734 "2020-10-30T20:10:56Z")
Hi there, could anyone please provide some intuitive doco explaining the steps to Integrate Azure Elastic authentication to Okta using SAML Thank you --- ## [Error when updating an array element object using java rest client api](https://discuss.elastic.co/t/error-when-updating-an-array-element-object-using-java-rest-client-api/253835)
**Author:** [@gtoor](https://discuss.elastic.co/u/gtoor)\ **Replies:** 1\ **Last updated:** [October 30, 2020, 7:44pm UTC](https://discuss.elastic.co/t/error-when-updating-an-array-element-object-using-java-rest-client-api/253835 "2020-10-30T19:44:51Z")
I am trying to update an array element in the document. The update should replace an existing element. This is what the document looks like "first" : "johnny", "last" : "gaudreau", "elements" : \[ { … --- ## [onPreFetchPhase listener \[org.elasticsearch.xpack.security.authz.SecuritySearchOperationListener@X\] failed](https://discuss.elastic.co/t/onprefetchphase-listener-org-elasticsearch-xpack-security-authz-securitysearchoperationlistener-x-failed/251004)
**Author:** [@alexus](https://discuss.elastic.co/u/alexus)\ **Replies:** 3\ **Last updated:** [October 30, 2020, 6:17pm UTC](https://discuss.elastic.co/t/onprefetchphase-listener-org-elasticsearch-xpack-security-authz-securitysearchoperationlistener-x-failed/251004 "2020-10-30T18:17:55Z")
Hello World! I'm using Elastic Stack 6.8.12 and running into following issue: elasticsearch' logs: XXXX | \[2020-10-05T00:22:46,990\]\[WARN \]\[o.e.i.s.IndexShard \] \[XXXXX\] \[4\] onPreFetchPhase listener \[… --- ## [Low performance while searching](https://discuss.elastic.co/t/low-performance-while-searching/253746)
**Author:** [@Phandora](https://discuss.elastic.co/u/Phandora)\ **Replies:** 4\ **Last updated:** [October 30, 2020, 4:15pm UTC](https://discuss.elastic.co/t/low-performance-while-searching/253746 "2020-10-30T16:15:17Z")
Hi, We are experiencing a low searching performance in our Kubernetes ES cluster. We have a 5 node ES cluster with the following specifications per node: ES\_JAVA\_OPTS: -Xms4096m -Xmx4096m Cpu request: 500m Cpu limi… --- ## [Machine learning options](https://discuss.elastic.co/t/machine-learning-options/253760)
**Author:** [@jungsoo](https://discuss.elastic.co/u/jungsoo)\ **Replies:** 1\ **Last updated:** [October 30, 2020, 4:31pm UTC](https://discuss.elastic.co/t/machine-learning-options/253760 "2020-10-30T16:31:09Z")
Hello, I'm testing machine learning features using the kibana sample data. I couldn't find detailed information about the options when creating ml jobs. I want to know what exclude frequent means, and how I could use t… --- ## [Ansible-elasticsearch on Centos 8](https://discuss.elastic.co/t/ansible-elasticsearch-on-centos-8/250839)
**Author:** [@biggtimber](https://discuss.elastic.co/u/biggtimber)\ **Replies:** 1\ **Last updated:** [October 30, 2020, 3:10pm UTC](https://discuss.elastic.co/t/ansible-elasticsearch-on-centos-8/250839 "2020-10-30T15:10:01Z")
Is there work being put towards supporting the ansible-elasticsearch project on Centos 8, since elasticsearch has supported it for 3 releases now. --- ## [How can I pattern match a sequence of events?](https://discuss.elastic.co/t/how-can-i-pattern-match-a-sequence-of-events/253246)
**Author:** [@marcosvrrs](https://discuss.elastic.co/u/marcosvrrs)\ **Replies:** 5\ **Last updated:** [October 30, 2020, 1:36pm UTC](https://discuss.elastic.co/t/how-can-i-pattern-match-a-sequence-of-events/253246 "2020-10-30T13:36:47Z")
Hi guys, I'am having a steep learning curve with the syntax. I have a sequence of transactions with timestamps, and when a transaction comes with some values in certain fields, I need to check if in the next 30 seconds … --- ## [Elasticsearch unassigned shards CircuitBreakingException\[\[parent\] Data too large](https://discuss.elastic.co/t/elasticsearch-unassigned-shards-circuitbreakingexception-parent-data-too-large/253820)
**Author:** [@elknoob](https://discuss.elastic.co/u/elknoob)\ **Replies:** 0\ **Last updated:** [October 30, 2020, 12:42pm UTC](https://discuss.elastic.co/t/elasticsearch-unassigned-shards-circuitbreakingexception-parent-data-too-large/253820 "2020-10-30T12:42:28Z")
I got alert stating elasticsearch has 2 unassigned shards. I made below api calls to gather more details. // curl -s http://localhost:9200/\_cluster/allocation/explain | python -m json.tool "allocate\_explanation": "c… --- ## [Failed to authenticate user with ldap realm using role mapping api](https://discuss.elastic.co/t/failed-to-authenticate-user-with-ldap-realm-using-role-mapping-api/253285)
**Author:** [@lusynda](https://discuss.elastic.co/u/lusynda)\ **Replies:** 4\ **Last updated:** [October 30, 2020, 12:05pm UTC](https://discuss.elastic.co/t/failed-to-authenticate-user-with-ldap-realm-using-role-mapping-api/253285 "2020-10-30T12:05:36Z")
Hi all, Currently i have successfully tried to authen to elastic with ldap, but i used the role\_mapping file, i was tesing with using the role mapping api but it is not working. When i turn on the authen debug log then… --- ## [How to subtract TimeSpan in ticks from datetime in any type of query range or script](https://discuss.elastic.co/t/how-to-subtract-timespan-in-ticks-from-datetime-in-any-type-of-query-range-or-script/253807)
**Author:** [@sameer\_sawant](https://discuss.elastic.co/u/sameer_sawant)\ **Replies:** 0\ **Last updated:** [October 30, 2020, 11:29am UTC](https://discuss.elastic.co/t/how-to-subtract-timespan-in-ticks-from-datetime-in-any-type-of-query-range-or-script/253807 "2020-10-30T11:29:49Z")
I want to achive something like this endDateUtc.Subtract(timespan) \<= DateTime.Now in elastic query . both fields ( enddateutc and timespan ) available in document. i want to do something like doc\["enddateutc"\].value - … --- ## [How to synchronize current thread with SubmitAsyncSearchRequest?](https://discuss.elastic.co/t/how-to-synchronize-current-thread-with-submitasyncsearchrequest/253795)
**Author:** [@Woniok](https://discuss.elastic.co/u/Woniok)\ **Replies:** 0\ **Last updated:** [October 30, 2020, 10:18am UTC](https://discuss.elastic.co/t/how-to-synchronize-current-thread-with-submitasyncsearchrequest/253795 "2020-10-30T10:18:19Z")
Hi, guys. Thank you for building such wonderful tools. :grinning: While I was coding with the guidance of the \[SubmitAsyncSearchRequest document\](https://www.elastic.co/guide/en/elasticsearch/client/java-rest/current/ja… --- ## [Unexpected behaviour with search\_as\_you\_type field indexed as arrays](https://discuss.elastic.co/t/unexpected-behaviour-with-search-as-you-type-field-indexed-as-arrays/253790)
**Author:** [@serkanozer](https://discuss.elastic.co/u/serkanozer)\ **Replies:** 0\ **Last updated:** [October 30, 2020, 9:18am UTC](https://discuss.elastic.co/t/unexpected-behaviour-with-search-as-you-type-field-indexed-as-arrays/253790 "2020-10-30T09:18:36Z")
curl -X PUT "localhost:9200/test\_index?pretty" -H 'Content-Type: application/json' -d' { "mappings": { "properties": { "search\_as\_you\_type\_field": { "type": "search\_as\_you\_type" } } } } ' … --- ## [How to improve performance of ID query](https://discuss.elastic.co/t/how-to-improve-performance-of-id-query/253699)
**Author:** [@anjali\_zarkar](https://discuss.elastic.co/u/anjali_zarkar)\ **Replies:** 1\ **Last updated:** [October 30, 2020, 9:12am UTC](https://discuss.elastic.co/t/how-to-improve-performance-of-id-query/253699 "2020-10-30T09:12:38Z")
'Hi , I am new to Elasticsearch, I am trying to fetch documents from eleasticsearch using Id query . Numbers of records in query are just 180 and query takes ~800 ms. { "profile" : "true", "query": { "ids" : { "va… --- ## [Packetbeats shards UNASSIGNED](https://discuss.elastic.co/t/packetbeats-shards-unassigned/253717)
**Author:** [@TheHunter1](https://discuss.elastic.co/u/TheHunter1)\ **Replies:** 2\ **Last updated:** [October 30, 2020, 9:05am UTC](https://discuss.elastic.co/t/packetbeats-shards-unassigned/253717 "2020-10-30T09:05:52Z")
Hello, Everything was working fine in my cluster, and today I found out that I have no log from packetbeat, and shards' health is red: and when I run GET \_cat/shards I get something like that: packetbeat-7.9.3-2020.… --- ## [I cant start up Elastic search](https://discuss.elastic.co/t/i-cant-start-up-elastic-search/253348)
**Author:** [@Fisnik\_Myrtezaj](https://discuss.elastic.co/u/Fisnik_Myrtezaj)\ **Replies:** 8\ **Last updated:** [October 30, 2020, 8:07am UTC](https://discuss.elastic.co/t/i-cant-start-up-elastic-search/253348 "2020-10-30T08:07:44Z")
When i try startup the elasticsearch i get this error : ./bin/elasticsearch-env: line 77: /volume1/web/elasticsearch/jdk/bin/java: cannot execute binary file: Exec format error im using Linux nas synology --- ## [Wildcard in aggregation acting Funny](https://discuss.elastic.co/t/wildcard-in-aggregation-acting-funny/253616)
**Author:** [@katana\_handler](https://discuss.elastic.co/u/katana_handler)\ **Replies:** 1\ **Last updated:** [October 30, 2020, 6:17am UTC](https://discuss.elastic.co/t/wildcard-in-aggregation-acting-funny/253616 "2020-10-30T06:17:09Z")
My docs (movies) are in this kind of format: { "title" : "title of movie", "cast": \[list of names\], "genres": \[list of genres\], "year" : long } Now i have attached the query that i performed and the res… --- ## [Roll up Jobs Performance](https://discuss.elastic.co/t/roll-up-jobs-performance/253773)
**Author:** [@Dimple\_Goyal](https://discuss.elastic.co/u/Dimple_Goyal)\ **Replies:** 0\ **Last updated:** [October 30, 2020, 6:14am UTC](https://discuss.elastic.co/t/roll-up-jobs-performance/253773 "2020-10-30T06:14:33Z")
I have about 90 indexes 50gb each. I have created rollup job to process information of these indices. The max page size for the rollup job is 10000 indexing is taking forever, any ideas on how i could ehance the perform… --- ## [Need help with co-occurrence of values in nested documents across documents](https://discuss.elastic.co/t/need-help-with-co-occurrence-of-values-in-nested-documents-across-documents/253718)
**Author:** [@verdict-lg](https://discuss.elastic.co/u/verdict-lg)\ **Replies:** 0\ **Last updated:** [October 29, 2020, 3:21pm UTC](https://discuss.elastic.co/t/need-help-with-co-occurrence-of-values-in-nested-documents-across-documents/253718 "2020-10-29T15:21:10Z")
Hi, Say this is my document and Book Meta is a nested field { { "Book ID": 1, "Book Meta": \[ { "Chapter\_ID" : 1, "Chapter\_Gist": "\ **Author:** [@Johann\_Hochtl](https://discuss.elastic.co/u/Johann_Hochtl)\ **Replies:** 2\ **Last updated:** [October 30, 2020, 4:54am UTC](https://discuss.elastic.co/t/enabling-security-in-basic-subscription/253449 "2020-10-30T04:54:30Z") I am using elasticsearch 7.9, Basic subscription I followed https://www.elastic.co/guide/en/elasticsearch/reference/current/configuring-security.html I enabled security in elastic with this configuration: xpack.se… --- ## [How do I get the highest matching set of data in a multi-value field?](https://discuss.elastic.co/t/how-do-i-get-the-highest-matching-set-of-data-in-a-multi-value-field/252141)
**Author:** [@yanglingqiang](https://discuss.elastic.co/u/yanglingqiang)\ **Replies:** 3\ **Last updated:** [October 30, 2020, 3:10am UTC](https://discuss.elastic.co/t/how-do-i-get-the-highest-matching-set-of-data-in-a-multi-value-field/252141 "2020-10-30T03:10:38Z")
my index mapping "mapping":{ "test":{ "descript": { "properties": { "prop": { "type": "long" }, "value": { "analyzer": "english", "type": "text" } } }, "id":{ "type":"lo… --- ## [Java JDK old version](https://discuss.elastic.co/t/java-jdk-old-version/253383)
**Author:** [@dfoot](https://discuss.elastic.co/u/dfoot)\ **Replies:** 3\ **Last updated:** [October 30, 2020, 12:44am UTC](https://discuss.elastic.co/t/java-jdk-old-version/253383 "2020-10-30T00:44:25Z")
ELK version 7.1.1... vulnerability scanning shows Java old version found on elasticsearch nodes path for ELK cluster and logstash Java JDK installation on Elasticsearch nodes path /usr/share/elasticsearch/jdk/ version … --- ## [Internals of snapshot and restore](https://discuss.elastic.co/t/internals-of-snapshot-and-restore/253750)
**Author:** [@avee](https://discuss.elastic.co/u/avee)\ **Replies:** 0\ **Last updated:** [October 29, 2020, 9:21pm UTC](https://discuss.elastic.co/t/internals-of-snapshot-and-restore/253750 "2020-10-29T21:21:24Z")
How does snapshot and restore works in the background? For example - When a snapshot is taken with AWS S3 as backend store, what all oprations are carried out on elastic nodes and which nodes ? And which node is responsi… --- ## [How to Limit Message Length in Watcher Json File](https://discuss.elastic.co/t/how-to-limit-message-length-in-watcher-json-file/253581)
**Author:** [@mdamera](https://discuss.elastic.co/u/mdamera)\ **Replies:** 0\ **Last updated:** [October 28, 2020, 3:17pm UTC](https://discuss.elastic.co/t/how-to-limit-message-length-in-watcher-json-file/253581 "2020-10-28T15:17:17Z")
Hello Everyone, I have following lines on a watcher Json configuration file and I would like to trim/limit the {{\_source.message}} to 3000 characters in the email alert Can anyone help me how can we do that ? "body":… --- ## [Storage quantity required for an Elastic SIEM solution](https://discuss.elastic.co/t/storage-quantity-required-for-an-elastic-siem-solution/253582)
**Author:** [@jelocabral](https://discuss.elastic.co/u/jelocabral)\ **Replies:** 4\ **Last updated:** [October 29, 2020, 6:22pm UTC](https://discuss.elastic.co/t/storage-quantity-required-for-an-elastic-siem-solution/253582 "2020-10-29T18:22:03Z")
Hi people, we have an ELK stack for a SIEM solution in our company. We need to ingest data from 10 devices aproximately, and we need to maintan the data for 3 months. We have one firewall which is a heavy log sender. C… --- ## [Snapshots do not list when restoring a backup](https://discuss.elastic.co/t/snapshots-do-not-list-when-restoring-a-backup/253737)
**Author:** [@alexporto](https://discuss.elastic.co/u/alexporto)\ **Replies:** 0\ **Last updated:** [October 29, 2020, 6:15pm UTC](https://discuss.elastic.co/t/snapshots-do-not-list-when-restoring-a-backup/253737 "2020-10-29T18:15:29Z")
I need to restore a backup of elasticsearch on another server, however snapshots do not appear on the system. My folder backup root@ixcgWfFZinUSKI:/var/lib/elasticsearch\_backup# ls -lh total 232K -rw-r--r--… --- ## [Using spaCy lemmatizers with ElasticSearch](https://discuss.elastic.co/t/using-spacy-lemmatizers-with-elasticsearch/253721)
**Author:** [@aquarian\_14](https://discuss.elastic.co/u/aquarian_14)\ **Replies:** 0\ **Last updated:** [October 29, 2020, 3:35pm UTC](https://discuss.elastic.co/t/using-spacy-lemmatizers-with-elasticsearch/253721 "2020-10-29T15:35:30Z")
Has anyone attempted to do lemmatization outside of elasticsearch on content, and fed the pre-analyzed tokens in document field and then ingested the document? I would like to use spaCy lemmatization for content that I … [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=774) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=776)