# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=776 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 777 --- ## [Elasticsearch Schema (Mapping) Analyzer](https://discuss.elastic.co/t/elasticsearch-schema-mapping-analyzer/253719)
**Author:** [@vorapoap](https://discuss.elastic.co/u/vorapoap)\ **Replies:** 0\ **Last updated:** [October 29, 2020, 3:27pm UTC](https://discuss.elastic.co/t/elasticsearch-schema-mapping-analyzer/253719 "2020-10-29T15:27:37Z")
In MongoDB there are tools that can do like Schema Analyzer. For example we can set to analyze first thousand documents to identify how is each field used by each document and how big they are. I am curious if we have … --- ## [Getting error while trying to take snapshot using curator](https://discuss.elastic.co/t/getting-error-while-trying-to-take-snapshot-using-curator/251429)
**Author:** [@knagasri](https://discuss.elastic.co/u/knagasri)\ **Replies:** 1\ **Last updated:** [October 29, 2020, 2:43pm UTC](https://discuss.elastic.co/t/getting-error-while-trying-to-take-snapshot-using-curator/251429 "2020-10-29T14:43:03Z")
I am getting the below error, while taking snapshot using Curator: Failed to complete action: snapshot. \: Cannot snapshot indices to missing repository: xxxx Here I am using GCS… --- ## [Getting error while restoring snapshots using curator](https://discuss.elastic.co/t/getting-error-while-restoring-snapshots-using-curator/251849)
**Author:** [@knagasri](https://discuss.elastic.co/u/knagasri)\ **Replies:** 11\ **Last updated:** [October 29, 2020, 1:47pm UTC](https://discuss.elastic.co/t/getting-error-while-restoring-snapshots-using-curator/251849 "2020-10-29T13:47:46Z")
Hi Team, I am taking snapshots using curator through GCS bucket and trying to restore it . But, I am getting error as below: 2020-10-13 06:08:35,293 INFO Preparing Action ID: 1, "restore" 2020-10-13 06:08:35,293 … --- ## [Index boost with completion suggester](https://discuss.elastic.co/t/index-boost-with-completion-suggester/253691)
**Author:** [@anupam](https://discuss.elastic.co/u/anupam)\ **Replies:** 0\ **Last updated:** [October 29, 2020, 12:43pm UTC](https://discuss.elastic.co/t/index-boost-with-completion-suggester/253691 "2020-10-29T12:43:24Z")
Is it possible to use index boost when using completion suggester in Elasticsearch? I have tried many different ways but doesn't seem to work. Haven't found any reference in the documentation claiming that it does not wo… --- ## [ElasticSearch 7.5.2: Scores must be positive or null exception](https://discuss.elastic.co/t/elasticsearch-7-5-2-scores-must-be-positive-or-null-exception/224872)
**Author:** [@bram](https://discuss.elastic.co/u/bram)\ **Replies:** 4\ **Last updated:** [October 29, 2020, 11:31am UTC](https://discuss.elastic.co/t/elasticsearch-7-5-2-scores-must-be-positive-or-null-exception/224872 "2020-10-29T11:31:14Z")
Hello, We're getting this exception from ElasticSearch for one specific search term: { "error": { "root\_cause": \[ { "type": "illegal\_argument\_exception", "reason": "Scores must be positive o… --- ## [GCP GCS storage using old service account key](https://discuss.elastic.co/t/gcp-gcs-storage-using-old-service-account-key/253545)
**Author:** [@bhuvaneshdct](https://discuss.elastic.co/u/bhuvaneshdct)\ **Replies:** 1\ **Last updated:** [October 29, 2020, 11:22am UTC](https://discuss.elastic.co/t/gcp-gcs-storage-using-old-service-account-key/253545 "2020-10-29T11:22:59Z")
I have an existing repository for GCS storage that using a JSON key. export PATH=/usr/share/elasticsearch/bin/:$PATH elasticsearch-keystore add-file gcs.client.default.credentials\_file /opt/esadmin/gcs-key.json elastics… --- ## [Can fields in one 7.9 component template refer to settings in another?](https://discuss.elastic.co/t/can-fields-in-one-7-9-component-template-refer-to-settings-in-another/253679)
**Author:** [@Bernt\_Rostad](https://discuss.elastic.co/u/Bernt_Rostad)\ **Replies:** 0\ **Last updated:** [October 29, 2020, 10:53am UTC](https://discuss.elastic.co/t/can-fields-in-one-7-9-component-template-refer-to-settings-in-another/253679 "2020-10-29T10:53:26Z")
I'm trying to get my head around the new concept of component templates in ES7.9 before I start upgrading from ES6.8. My problem is that I've got a dozen index templates where I use the "order" field to build up the map… --- ## [How to match a word which includes white spaces?](https://discuss.elastic.co/t/how-to-match-a-word-which-includes-white-spaces/253655)
**Author:** [@taichi](https://discuss.elastic.co/u/taichi)\ **Replies:** 2\ **Last updated:** [October 29, 2020, 9:51am UTC](https://discuss.elastic.co/t/how-to-match-a-word-which-includes-white-spaces/253655 "2020-10-29T09:51:22Z")
I have a text field named profile (with default analyzer), and I want to query with words including white spaces. For example, when I wanted to search by vice president, I created a query { "query": { { … --- ## [Elastic Cloud Deployment on AWS & SAML Okta](https://discuss.elastic.co/t/elastic-cloud-deployment-on-aws-saml-okta/253441)
**Author:** [@michal.adamkiewicz](https://discuss.elastic.co/u/michal.adamkiewicz)\ **Replies:** 4\ **Last updated:** [October 29, 2020, 8:47am UTC](https://discuss.elastic.co/t/elastic-cloud-deployment-on-aws-saml-okta/253441 "2020-10-29T08:47:17Z")
Hello guys, I'm writing because I have been struggling with set up Elastic and OKTA SAML together. To be short and precisely describe my issue (and also help eventually anyone share advice about that - thanks in advance… --- ## [Script watcher for detecting brute force attacks (winlogbeat)](https://discuss.elastic.co/t/script-watcher-for-detecting-brute-force-attacks-winlogbeat/253657)
**Author:** [@TheHunter1](https://discuss.elastic.co/u/TheHunter1)\ **Replies:** 0\ **Last updated:** [October 29, 2020, 8:38am UTC](https://discuss.elastic.co/t/script-watcher-for-detecting-brute-force-attacks-winlogbeat/253657 "2020-10-29T08:38:04Z")
Hello everybody, So I begin creating some watcher alerts, and my first script is for detecting brute force using winlogbeat. Here is my script: PUT \_watcher/watch/brute\_force\_winlogbeat { "trigger": { "schedu… --- ## [How to understand the “PUT /\_mapping” API](https://discuss.elastic.co/t/how-to-understand-the-put-mapping-api/253656)
**Author:** [@luchenguang](https://discuss.elastic.co/u/luchenguang)\ **Replies:** 0\ **Last updated:** [October 29, 2020, 8:14am UTC](https://discuss.elastic.co/t/how-to-understand-the-put-mapping-api/253656 "2020-10-29T08:14:31Z")
Hi, everyone. I am confuse about these PUT mapping APIs in this Guide Document, and need some help :pray: :pray: The Request APIs are: PUT /\/\_mapping PUT /\_mapping About the path parameter \, it says … --- ## [Elastic Search 6.8.6 breaks abruptly!](https://discuss.elastic.co/t/elastic-search-6-8-6-breaks-abruptly/253366)
**Author:** [@jaraws](https://discuss.elastic.co/u/jaraws)\ **Replies:** 3\ **Last updated:** [October 29, 2020, 8:12am UTC](https://discuss.elastic.co/t/elastic-search-6-8-6-breaks-abruptly/253366 "2020-10-29T08:12:18Z")
Hi, I have been facing a strange error where the Elastic search instance breaks abruptly . ELK stack works fine initially, I am able to push data against index as well but the stack later breaks with following error, t… --- ## [Can't delete old indices older than 21 days](https://discuss.elastic.co/t/cant-delete-old-indices-older-than-21-days/253586)
**Author:** [@yys2000](https://discuss.elastic.co/u/yys2000)\ **Replies:** 1\ **Last updated:** [October 29, 2020, 7:46am UTC](https://discuss.elastic.co/t/cant-delete-old-indices-older-than-21-days/253586 "2020-10-29T07:46:50Z")
Hi, I ran this in Kibana to delete the indices older than 21 days: POST monstache.\*/\_delete\_by\_query { "query": { "range": { "@timestamp": { "lte": "now-21d" } } } } After ran it, I performed indices search a… --- ## [Daily ingest in bytes](https://discuss.elastic.co/t/daily-ingest-in-bytes/253625)
**Author:** [@ajhstn](https://discuss.elastic.co/u/ajhstn)\ **Replies:** 1\ **Last updated:** [October 29, 2020, 6:34am UTC](https://discuss.elastic.co/t/daily-ingest-in-bytes/253625 "2020-10-29T06:34:21Z")
How can i query to see my total ingest bytes across all data sources grouped daily? eg. 1/1/2020 - 1GB 2/1/2020 - 3GB 3/1/2020 - 2GB 4/1/2020 - 3GB --- ## [How to count the number of docs indexed per N seconds](https://discuss.elastic.co/t/how-to-count-the-number-of-docs-indexed-per-n-seconds/253631)
**Author:** [@AClerk](https://discuss.elastic.co/u/AClerk)\ **Replies:** 6\ **Last updated:** [October 29, 2020, 6:31am UTC](https://discuss.elastic.co/t/how-to-count-the-number-of-docs-indexed-per-n-seconds/253631 "2020-10-29T06:31:45Z")
Hello, I would like to know how many documents are indexed per N seconds. So, I want to export/get statistics about the Elastic cluster performance. Is there a way to get these numbers? Is there a way to split these … --- ## [While copying the existing document with adding \_ to the id duplicate data is getting](https://discuss.elastic.co/t/while-copying-the-existing-document-with-adding-to-the-id-duplicate-data-is-getting/253644)
**Author:** [@kiran3](https://discuss.elastic.co/u/kiran3)\ **Replies:** 0\ **Last updated:** [October 29, 2020, 6:26am UTC](https://discuss.elastic.co/t/while-copying-the-existing-document-with-adding-to-the-id-duplicate-data-is-getting/253644 "2020-10-29T06:26:07Z")
when we are making a copy of the existing document(ex id: Tf23) with adding \_ to the id (ex id:\_Tf23) we are getting an issue like the existing document id (Tf23) it is also taking the \_ to the id but we need a copy of… --- ## [Kuromoji token offsets going backwards in extended mode](https://discuss.elastic.co/t/kuromoji-token-offsets-going-backwards-in-extended-mode/253634)
**Author:** [@matobaa](https://discuss.elastic.co/u/matobaa)\ **Replies:** 0\ **Last updated:** [October 29, 2020, 2:49am UTC](https://discuss.elastic.co/t/kuromoji-token-offsets-going-backwards-in-extended-mode/253634 "2020-10-29T02:49:06Z")
When we upgraded our ES instance from 6.8 to 7.8, we noticed errors during indexing like below: java.lang.IllegalArgumentException: startOffset must be non-negative, and endOffset must be \>= startOffset, and offsets mus… --- ## [Multiple Plugin Installations on Windows intermittently fail with java.nio.AccessDeniedException](https://discuss.elastic.co/t/multiple-plugin-installations-on-windows-intermittently-fail-with-java-nio-accessdeniedexception/253630)
**Author:** [@Varsha\_Muzumdar](https://discuss.elastic.co/u/Varsha_Muzumdar)\ **Replies:** 0\ **Last updated:** [October 29, 2020, 1:55am UTC](https://discuss.elastic.co/t/multiple-plugin-installations-on-windows-intermittently-fail-with-java-nio-accessdeniedexception/253630 "2020-10-29T01:55:11Z")
Hi, I am recently facing intermittent issue when sequentially installing multiple custom plugins as a part of ES 5.6.10 setup. I am spawning a C# process to invoke elasticsearch-plugin.bat with plugin name as argument a… --- ## [Context for clauses inside "must" parameter](https://discuss.elastic.co/t/context-for-clauses-inside-must-parameter/253628)
**Author:** [@shekharshan](https://discuss.elastic.co/u/shekharshan)\ **Replies:** 0\ **Last updated:** [October 29, 2020, 1:45am UTC](https://discuss.elastic.co/t/context-for-clauses-inside-must-parameter/253628 "2020-10-29T01:45:00Z")
I was reading Elasticsearch documentation here: https://www.elastic.co/guide/en/elasticsearch/reference/6.8/query-filter-context.html The page gives an example of a query like so: curl -X GET "localhost:9200/\_search?pr… --- ## [Create a machine learning job with aggregation](https://discuss.elastic.co/t/create-a-machine-learning-job-with-aggregation/253579)
**Author:** [@TheHunter1](https://discuss.elastic.co/u/TheHunter1)\ **Replies:** 2\ **Last updated:** [October 28, 2020, 9:30pm UTC](https://discuss.elastic.co/t/create-a-machine-learning-job-with-aggregation/253579 "2020-10-28T21:30:44Z")
Hello everybody, So I just began with machine learning jobs and I wanna create a job to detect port scans. I wanna aggregate data by source.ip and then by destination.ip and finally count the number of destination.port … --- ## [Azure Snapshot ECK](https://discuss.elastic.co/t/azure-snapshot-eck/253610)
**Author:** [@Fikrat\_Karimli](https://discuss.elastic.co/u/Fikrat_Karimli)\ **Replies:** 1\ **Last updated:** [October 28, 2020, 7:58pm UTC](https://discuss.elastic.co/t/azure-snapshot-eck/253610 "2020-10-28T19:58:29Z")
Hi I followed steps in documentation and another posts. Still getting azure client invalid key even the account name and key is correct. First created secret apiVersion: v1 kind: Secret metadata: name: snapshot-secre… --- ## [Inconsistent date\_histogram "key\_as\_string" when "format" is set](https://discuss.elastic.co/t/inconsistent-date-histogram-key-as-string-when-format-is-set/253597)
**Author:** [@Nicolas\_Labrot](https://discuss.elastic.co/u/Nicolas_Labrot)\ **Replies:** 1\ **Last updated:** [October 28, 2020, 6:00pm UTC](https://discuss.elastic.co/t/inconsistent-date-histogram-key-as-string-when-format-is-set/253597 "2020-10-28T18:00:44Z")
Hello, I have an issue with date\_histogram on Elastic 7.9.2. The "key\_as\_string" does not seems to be correct. I have this index: PUT https://localhost:9200/test -d ' { "mappings":{ "propertie… --- ## [Ingest Node Pipelines making Elasticsearch Unreachable](https://discuss.elastic.co/t/ingest-node-pipelines-making-elasticsearch-unreachable/253534)
**Author:** [@Vijay\_Barai](https://discuss.elastic.co/u/Vijay_Barai)\ **Replies:** 1\ **Last updated:** [October 28, 2020, 4:18pm UTC](https://discuss.elastic.co/t/ingest-node-pipelines-making-elasticsearch-unreachable/253534 "2020-10-28T16:18:33Z")
I am using ES-7.9.1. I created few ingest pipeling for small enrichment using UI. All pipeline working fine individually when load a data using logstash-output-elasticsearch. To impliment all the enrichment I combined 5 … --- ## [How to exclude querystring reponse and keep only exact match if present?](https://discuss.elastic.co/t/how-to-exclude-querystring-reponse-and-keep-only-exact-match-if-present/253412)
**Author:** [@darshan\_ambre](https://discuss.elastic.co/u/darshan_ambre)\ **Replies:** 2\ **Last updated:** [October 28, 2020, 1:59pm UTC](https://discuss.elastic.co/t/how-to-exclude-querystring-reponse-and-keep-only-exact-match-if-present/253412 "2020-10-28T13:59:39Z")
How to return only exact match if exists else perform wildcard search. for e.g. for the below given set of data \[ { "\_index" : "priority\_test", "\_type" : "\_doc", "\_id" : "3IkeZHUBYJCjRl… --- ## [Add trace ids to deprecation logs](https://discuss.elastic.co/t/add-trace-ids-to-deprecation-logs/252999)
**Author:** [@rdragan](https://discuss.elastic.co/u/rdragan)\ **Replies:** 1\ **Last updated:** [October 28, 2020, 1:54pm UTC](https://discuss.elastic.co/t/add-trace-ids-to-deprecation-logs/252999 "2020-10-28T13:54:44Z")
Hello, I've noticed that your search and indexing slow logs have attached trace ids \[Github code\]. I was wondering if it would be possible to add them to deprecation logs as well? The motivation behind this is the fa… --- ## [Count max consecutive values](https://discuss.elastic.co/t/count-max-consecutive-values/253565)
**Author:** [@Yevhen\_Baidiuk](https://discuss.elastic.co/u/Yevhen_Baidiuk)\ **Replies:** 0\ **Last updated:** [October 28, 2020, 1:33pm UTC](https://discuss.elastic.co/t/count-max-consecutive-values/253565 "2020-10-28T13:33:19Z")
Hello, I try to get values with specific logic. For Example, we get 2 Entity from 4 days period. Name Date Val B 01 1 (1) A 01 1 A 02 0 A … --- ## [Term aggregation size well with in search.max\_buckets, still getting too-many-bucket errors](https://discuss.elastic.co/t/term-aggregation-size-well-with-in-search-max-buckets-still-getting-too-many-bucket-errors/253535)
**Author:** [@nicholasb](https://discuss.elastic.co/u/nicholasb)\ **Replies:** 0\ **Last updated:** [October 28, 2020, 9:00am UTC](https://discuss.elastic.co/t/term-aggregation-size-well-with-in-search-max-buckets-still-getting-too-many-bucket-errors/253535 "2020-10-28T09:00:27Z")
The ES setup is with single-node and single-shard. There are around 15000 records being added on a given 8-hour window on a specific index. The search.max\_buckets is set to 10000. For the following query, if the size is… --- ## [Maximum Heap Size for Server with 192GB RAM](https://discuss.elastic.co/t/maximum-heap-size-for-server-with-192gb-ram/253277)
**Author:** [@gnome](https://discuss.elastic.co/u/gnome)\ **Replies:** 5\ **Last updated:** [October 28, 2020, 5:57am UTC](https://discuss.elastic.co/t/maximum-heap-size-for-server-with-192gb-ram/253277 "2020-10-28T05:57:18Z")
Good day everyone. I spend some time read up the maximum heap size can be allocated for ElasticSearch Server, most of it said recommend maximum of 32GB or 1/2 of your physical memory. I have a server with 192GB of Ram, … --- ## [Update by query don't accept user-defined param in java high level client](https://discuss.elastic.co/t/update-by-query-dont-accept-user-defined-param-in-java-high-level-client/226927)
**Author:** [@tnarita](https://discuss.elastic.co/u/tnarita)\ **Replies:** 8\ **Last updated:** [October 28, 2020, 3:49am UTC](https://discuss.elastic.co/t/update-by-query-dont-accept-user-defined-param-in-java-high-level-client/226927 "2020-10-28T03:49:01Z")
Hi, I'm using REST High Level Client in v7.5 I'm getting error when I tried to update all document by UpdateByQueryRequest. Error message : cannot write xcontent for unknown value of type class entity.Navigation Belo… --- ## [java.net.ConnectException: Connection timed out: no further information](https://discuss.elastic.co/t/java-net-connectexception-connection-timed-out-no-further-information/253513)
**Author:** [@carolcoral](https://discuss.elastic.co/u/carolcoral)\ **Replies:** 0\ **Last updated:** [October 28, 2020, 3:22am UTC](https://discuss.elastic.co/t/java-net-connectexception-connection-timed-out-no-further-information/253513 "2020-10-28T03:22:50Z")
Java version:1.8 Es version:7.9.2 Es java maven: \ \org.elasticsearch.client\ \elasticsearch-rest-high-level-client\ \7.9.3\ \… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=775) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=777)