# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=777 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 778 --- ## [\[bug\] big decimal value losed precision](https://discuss.elastic.co/t/bug-big-decimal-value-losed-precision/253105)
**Author:** [@vpzlin](https://discuss.elastic.co/u/vpzlin)\ **Replies:** 10\ **Last updated:** [October 28, 2020, 2:09am UTC](https://discuss.elastic.co/t/bug-big-decimal-value-losed-precision/253105 "2020-10-28T02:09:56Z")
Hello, ES team! There is a precision losing problem when I'm using java client of ElasticSearch. Will you fix this bug recently? We do need a big decimal in developing financial system. Thanks very much! \[Development… --- ## [Cluster eventually starts giving absurdly wrong counts on search](https://discuss.elastic.co/t/cluster-eventually-starts-giving-absurdly-wrong-counts-on-search/252096)
**Author:** [@caarlos0](https://discuss.elastic.co/u/caarlos0)\ **Replies:** 3\ **Last updated:** [October 28, 2020, 2:06am UTC](https://discuss.elastic.co/t/cluster-eventually-starts-giving-absurdly-wrong-counts-on-search/252096 "2020-10-28T02:06:05Z")
We have a cluster running version 5.6.16. It has ~5.7k primary shards, ~2k indices and 28 nodes (3 masters, 3 coordinators and 22 data nodes): { "cluster\_name": "foo", "status": "green", "timed\_out": false, "num… --- ## [Creating dynamic watcher](https://discuss.elastic.co/t/creating-dynamic-watcher/252473)
**Author:** [@Wilbert\_Silverio](https://discuss.elastic.co/u/Wilbert_Silverio)\ **Replies:** 6\ **Last updated:** [October 28, 2020, 1:02am UTC](https://discuss.elastic.co/t/creating-dynamic-watcher/252473 "2020-10-28T01:02:28Z")
Hi All, we had a watcher wherein it sends us a notification when the transactions are going in per hour. we wanted to create a dynamic watcher wherein it checks for the peak hours and checks during off-peak hours. Can s… --- ## [K8s Elasticsearch with filebeat is keeping 'not ready' after rebooting](https://discuss.elastic.co/t/k8s-elasticsearch-with-filebeat-is-keeping-not-ready-after-rebooting/253376)
**Author:** [@klaude416](https://discuss.elastic.co/u/klaude416)\ **Replies:** 1\ **Last updated:** [October 28, 2020, 12:42am UTC](https://discuss.elastic.co/t/k8s-elasticsearch-with-filebeat-is-keeping-not-ready-after-rebooting/253376 "2020-10-28T00:42:41Z")
I'm going through a not very understandable situation. Environment Two dedicated nodes with azure centos 8.2 (2vcpu, 16G ram), not AKS 1 master node, 1 worker node. kubernetes v1.19.3 helm v2.16.12 Helm charts Elasti… --- ## [Documents version getting set to -1](https://discuss.elastic.co/t/documents-version-getting-set-to-1/253492)
**Author:** [@natasha\_adewar](https://discuss.elastic.co/u/natasha_adewar)\ **Replies:** 0\ **Last updated:** [October 27, 2020, 8:50pm UTC](https://discuss.elastic.co/t/documents-version-getting-set-to-1/253492 "2020-10-27T20:50:38Z")
We are migrating ES from 2.4 to 5.6. Before migrating we copy all the documents from Index A to Index B. After migrating to 5.6 we are seeing many of the documents version on Index B is getting set to -1, hence the dele… --- ## [Invalid index name \[\_security\], must not start with '\_', '-', or '+'](https://discuss.elastic.co/t/invalid-index-name-security-must-not-start-with-or/253448)
**Author:** [@mr\_searchng](https://discuss.elastic.co/u/mr_searchng)\ **Replies:** 10\ **Last updated:** [October 27, 2020, 8:41pm UTC](https://discuss.elastic.co/t/invalid-index-name-security-must-not-start-with-or/253448 "2020-10-27T20:41:19Z")
Elasticsearch version :6.3.0 --- ## [Ingest Pipeline with Grok Processor cannot index all files](https://discuss.elastic.co/t/ingest-pipeline-with-grok-processor-cannot-index-all-files/252594)
**Author:** [@morningkaren](https://discuss.elastic.co/u/morningkaren)\ **Replies:** 5\ **Last updated:** [October 27, 2020, 6:22pm UTC](https://discuss.elastic.co/t/ingest-pipeline-with-grok-processor-cannot-index-all-files/252594 "2020-10-27T18:22:28Z")
Hello, In Python, I created an ingest pipeline with a grok processor to look for names in the file.filename field like so : body = { "description" : "name\_search\_test pipeline", "processors" : \[ … --- ## [ES Sorting on datetimestamp](https://discuss.elastic.co/t/es-sorting-on-datetimestamp/253476)
**Author:** [@Amit-Singh](https://discuss.elastic.co/u/Amit-Singh)\ **Replies:** 1\ **Last updated:** [October 27, 2020, 6:14pm UTC](https://discuss.elastic.co/t/es-sorting-on-datetimestamp/253476 "2020-10-27T18:14:02Z")
Hi Elasticsearch community, I have a doubt/ask, I need to get the latest record from the hits based on a date timestamp column. The format of date time column i.e. 'time': 'Mon Oct 26 20:04:11 2020' Kindly help me out … --- ## [Create a weekly report](https://discuss.elastic.co/t/create-a-weekly-report/253457)
**Author:** [@headtea](https://discuss.elastic.co/u/headtea)\ **Replies:** 0\ **Last updated:** [October 27, 2020, 3:23pm UTC](https://discuss.elastic.co/t/create-a-weekly-report/253457 "2020-10-27T15:23:52Z")
I've created a dashboard per bossman's requested and now he asks it to be delivered by mail every week. Unfortunately with a zero budget, I'm looking for an alternative for the paid subscription provided in kibana. Does… --- ## [Add Synonym Analyzer for Keyword field](https://discuss.elastic.co/t/add-synonym-analyzer-for-keyword-field/253469)
**Author:** [@Coder\_Cub](https://discuss.elastic.co/u/Coder_Cub)\ **Replies:** 0\ **Last updated:** [October 27, 2020, 4:23pm UTC](https://discuss.elastic.co/t/add-synonym-analyzer-for-keyword-field/253469 "2020-10-27T16:23:12Z")
Hi everyone, I am stuck here for adding Synonym Analyzer to Keyword field while creating my index. Can you please help how can I achieve this or what am I missing? Use case: A person can have multiple nick names. If … --- ## [Declare a field variable for use in a for cycle](https://discuss.elastic.co/t/declare-a-field-variable-for-use-in-a-for-cycle/253452)
**Author:** [@Juan\_David\_Jaramillo](https://discuss.elastic.co/u/Juan_David_Jaramillo)\ **Replies:** 0\ **Last updated:** [October 27, 2020, 3:10pm UTC](https://discuss.elastic.co/t/declare-a-field-variable-for-use-in-a-for-cycle/253452 "2020-10-27T15:10:15Z")
hi, guys, i need your help with this code, it's well? { "trigger": { "schedule": { "interval": "24h" } }, "input": { "search": { "request": { "search\_type": "query\_then\_fetch", … --- ## [Terms aggregation on a keyword field returns no results](https://discuss.elastic.co/t/terms-aggregation-on-a-keyword-field-returns-no-results/253436)
**Author:** [@akhilmathew001](https://discuss.elastic.co/u/akhilmathew001)\ **Replies:** 1\ **Last updated:** [October 27, 2020, 2:52pm UTC](https://discuss.elastic.co/t/terms-aggregation-on-a-keyword-field-returns-no-results/253436 "2020-10-27T14:52:09Z")
I have Elastic search v7.2 with an index of 20 million documents. Part of es schema is as follows; { "properties": { "industries\_name": { "copy\_to": \[ "keyword\_search\_copy\_to\_field" \], "ty… --- ## [ResourceNotFoundException when running percolator query](https://discuss.elastic.co/t/resourcenotfoundexception-when-running-percolator-query/253440)
**Author:** [@makons](https://discuss.elastic.co/u/makons)\ **Replies:** 0\ **Last updated:** [October 27, 2020, 12:52pm UTC](https://discuss.elastic.co/t/resourcenotfoundexception-when-running-percolator-query/253440 "2020-10-27T12:52:27Z")
I'm getting a lot of ResourceNotFoundExceptions when using percolator queries, and I cannot seem to fully understand why... So the document that is reported to be missing in an index, indeed is not there, but I don't und… --- ## [Input / Index configuration for log browsing. Differences due to disabled xpack?](https://discuss.elastic.co/t/input-index-configuration-for-log-browsing-differences-due-to-disabled-xpack/253427)
**Author:** [@AndreasS](https://discuss.elastic.co/u/AndreasS)\ **Replies:** 0\ **Last updated:** [October 27, 2020, 11:21am UTC](https://discuss.elastic.co/t/input-index-configuration-for-log-browsing-differences-due-to-disabled-xpack/253427 "2020-10-27T11:21:32Z")
Hello, sorry for the absolute noob question. Edit: just found the solution myself. Please ignore it, nothing interesting to see here anymore... :wink: I am looking for a solution to brows all my codes (running in some… --- ## [ILM Lifecycle limit of total fields](https://discuss.elastic.co/t/ilm-lifecycle-limit-of-total-fields/253420)
**Author:** [@dfoot](https://discuss.elastic.co/u/dfoot)\ **Replies:** 0\ **Last updated:** [October 27, 2020, 10:47am UTC](https://discuss.elastic.co/t/ilm-lifecycle-limit-of-total-fields/253420 "2020-10-27T10:47:21Z")
Created ILM successfully couple of weeks ago for multi topics but one of topics I am getting error messages on logstash log - limit of total field 1000 for footy-000013. I added below: PUT micky\_aaa\_footy\*/\_settings { … --- ## [Ingest pipeline not working correctly?](https://discuss.elastic.co/t/ingest-pipeline-not-working-correctly/253291)
**Author:** [@iamtheliquor](https://discuss.elastic.co/u/iamtheliquor)\ **Replies:** 2\ **Last updated:** [October 27, 2020, 10:36am UTC](https://discuss.elastic.co/t/ingest-pipeline-not-working-correctly/253291 "2020-10-27T10:36:55Z")
Hi everybody, We have two pipelines, that are identical, one is for staging and one is for production logs; { "staging\_pipeline" : { "description" : "Staging Pipeline", "processors" : \[ … --- ## [Constant SocketException: Broken pipe for selective indices while taking snapshot to AWS](https://discuss.elastic.co/t/constant-socketexception-broken-pipe-for-selective-indices-while-taking-snapshot-to-aws/253389)
**Author:** [@nishant.saini](https://discuss.elastic.co/u/nishant.saini)\ **Replies:** 0\ **Last updated:** [October 27, 2020, 6:28am UTC](https://discuss.elastic.co/t/constant-socketexception-broken-pipe-for-selective-indices-while-taking-snapshot-to-aws/253389 "2020-10-27T06:28:49Z")
We have been facing a strange issue while taking snapshot of all the indices in our cluster. Issuing an API call to take snapshot works fine every time for some indices but fail every time for a few indices. Taking snap… --- ## [Best strategy for fast recoveries after node restart](https://discuss.elastic.co/t/best-strategy-for-fast-recoveries-after-node-restart/253381)
**Author:** [@jthoni](https://discuss.elastic.co/u/jthoni)\ **Replies:** 0\ **Last updated:** [October 27, 2020, 2:35am UTC](https://discuss.elastic.co/t/best-strategy-for-fast-recoveries-after-node-restart/253381 "2020-10-27T02:35:06Z")
We have a 90 node cluster running in an Azure Service Fabric application. We have a few services in this application (logstash, a watchdog service, some compliance services, etc.). We occasionally need to roll updates ou… --- ## [Changing role of a pod node](https://discuss.elastic.co/t/changing-role-of-a-pod-node/253371)
**Author:** [@asrinivasan](https://discuss.elastic.co/u/asrinivasan)\ **Replies:** 0\ **Last updated:** [October 26, 2020, 11:49pm UTC](https://discuss.elastic.co/t/changing-role-of-a-pod-node/253371 "2020-10-26T23:49:18Z")
Hi I have a cluster with 5 master nodes and 10 data nodes deployed on GKE using the stable helm charts. Version is 7.2.0. When i setup the cluster initially i had 5 nodes which had alll the roles master,data and ingest… --- ## [How to store iis x-forwarded-for ip with field type IPORHOST](https://discuss.elastic.co/t/how-to-store-iis-x-forwarded-for-ip-with-field-type-iporhost/253186)
**Author:** [@Thanura\_Kannangara](https://discuss.elastic.co/u/Thanura_Kannangara)\ **Replies:** 4\ **Last updated:** [October 26, 2020, 6:16pm UTC](https://discuss.elastic.co/t/how-to-store-iis-x-forwarded-for-ip-with-field-type-iporhost/253186 "2020-10-26T18:16:31Z")
I'm trying to grok these entries #Fields: date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) cs(Referer) sc-status sc-substatus sc-win32-status time-taken X-Forwarded-For 2020-10-23… --- ## [Endpoint not detecting installed plugins](https://discuss.elastic.co/t/endpoint-not-detecting-installed-plugins/253352)
**Author:** [@columbian\_chris](https://discuss.elastic.co/u/columbian_chris)\ **Replies:** 0\ **Last updated:** [October 26, 2020, 5:03pm UTC](https://discuss.elastic.co/t/endpoint-not-detecting-installed-plugins/253352 "2020-10-26T17:03:04Z")
I have installed a couple plugins into my elasticsearch setup, but nothing gets listed when I use the /\_cat/plugins endpoint. I can confirm that they're installed because bin/elasticsearch-plugin list correctly lists th… --- ## [ML watcher configs](https://discuss.elastic.co/t/ml-watcher-configs/251696)
**Author:** [@saraKM](https://discuss.elastic.co/u/saraKM)\ **Replies:** 3\ **Last updated:** [October 26, 2020, 4:59pm UTC](https://discuss.elastic.co/t/ml-watcher-configs/251696 "2020-10-26T16:59:45Z")
We have a watcher running for a daily ML job (1d bucket span) over .ml-anomalies\* and fires for record results where in\_interim is false and some other conditions on record\_score and actual values. The watcher has a sche… --- ## [Problem with query date elastichsearch with php](https://discuss.elastic.co/t/problem-with-query-date-elastichsearch-with-php/253336)
**Author:** [@joseantonio.sanchez](https://discuss.elastic.co/u/joseantonio.sanchez)\ **Replies:** 0\ **Last updated:** [October 26, 2020, 3:43pm UTC](https://discuss.elastic.co/t/problem-with-query-date-elastichsearch-with-php/253336 "2020-10-26T15:43:56Z")
good afternoon, I am making a query from php to elasticsearch, I give you some parameters $params = \[ 'scroll' =\> '30s', // how long between scroll requests. should be small! 'size' =\> 300, //… --- ## [How to only use score of best matching term](https://discuss.elastic.co/t/how-to-only-use-score-of-best-matching-term/253317)
**Author:** [@JF2018](https://discuss.elastic.co/u/JF2018)\ **Replies:** 2\ **Last updated:** [October 26, 2020, 3:53pm UTC](https://discuss.elastic.co/t/how-to-only-use-score-of-best-matching-term/253317 "2020-10-26T15:53:43Z")
Hey I have four terms, Term\_A, Term\_B, Term\_C and Term\_D. I would like to do something like this: { "query": { "bool" : { "should" : \[ { "term" : { "tags\_field" : "Term\_A" } }, … --- ## [Has\_child query match children-less parent](https://discuss.elastic.co/t/has-child-query-match-children-less-parent/253325)
**Author:** [@rfferrao](https://discuss.elastic.co/u/rfferrao)\ **Replies:** 1\ **Last updated:** [October 26, 2020, 3:36pm UTC](https://discuss.elastic.co/t/has-child-query-match-children-less-parent/253325 "2020-10-26T15:36:59Z")
Is it possible to do this? Here's what I've tried: { "query": { "bool": { "should": { "has\_child": { "type": "group", "query": { "bool": { "should": { "match\_all": { } } } }, … --- ## [Create a weekly newsletter that contains e.g. a Dashboard](https://discuss.elastic.co/t/create-a-weekly-newsletter-that-contains-e-g-a-dashboard/253331)
**Author:** [@kwoxer](https://discuss.elastic.co/u/kwoxer)\ **Replies:** 0\ **Last updated:** [October 26, 2020, 3:05pm UTC](https://discuss.elastic.co/t/create-a-weekly-newsletter-that-contains-e-g-a-dashboard/253331 "2020-10-26T15:05:46Z")
I would like to send a newsletter every week with the information of one Dashboard. So I already found the Email action. But I'm not so sure if that is actually what I need. Is there maybe a more detailed tutorial abou… --- ## [ES Flush Latency is too high](https://discuss.elastic.co/t/es-flush-latency-is-too-high/253324)
**Author:** [@robertitox](https://discuss.elastic.co/u/robertitox)\ **Replies:** 0\ **Last updated:** [October 26, 2020, 2:33pm UTC](https://discuss.elastic.co/t/es-flush-latency-is-too-high/253324 "2020-10-26T14:33:47Z")
Dear people, I have a 3 node ES 7.9.1 cluster running OK. But when I activate the ES template for my Zabbix monitor, I get these warnings for each of my three ES nodes: And this is the trigger in Zabbix: My storag… --- ## [Coordinating node license requirement](https://discuss.elastic.co/t/coordinating-node-license-requirement/253279)
**Author:** [@Jalpesh1](https://discuss.elastic.co/u/Jalpesh1)\ **Replies:** 1\ **Last updated:** [October 26, 2020, 2:41pm UTC](https://discuss.elastic.co/t/coordinating-node-license-requirement/253279 "2020-10-26T14:41:26Z")
Hi Team, We have 5 Nodes cluster with Platinum license . Now we are planning to add 1 coordinating node for request/response. Do we require additional license for coordinating node ? Regards, Jalpesh --- ## [ILM index priority not being set correctly](https://discuss.elastic.co/t/ilm-index-priority-not-being-set-correctly/250379)
**Author:** [@samcook](https://discuss.elastic.co/u/samcook)\ **Replies:** 2\ **Last updated:** [October 26, 2020, 2:08pm UTC](https://discuss.elastic.co/t/ilm-index-priority-not-being-set-correctly/250379 "2020-10-26T14:08:24Z")
I have an ILM policy defined that looks like this: GET \_ilm/policy/warm-shrink-merge-after-1-year { "warm-shrink-merge-after-1-year" : { "version" : 1, "modified\_date" : "2020-09-28T23:03:18.959Z", "policy… --- ## [Elastic Ingest Pipeline with enrich processor to enrich nested objects](https://discuss.elastic.co/t/elastic-ingest-pipeline-with-enrich-processor-to-enrich-nested-objects/253044)
**Author:** [@bgiordano](https://discuss.elastic.co/u/bgiordano)\ **Replies:** 2\ **Last updated:** [October 26, 2020, 1:36pm UTC](https://discuss.elastic.co/t/elastic-ingest-pipeline-with-enrich-processor-to-enrich-nested-objects/253044 "2020-10-26T13:36:39Z")
What is the correct syntax for the enrich processor to access field for enrichment for an object within an array? This works to get access to field in single object, as shown in the example provided. This is what I am s… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=776) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=778)