# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=778 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 779 --- ## [Index Lifecycle Policy Failures](https://discuss.elastic.co/t/index-lifecycle-policy-failures/253306)
**Author:** [@Mohammad\_Etemad](https://discuss.elastic.co/u/Mohammad_Etemad)\ **Replies:** 0\ **Last updated:** [October 26, 2020, 12:39pm UTC](https://discuss.elastic.co/t/index-lifecycle-policy-failures/253306 "2020-10-26T12:39:24Z")
Hello, I am using Elasticsearch version 7.4 and have configured rollover policies for my indices. Every now and then on some indices (by random) I get some failures on rollover. The errors include: illegal\_argument\_exc… --- ## [Elastic Stack OIDC Google](https://discuss.elastic.co/t/elastic-stack-oidc-google/251898)
**Author:** [@Bjoern\_Boschman](https://discuss.elastic.co/u/Bjoern_Boschman)\ **Replies:** 2\ **Last updated:** [October 26, 2020, 12:28pm UTC](https://discuss.elastic.co/t/elastic-stack-oidc-google/251898 "2020-10-26T12:28:39Z")
Hi, I'm trying to get OIDC integration with google working without any success for quite some time. Im using Elastic Stack as a Service First I configured within Elasticsearch keystore: xpack.security.authc.realms.oi… --- ## [Count of each API in a different table](https://discuss.elastic.co/t/count-of-each-api-in-a-different-table/253302)
**Author:** [@rohitarorait82](https://discuss.elastic.co/u/rohitarorait82)\ **Replies:** 1\ **Last updated:** [October 26, 2020, 12:28pm UTC](https://discuss.elastic.co/t/count-of-each-api-in-a-different-table/253302 "2020-10-26T12:28:24Z")
Hi All, We need to create a table where we can store daily counts of all the apis. We actually keep data of around 1 month in ELK but will be needing count details for around an year for analysis. Is there a way to do … --- ## [Watcher configuration error](https://discuss.elastic.co/t/watcher-configuration-error/253292)
**Author:** [@Syed.Ubaid](https://discuss.elastic.co/u/Syed.Ubaid)\ **Replies:** 1\ **Last updated:** [October 26, 2020, 12:25pm UTC](https://discuss.elastic.co/t/watcher-configuration-error/253292 "2020-10-26T12:25:57Z")
I am configuring watcher email in elasticsearch yml using this configuration xpack.notification.email.account: gmail\_account: profile: gmail smtp: auth: true starttls.enable: true host: smtp.gmail.com port: 587 … --- ## [Grok parser date processor problem](https://discuss.elastic.co/t/grok-parser-date-processor-problem/253207)
**Author:** [@gizem](https://discuss.elastic.co/u/gizem)\ **Replies:** 4\ **Last updated:** [October 26, 2020, 12:23pm UTC](https://discuss.elastic.co/t/grok-parser-date-processor-problem/253207 "2020-10-26T12:23:04Z")
Hi, I have the grok parser below: { "description": "pipeline", "processors": \[ { "grok": { "if": "ctx.message.contains('LOG1')", "field": "message", "patterns": \[ "\\\\\[%{G… --- ## [Dataset of IP's to query against Index](https://discuss.elastic.co/t/dataset-of-ips-to-query-against-index/253056)
**Author:** [@MichaelHuff](https://discuss.elastic.co/u/MichaelHuff)\ **Replies:** 3\ **Last updated:** [October 26, 2020, 12:22pm UTC](https://discuss.elastic.co/t/dataset-of-ips-to-query-against-index/253056 "2020-10-26T12:22:19Z")
I have a data set of around 40k of IP Addresses that are known bad IP's. I am wanting to query that data set against an index in my stack. When I query the data I wanna bring back any specific username that has had a suc… --- ## [ES aggregation query](https://discuss.elastic.co/t/es-aggregation-query/253284)
**Author:** [@niraj\_pandey](https://discuss.elastic.co/u/niraj_pandey)\ **Replies:** 4\ **Last updated:** [October 26, 2020, 12:05pm UTC](https://discuss.elastic.co/t/es-aggregation-query/253284 "2020-10-26T12:05:22Z")
I am running a huge aggregation query and getting the following error. This aggregation creates too many buckets (10001) and will throw an error in future versions. You should update the \[search.max\_buckets\] cluster set… --- ## [How to give priority to exact search in multiple should match?](https://discuss.elastic.co/t/how-to-give-priority-to-exact-search-in-multiple-should-match/253300)
**Author:** [@darshan\_ambre](https://discuss.elastic.co/u/darshan_ambre)\ **Replies:** 0\ **Last updated:** [October 26, 2020, 11:54am UTC](https://discuss.elastic.co/t/how-to-give-priority-to-exact-search-in-multiple-should-match/253300 "2020-10-26T11:54:57Z")
How to return only exact match if exists else perform wildcard search. for e.g. for the below given set of data \[ { "\_index" : "priority\_test", "\_type" : "\_doc", "\_id" : "3IkeZHUBYJCjRl… --- ## [CircuitBreakingException: \[parent\] Data too large](https://discuss.elastic.co/t/circuitbreakingexception-parent-data-too-large/253299)
**Author:** [@Grant\_Zietsman](https://discuss.elastic.co/u/Grant_Zietsman)\ **Replies:** 0\ **Last updated:** [October 26, 2020, 11:28am UTC](https://discuss.elastic.co/t/circuitbreakingexception-parent-data-too-large/253299 "2020-10-26T11:28:49Z")
Running into a CircuitBreakingException when doing a restore for Elasticsearch 7.7.1 Based on this issue, I suspect that I can try disabling indices.breaker.total.use\_real\_memory. Alternatively, I can try reducing CMSIn… --- ## [Elasticsearch dead but pid file exists](https://discuss.elastic.co/t/elasticsearch-dead-but-pid-file-exists/252684)
**Author:** [@muthug](https://discuss.elastic.co/u/muthug)\ **Replies:** 3\ **Last updated:** [October 26, 2020, 11:19am UTC](https://discuss.elastic.co/t/elasticsearch-dead-but-pid-file-exists/252684 "2020-10-26T11:19:39Z")
Why it is happening very frequently? is there any thing crashed ? i have removed the dead file from /var/lock/subsys but again and again i am getting this. Elasticsearch dead but pid file exists --- ## [Elasticsearch error](https://discuss.elastic.co/t/elasticsearch-error/253176)
**Author:** [@Akhil2](https://discuss.elastic.co/u/Akhil2)\ **Replies:** 1\ **Last updated:** [October 26, 2020, 9:25am UTC](https://discuss.elastic.co/t/elasticsearch-error/253176 "2020-10-26T09:25:48Z")
Hello there, I have been using ELK 7.9.2 and now I am trying to set up a cluster with ELK 7.9.3. when I run elasticsearch it gives me following errors? \[2020-10-23T11:51:05,352\]\[WARN \]\[o.e.x.m.e.l.LocalExporter\] \[mast… --- ## [Filter/Collapse on multiple fields](https://discuss.elastic.co/t/filter-collapse-on-multiple-fields/252858)
**Author:** [@Turbo-555](https://discuss.elastic.co/u/Turbo-555)\ **Replies:** 2\ **Last updated:** [October 26, 2020, 9:22am UTC](https://discuss.elastic.co/t/filter-collapse-on-multiple-fields/252858 "2020-10-26T09:22:01Z")
Hi all, I'm trying to find documents that have distinct values over 2 separate fields. Documents have \_id, filters.10,filters.20 For Example: 1, f10\_1, f20\_1 2, f10\_1, f20\_1 3, f10\_2, f20\_1 4, f10\_3, … --- ## [Unable to start the elasticsearch as it says "failed to start ElasticSearch"](https://discuss.elastic.co/t/unable-to-start-the-elasticsearch-as-it-says-failed-to-start-elasticsearch/253257)
**Author:** [@aknraj](https://discuss.elastic.co/u/aknraj)\ **Replies:** 1\ **Last updated:** [October 26, 2020, 9:07am UTC](https://discuss.elastic.co/t/unable-to-start-the-elasticsearch-as-it-says-failed-to-start-elasticsearch/253257 "2020-10-26T09:07:12Z")
Hi - I am receiving the following error while starting the elasticsearch, can you please advise if i am missing any step to follow? â elasticsearch.service - Elasticsearch Loaded: loaded (/usr/lib/systemd/system/elasti… --- ## [Context Suggester: FST size estimate (RAM)](https://discuss.elastic.co/t/context-suggester-fst-size-estimate-ram/252642)
**Author:** [@Bhavik92](https://discuss.elastic.co/u/Bhavik92)\ **Replies:** 5\ **Last updated:** [October 26, 2020, 9:03am UTC](https://discuss.elastic.co/t/context-suggester-fst-size-estimate-ram/252642 "2020-10-26T09:03:24Z")
I've heard about the high memory (heap) occupancy in case FST. Is there any thumb rule I can use to calculate the size of FST / heap given the amount of data that'll be fed as input to suggester. Any benchmarking studie… --- ## ["refresh" index as a background task](https://discuss.elastic.co/t/refresh-index-as-a-background-task/253280)
**Author:** [@ebuildy](https://discuss.elastic.co/u/ebuildy)\ **Replies:** 0\ **Last updated:** [October 26, 2020, 9:02am UTC](https://discuss.elastic.co/t/refresh-index-as-a-background-task/253280 "2020-10-26T09:02:05Z")
We have a big index, calling "\_refresh" API take more than 30 secondes and timeout our HTTP client. what about to add a new parameter wait\_for\_completion (like for reindex API), so this possible to run it asynchronously… --- ## [Enrich processor](https://discuss.elastic.co/t/enrich-processor/252987)
**Author:** [@liorg2](https://discuss.elastic.co/u/liorg2)\ **Replies:** 3\ **Last updated:** [October 26, 2020, 8:55am UTC](https://discuss.elastic.co/t/enrich-processor/252987 "2020-10-26T08:55:15Z")
Hello Is it possible to use the enrich processor, with documents from the same index? In addition, when running POST /\_enrich/policy/my-enrich-test-policy/\_execute it creates an index (.enrich....) with all the value… --- ## [How to build a custom query endpoint against Elastic in an Open API?](https://discuss.elastic.co/t/how-to-build-a-custom-query-endpoint-against-elastic-in-an-open-api/253263)
**Author:** [@Elasticjerk](https://discuss.elastic.co/u/Elasticjerk)\ **Replies:** 0\ **Last updated:** [October 26, 2020, 6:57am UTC](https://discuss.elastic.co/t/how-to-build-a-custom-query-endpoint-against-elastic-in-an-open-api/253263 "2020-10-26T06:57:45Z")
Hi! Im hoping to find inspiration, tips or examples on how to open up more possibilities for independent devs and other organisations using our data. We are running an open API for ad search based on Elastic and would … --- ## [Incorrect query analyzing that don't correspond to the search\_analyzer setting](https://discuss.elastic.co/t/incorrect-query-analyzing-that-dont-correspond-to-the-search-analyzer-setting/253256)
**Author:** [@Alex\_Pravdin](https://discuss.elastic.co/u/Alex_Pravdin)\ **Replies:** 0\ **Last updated:** [October 26, 2020, 3:06am UTC](https://discuss.elastic.co/t/incorrect-query-analyzing-that-dont-correspond-to-the-search-analyzer-setting/253256 "2020-10-26T03:06:54Z")
I'm trying to transform search query against a field replacing parentheses by underscores making them regular letters available for search. The same process is made both for index and for the query. I expect that my quer… --- ## [What is the purpose of ingest node?](https://discuss.elastic.co/t/what-is-the-purpose-of-ingest-node/253230)
**Author:** [@Burga](https://discuss.elastic.co/u/Burga)\ **Replies:** 2\ **Last updated:** [October 25, 2020, 10:05pm UTC](https://discuss.elastic.co/t/what-is-the-purpose-of-ingest-node/253230 "2020-10-25T22:05:45Z")
What is the purpose of ingest node ? Thanks in advance. --- ## [Elasticsearch ECK : Kubernetes deployment via default settings showing error](https://discuss.elastic.co/t/elasticsearch-eck-kubernetes-deployment-via-default-settings-showing-error/253231)
**Author:** [@kelk](https://discuss.elastic.co/u/kelk)\ **Replies:** 2\ **Last updated:** [October 25, 2020, 8:26pm UTC](https://discuss.elastic.co/t/elasticsearch-eck-kubernetes-deployment-via-default-settings-showing-error/253231 "2020-10-25T20:26:05Z")
I was following as per quickstart summary of : https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-deploy-elasticsearch.html But when i start , I'm getting below error 0/1 nodes are available: 1 Insufficient memor… --- ## [Does the field used in field\_value\_factor function scoring need to be an 'indexed' field, or can it just be 'stored'?](https://discuss.elastic.co/t/does-the-field-used-in-field-value-factor-function-scoring-need-to-be-an-indexed-field-or-can-it-just-be-stored/253244)
**Author:** [@jbalakrishnan](https://discuss.elastic.co/u/jbalakrishnan)\ **Replies:** 0\ **Last updated:** [October 25, 2020, 6:06pm UTC](https://discuss.elastic.co/t/does-the-field-used-in-field-value-factor-function-scoring-need-to-be-an-indexed-field-or-can-it-just-be-stored/253244 "2020-10-25T18:06:49Z")
I need to use a positive-valued float or double value field, one field value per document, that I compute at index time. I want to use this value to boost the score of each document matching an arbitrary query, by the va… --- ## [ES 7.5 - Enhancing indexing process](https://discuss.elastic.co/t/es-7-5-enhancing-indexing-process/253238)
**Author:** [@Khalil\_Jomaa](https://discuss.elastic.co/u/Khalil_Jomaa)\ **Replies:** 2\ **Last updated:** [October 25, 2020, 2:25pm UTC](https://discuss.elastic.co/t/es-7-5-enhancing-indexing-process/253238 "2020-10-25T14:25:56Z")
Hello, We are working to enhance our indexing process using ES version 7.5.2 and looking to create a dedicated cluster for doing the test, we need some help and advise which parameters and changes we can test, for examp… --- ## [Querying sysmon event](https://discuss.elastic.co/t/querying-sysmon-event/252700)
**Author:** [@Yotam\_Mazurik](https://discuss.elastic.co/u/Yotam_Mazurik)\ **Replies:** 1\ **Last updated:** [October 25, 2020, 9:29am UTC](https://discuss.elastic.co/t/querying-sysmon-event/252700 "2020-10-25T09:29:44Z")
Hi, I am new to elk and trying to understand what data modeling to use for my network. what I am trying to achieve is a central databse that will group sysmon data from hosts over my network and querying that dataset t… --- ## [Problem with master node](https://discuss.elastic.co/t/problem-with-master-node/253218)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 1\ **Last updated:** [October 24, 2020, 8:39pm UTC](https://discuss.elastic.co/t/problem-with-master-node/253218 "2020-10-24T20:39:50Z")
I'd setup the 3 node master for node 1 the configuration was node.name: master1 nod.data: false node.master: true node.voting\_only: true for node 2 the configuration was node.name: master2 nod.data: false node.master… --- ## [RSS feed for new Elasticsearch versions](https://discuss.elastic.co/t/rss-feed-for-new-elasticsearch-versions/253217)
**Author:** [@BS1](https://discuss.elastic.co/u/BS1)\ **Replies:** 0\ **Last updated:** [October 24, 2020, 7:02pm UTC](https://discuss.elastic.co/t/rss-feed-for-new-elasticsearch-versions/253217 "2020-10-24T19:02:57Z")
My group manages multiple Elasticsearch clusters in AWS, and we’d like to set up some automation around building new AMIs whenever a new ES version is available. Is there an official RSS feed we can tap into which is dep… --- ## [Running a elasticsearch 7.9 cluster of two (or several) nodes on same (windows) machine](https://discuss.elastic.co/t/running-a-elasticsearch-7-9-cluster-of-two-or-several-nodes-on-same-windows-machine/253162)
**Author:** [@dror](https://discuss.elastic.co/u/dror)\ **Replies:** 4\ **Last updated:** [October 24, 2020, 5:56pm UTC](https://discuss.elastic.co/t/running-a-elasticsearch-7-9-cluster-of-two-or-several-nodes-on-same-windows-machine/253162 "2020-10-24T17:56:41Z")
Hi ! i'm trying to run a cluster of two (or several) nodes on same (windows) machine. Each node is pointing to the other node in the "discovery.seed\_hosts" node 1 configuration is (the only rows that changed from … --- ## [ILM hot-\>warm resource usage question](https://discuss.elastic.co/t/ilm-hot-warm-resource-usage-question/253213)
**Author:** [@basdfa23](https://discuss.elastic.co/u/basdfa23)\ **Replies:** 0\ **Last updated:** [October 24, 2020, 4:38pm UTC](https://discuss.elastic.co/t/ilm-hot-warm-resource-usage-question/253213 "2020-10-24T16:38:21Z")
Both force merge and best\_compression are resource intensive. If you set the ILM hot-\>warm rollover for the following actions: force merge change compression to best\_compression change replica from 0 to 1 On which n… --- ## [Elasticsearch RPM installation conflicts old Elasticsearch](https://discuss.elastic.co/t/elasticsearch-rpm-installation-conflicts-old-elasticsearch/252419)
**Author:** [@H0bbit](https://discuss.elastic.co/u/H0bbit)\ **Replies:** 2\ **Last updated:** [October 24, 2020, 4:15pm UTC](https://discuss.elastic.co/t/elasticsearch-rpm-installation-conflicts-old-elasticsearch/252419 "2020-10-24T16:15:13Z")
Hi there, I'm pretty new to Elasticsearch. I have been trying to install it on my Centos 7 server. I have been following a tutorial for installing elasticsearch-oss. Because I was playing with it, I have uninstalled it … --- ## [Return all top level fields with nested filter ES 7.9](https://discuss.elastic.co/t/return-all-top-level-fields-with-nested-filter-es-7-9/253211)
**Author:** [@bnarang](https://discuss.elastic.co/u/bnarang)\ **Replies:** 0\ **Last updated:** [October 24, 2020, 3:21pm UTC](https://discuss.elastic.co/t/return-all-top-level-fields-with-nested-filter-es-7-9/253211 "2020-10-24T15:21:17Z")
I have a usecase where I need to return all top level fields and filtered results from the nested objects. Consider the example: { "jobID": 940230, "jobTitle": "front-end", "jobDetails": \[ { "hours":… --- ## [Elasticsearch query without date range](https://discuss.elastic.co/t/elasticsearch-query-without-date-range/253165)
**Author:** [@gizem](https://discuss.elastic.co/u/gizem)\ **Replies:** 6\ **Last updated:** [October 24, 2020, 1:59pm UTC](https://discuss.elastic.co/t/elasticsearch-query-without-date-range/253165 "2020-10-24T13:59:28Z")
Hello, I wonder how does an elasticsearch query work without a date range? Is there a default size of the result? For example, what if I just only use lte for the range. Does query result include all the records from … [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=777) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=779)