# Elasticsearch

**URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=780

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 781

---

## [Possible to create elasticsearch indices on specific nodes?](https://discuss.elastic.co/t/possible-to-create-elasticsearch-indices-on-specific-nodes/253021)

<div class="topic-metadata">

**Author:** [@Nitish\_Goyal](https://discuss.elastic.co/u/Nitish_Goyal)\
**Replies:** 1\
**Last updated:** [October 22, 2020, 3:15pm UTC](https://discuss.elastic.co/t/possible-to-create-elasticsearch-indices-on-specific-nodes/253021 "2020-10-22T15:15:13Z")

</div>

Hi, Use case : We create daily indices. We want to reserve certain nodes only for some specific indices. Cluster size : 200 nodes Clients : 100+ We want to reserve 40 nodes only for important clients and leave 160 no…

---

## [Understanding continous transforms syncing](https://discuss.elastic.co/t/understanding-continous-transforms-syncing/252827)

<div class="topic-metadata">

**Author:** [@AlessandroKP](https://discuss.elastic.co/u/AlessandroKP)\
**Replies:** 4\
**Last updated:** [October 22, 2020, 2:17pm UTC](https://discuss.elastic.co/t/understanding-continous-transforms-syncing/252827 "2020-10-22T14:17:45Z")

</div>

Hi all, recently I played a bit with the Transforms feature on Elasticsearch. I started by creating this test continuous transform { "description": "Create summary transaction entities", "frequency": "1m", "source"…

---

## [No ingest node in the cluster](https://discuss.elastic.co/t/no-ingest-node-in-the-cluster/252952)

<div class="topic-metadata">

**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\
**Replies:** 2\
**Last updated:** [October 22, 2020, 1:41pm UTC](https://discuss.elastic.co/t/no-ingest-node-in-the-cluster/252952 "2020-10-22T13:41:54Z")

</div>

I am using elasticsearch cluster of 6 node 3 master 2 data node 1 coordinate node.The data nodes and coordinate node throwing the exception of no ingest node in this cluster and i am using logstash for processing the dat…

---

## [Creating a watcher with more conditions - how to](https://discuss.elastic.co/t/creating-a-watcher-with-more-conditions-how-to/249815)

<div class="topic-metadata">

**Author:** [@mathric](https://discuss.elastic.co/u/mathric)\
**Replies:** 11\
**Last updated:** [October 22, 2020, 12:48pm UTC](https://discuss.elastic.co/t/creating-a-watcher-with-more-conditions-how-to/249815 "2020-10-22T12:48:39Z")

</div>

Hey. Imagine you have the following data set: { "\_index": "myindex", "\_type": "\_doc", "\_id": "0f3e7c49b480a4d7ea2352a424ae8550", "\_version": 1, "\_score": null, "\_source": { "Measurement.Warning": 0.2, …

---

## [How to create docs in index using API?](https://discuss.elastic.co/t/how-to-create-docs-in-index-using-api/252566)

<div class="topic-metadata">

**Author:** [@Gosforth](https://discuss.elastic.co/u/Gosforth)\
**Replies:** 3\
**Last updated:** [October 22, 2020, 12:44pm UTC](https://discuss.elastic.co/t/how-to-create-docs-in-index-using-api/252566 "2020-10-22T12:44:47Z")

</div>

What I understand \_type is not required now. So first scenario: POST host/\_bulk { "index":{ "\_index": "myindex"} } { "name":"john doe","age":25 } Does not work Scenario 2: POST host/myindex/\_bulk { "index":{ } } {…

---

## [Elasticsearch bulk rejection error in logstash logs](https://discuss.elastic.co/t/elasticsearch-bulk-rejection-error-in-logstash-logs/249397)

<div class="topic-metadata">

**Author:** [@Kartikey\_Bhatore](https://discuss.elastic.co/u/Kartikey_Bhatore)\
**Replies:** 5\
**Last updated:** [October 22, 2020, 11:58am UTC](https://discuss.elastic.co/t/elasticsearch-bulk-rejection-error-in-logstash-logs/249397 "2020-10-22T11:58:43Z")

</div>

Hello, I am using ELK stack v6.5.3. I have a 7 node cluster (5 datanodes \[elasticsearch + logstash \] and 2 coordinator nodes \[elasticsearch + kibana\]) from past some days I am getting below error on one of my logst…

---

## [Fields Coming as unknown in Index](https://discuss.elastic.co/t/fields-coming-as-unknown-in-index/252996)

<div class="topic-metadata">

**Author:** [@Ayush\_Agrahari](https://discuss.elastic.co/u/Ayush_Agrahari)\
**Replies:** 0\
**Last updated:** [October 22, 2020, 11:57am UTC](https://discuss.elastic.co/t/fields-coming-as-unknown-in-index/252996 "2020-10-22T11:57:11Z")

</div>

I am getting unknown fields in .monitoring-es-\* Index. I recently enabled stack monitoring in ELK Stack then I am getting data in .monitoring-\* Indices. I wanted to create alerts based on this data but I am unable to us…

---

## [Restore an Elasticsearch 6.2 to Elasticsearch 7.7?](https://discuss.elastic.co/t/restore-an-elasticsearch-6-2-to-elasticsearch-7-7/252995)

<div class="topic-metadata">

**Author:** [@tonibirrer](https://discuss.elastic.co/u/tonibirrer)\
**Replies:** 0\
**Last updated:** [October 22, 2020, 11:55am UTC](https://discuss.elastic.co/t/restore-an-elasticsearch-6-2-to-elasticsearch-7-7/252995 "2020-10-22T11:55:21Z")

</div>

Hi, Based on the reference documentation it should be possible to restore a snapshot taken on Elastic 6.x on a 7.x cluster: https://www.elastic.co/guide/en/elasticsearch/reference/current/snapshot-restore.html I've tri…

---

## [Ingest pipeline multiplies processed documents (resulting in three copies)](https://discuss.elastic.co/t/ingest-pipeline-multiplies-processed-documents-resulting-in-three-copies/252002)

<div class="topic-metadata">

**Author:** [@Christos\_Gitsis](https://discuss.elastic.co/u/Christos_Gitsis)\
**Replies:** 4\
**Last updated:** [October 22, 2020, 11:49am UTC](https://discuss.elastic.co/t/ingest-pipeline-multiplies-processed-documents-resulting-in-three-copies/252002 "2020-10-22T11:49:44Z")

</div>

I use an ingest pipeline with a grok processor to add some extra fields to my documents. I have noticed however, that when the pipeline is active, in the end there are three copies of the document in ElastcSearch, all i…

---

## [How to update type of existing field to geo\_point?](https://discuss.elastic.co/t/how-to-update-type-of-existing-field-to-geo-point/252988)

<div class="topic-metadata">

**Author:** [@dattack13](https://discuss.elastic.co/u/dattack13)\
**Replies:** 1\
**Last updated:** [October 22, 2020, 11:46am UTC](https://discuss.elastic.co/t/how-to-update-type-of-existing-field-to-geo-point/252988 "2020-10-22T11:46:12Z")

</div>

Hi I have an existing index which has location inside the property address which is like below - "location" : { "properties" : { "lat" : { "type" : "float" …

---

## [Disabling Elastic User access in Kibana Dashboard](https://discuss.elastic.co/t/disabling-elastic-user-access-in-kibana-dashboard/252940)

<div class="topic-metadata">

**Author:** [@vijazy](https://discuss.elastic.co/u/vijazy)\
**Replies:** 4\
**Last updated:** [October 22, 2020, 10:22am UTC](https://discuss.elastic.co/t/disabling-elastic-user-access-in-kibana-dashboard/252940 "2020-10-22T10:22:30Z")

</div>

HI Elastic Team, I am trying to setup Elastic search log management...I have enabled Xpack for kibana Dashboard authentication and created some users with superuser access.. Now I would like to disable elastic user logi…

---

## [Email ElastAlert Not triggering on Average Aggregation query](https://discuss.elastic.co/t/email-elastalert-not-triggering-on-average-aggregation-query/252948)

<div class="topic-metadata">

**Author:** [@Chennai\_Cheetah](https://discuss.elastic.co/u/Chennai_Cheetah)\
**Replies:** 2\
**Last updated:** [October 22, 2020, 10:20am UTC](https://discuss.elastic.co/t/email-elastalert-not-triggering-on-average-aggregation-query/252948 "2020-10-22T10:20:41Z")

</div>

Mail is not triggering for my elast alert aggregator rule. I have a Elastic DSL Query which returns me an average Response time for the API for the last 15 mins. My objective is to fire email if the API average respons…

---

## [Is -Dmapper.allow\_dots\_in\_name=true setting allowed in 7.X version of ES?](https://discuss.elastic.co/t/is-dmapper-allow-dots-in-name-true-setting-allowed-in-7-x-version-of-es/252982)

<div class="topic-metadata">

**Author:** [@Saravana37](https://discuss.elastic.co/u/Saravana37)\
**Replies:** 0\
**Last updated:** [October 22, 2020, 10:17am UTC](https://discuss.elastic.co/t/is-dmapper-allow-dots-in-name-true-setting-allowed-in-7-x-version-of-es/252982 "2020-10-22T10:17:14Z")

</div>

Hello All , Is -Dmapper.allow\_dots\_in\_name=true allowed in ES 7.X version ? I am looking for a reference document on this ? Thanks and Regards Saravana S

---

## [Elasticsearch keepalive idle timer for logstash connections via http](https://discuss.elastic.co/t/elasticsearch-keepalive-idle-timer-for-logstash-connections-via-http/252981)

<div class="topic-metadata">

**Author:** [@reykime](https://discuss.elastic.co/u/reykime)\
**Replies:** 0\
**Last updated:** [October 22, 2020, 10:11am UTC](https://discuss.elastic.co/t/elasticsearch-keepalive-idle-timer-for-logstash-connections-via-http/252981 "2020-10-22T10:11:33Z")

</div>

Hey Guys I'm currently running into an issue where i see the following messages in logstash: Marking url as dead. Last error: \[LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError\] Elasticsearch Unr…

---

## [Getting doc\_count as zero while aggregation query on index created with type LocalDate in jpa](https://discuss.elastic.co/t/getting-doc-count-as-zero-while-aggregation-query-on-index-created-with-type-localdate-in-jpa/252885)

<div class="topic-metadata">

**Author:** [@daviddavid](https://discuss.elastic.co/u/daviddavid)\
**Replies:** 1\
**Last updated:** [October 22, 2020, 9:55am UTC](https://discuss.elastic.co/t/getting-doc-count-as-zero-while-aggregation-query-on-index-created-with-type-localdate-in-jpa/252885 "2020-10-22T09:55:39Z")

</div>

Getting doc\_count as zero while aggregation query on index created with type LocalDate in jpa java. Format is "yyyy-mm-dd". Whatever I try looking here and there as help , doc\_count is coming 0. Olease help Below is qu…

---

## [Wanted to combine two different result set in one query](https://discuss.elastic.co/t/wanted-to-combine-two-different-result-set-in-one-query/252962)

<div class="topic-metadata">

**Author:** [@dattack13](https://discuss.elastic.co/u/dattack13)\
**Replies:** 2\
**Last updated:** [October 22, 2020, 9:50am UTC](https://discuss.elastic.co/t/wanted-to-combine-two-different-result-set-in-one-query/252962 "2020-10-22T09:50:25Z")

</div>

Hi There, I have requirement where I need to combine two different result based on different filter criteria for example one query is filtering records based on some true & false indicator and then other query is filter…

---

## [Elasticsearch exception \[type=json\_parse\_exception, reason=Current token (VALUE\_NUMBER\_INT) not of boolean type](https://discuss.elastic.co/t/elasticsearch-exception-type-json-parse-exception-reason-current-token-value-number-int-not-of-boolean-type/252728)

<div class="topic-metadata">

**Author:** [@Giovanni\_Di\_Lembo](https://discuss.elastic.co/u/Giovanni_Di_Lembo)\
**Replies:** 6\
**Last updated:** [October 22, 2020, 9:46am UTC](https://discuss.elastic.co/t/elasticsearch-exception-type-json-parse-exception-reason-current-token-value-number-int-not-of-boolean-type/252728 "2020-10-22T09:46:36Z")

</div>

Hi all and sorry for my poor english. I'm using docker docker.elastic.co/elasticsearch/elasticsearch:6.2.1 paired with spring data elasticsearch. The issue does not involve spring for sure. When I try any kind of opera…

---

## [Execution of a watcher when another one has been executed](https://discuss.elastic.co/t/execution-of-a-watcher-when-another-one-has-been-executed/252572)

<div class="topic-metadata">

**Author:** [@Juan\_David\_Jaramillo](https://discuss.elastic.co/u/Juan_David_Jaramillo)\
**Replies:** 5\
**Last updated:** [October 22, 2020, 9:42am UTC](https://discuss.elastic.co/t/execution-of-a-watcher-when-another-one-has-been-executed/252572 "2020-10-22T09:42:31Z")

</div>

hello good, I need help with the trigger of an alert, I want it to run when another alert has been executed, I do not know if you explain to me when I detect that another alert has been executed this is executed. I do no…

---

## [Newbie question: how to reindex with field value change?](https://discuss.elastic.co/t/newbie-question-how-to-reindex-with-field-value-change/252655)

<div class="topic-metadata">

**Author:** [@Admak](https://discuss.elastic.co/u/Admak)\
**Replies:** 2\
**Last updated:** [October 22, 2020, 8:10am UTC](https://discuss.elastic.co/t/newbie-question-how-to-reindex-with-field-value-change/252655 "2020-10-22T08:10:36Z")

</div>

Hi! First, sorry for the newb question, however 2h of googling proved i'm either unqualified or explicitly trying to do the task wrong way I'm trying to reindex with new mappings, however due to field data type change,…

---

## [I Want to Audit Enabled for Kibana Dev Tools Console Queries](https://discuss.elastic.co/t/i-want-to-audit-enabled-for-kibana-dev-tools-console-queries/252839)

<div class="topic-metadata">

**Author:** [@RusseL](https://discuss.elastic.co/u/RusseL)\
**Replies:** 2\
**Last updated:** [October 22, 2020, 8:06am UTC](https://discuss.elastic.co/t/i-want-to-audit-enabled-for-kibana-dev-tools-console-queries/252839 "2020-10-22T08:06:07Z")

</div>

I want to keep a diary for Kibana Dev Tools Console queries. For this they told me to add xpack.audit.enabled: true line to elasticsearch.yml file and restart elasticsearch service, but when I add the line the elasticse…

---

## [Elastic doesn't create a new index](https://discuss.elastic.co/t/elastic-doesnt-create-a-new-index/252947)

<div class="topic-metadata">

**Author:** [@AlexOQ](https://discuss.elastic.co/u/AlexOQ)\
**Replies:** 5\
**Last updated:** [October 22, 2020, 8:03am UTC](https://discuss.elastic.co/t/elastic-doesnt-create-a-new-index/252947 "2020-10-22T08:03:36Z")

</div>

Hi, and thanks for any leads in advance. I am using the following output configuration: \<match \*\*\> @type rewrite\_tag\_filter @label @LOGTYPE \<rule\> key …

---

## [Search value based on specific field as child field are dynamic](https://discuss.elastic.co/t/search-value-based-on-specific-field-as-child-field-are-dynamic/252957)

<div class="topic-metadata">

**Author:** [@ROHITHPR](https://discuss.elastic.co/u/ROHITHPR)\
**Replies:** 0\
**Last updated:** [October 22, 2020, 7:54am UTC](https://discuss.elastic.co/t/search-value-based-on-specific-field-as-child-field-are-dynamic/252957 "2020-10-22T07:54:23Z")

</div>

The collection looks like this { "displayname":"unknown12" "hierarchy":{ "username":"Nothing on", …

---

## [\[Solved\] Using /\_xpack/sql endpoint with dates with curl](https://discuss.elastic.co/t/solved-using-xpack-sql-endpoint-with-dates-with-curl/252742)

<div class="topic-metadata">

**Author:** [@Tiago\_Cruz](https://discuss.elastic.co/u/Tiago_Cruz)\
**Replies:** 3\
**Last updated:** [October 22, 2020, 7:53am UTC](https://discuss.elastic.co/t/solved-using-xpack-sql-endpoint-with-dates-with-curl/252742 "2020-10-22T07:53:04Z")

</div>

Hello, This works good: $ curl -X POST "localhost:9200/\_xpack/sql?format=txt&pretty" -H 'Content-Type: application/json' -d' { "query": "SELECT count(\*) FROM whatsapp\_202010 WHERE clientInfo.customerId = 7503" } ' …

---

## [Expand terms in search query into boolean expression?](https://discuss.elastic.co/t/expand-terms-in-search-query-into-boolean-expression/252935)

<div class="topic-metadata">

**Author:** [@GavinM](https://discuss.elastic.co/u/GavinM)\
**Replies:** 1\
**Last updated:** [October 22, 2020, 7:42am UTC](https://discuss.elastic.co/t/expand-terms-in-search-query-into-boolean-expression/252935 "2020-10-22T07:42:37Z")

</div>

Hi Does Elastic search have a capability of reading a text file containing pattern = replacement strings, and if any terms in the search query match pattern they are replaced with the boolean expression defined on the r…

---

## [Handling array values while reading from elasticsearch in spark using elasticsearch-spark](https://discuss.elastic.co/t/handling-array-values-while-reading-from-elasticsearch-in-spark-using-elasticsearch-spark/252950)

<div class="topic-metadata">

**Author:** [@shubham1](https://discuss.elastic.co/u/shubham1)\
**Replies:** 0\
**Last updated:** [October 22, 2020, 7:27am UTC](https://discuss.elastic.co/t/handling-array-values-while-reading-from-elasticsearch-in-spark-using-elasticsearch-spark/252950 "2020-10-22T07:27:17Z")

</div>

Hi, I am trying to read from elasticsearch in spark using es-hadoop library. I know while reading from es-hadoop, we need to pass option es.read.field.as.array.include as in code ApacheSpark.sqlContext.read.format("org.…

---

## [Configure ELK stack with Jira server to monitor server logs](https://discuss.elastic.co/t/configure-elk-stack-with-jira-server-to-monitor-server-logs/252938)

<div class="topic-metadata">

**Author:** [@prerak.diwan](https://discuss.elastic.co/u/prerak.diwan)\
**Replies:** 0\
**Last updated:** [October 22, 2020, 6:24am UTC](https://discuss.elastic.co/t/configure-elk-stack-with-jira-server-to-monitor-server-logs/252938 "2020-10-22T06:24:04Z")

</div>

Hi all, I am new to the ELK stack and want to try the ELK solution to monitor Atlassian Jira logs. So far I have been able to setup the ELK stack on my local system and start both the Kibana and Elasticsearch servers. …

---

## [Http tls on elastic nodes?](https://discuss.elastic.co/t/http-tls-on-elastic-nodes/252922)

<div class="topic-metadata">

**Author:** [@lusynda](https://discuss.elastic.co/u/lusynda)\
**Replies:** 0\
**Last updated:** [October 22, 2020, 3:40am UTC](https://discuss.elastic.co/t/http-tls-on-elastic-nodes/252922 "2020-10-22T03:40:14Z")

</div>

Hi all In my cluster it said that i need to configure tls for connection between elastic and kibana But i have some question, i have 2 nodes for coordination, the kibana will connect to those 2 node only, so do i have …

---

## [Aggregate sum child documents' cumulative data while keeping some of parent's source fields](https://discuss.elastic.co/t/aggregate-sum-child-documents-cumulative-data-while-keeping-some-of-parents-source-fields/252907)

<div class="topic-metadata">

**Author:** [@rfferrao](https://discuss.elastic.co/u/rfferrao)\
**Replies:** 0\
**Last updated:** [October 21, 2020, 10:28pm UTC](https://discuss.elastic.co/t/aggregate-sum-child-documents-cumulative-data-while-keeping-some-of-parents-source-fields/252907 "2020-10-21T22:28:27Z")

</div>

I'd like to know if it's possible to do this. Let's say I have the following mapping for a testindex: { "properties": { "datetime": { "type": "date" }, "datetime\_range": { "type": "date\_range" }, "devna…

---

## [How to call an alert in another?](https://discuss.elastic.co/t/how-to-call-an-alert-in-another/252910)

<div class="topic-metadata">

**Author:** [@Juan\_David\_Jaramillo](https://discuss.elastic.co/u/Juan_David_Jaramillo)\
**Replies:** 0\
**Last updated:** [October 21, 2020, 10:52pm UTC](https://discuss.elastic.co/t/how-to-call-an-alert-in-another/252910 "2020-10-21T22:52:23Z")

</div>

How can I do to call a watch in another, so I had it in my code but it does not serve me need to call an alert to this, to make a condition that if you run that make an action in this. I am confused about this because th…

---

## [State execution watcher condition](https://discuss.elastic.co/t/state-execution-watcher-condition/252909)

<div class="topic-metadata">

**Author:** [@Juan\_David\_Jaramillo](https://discuss.elastic.co/u/Juan_David_Jaramillo)\
**Replies:** 0\
**Last updated:** [October 21, 2020, 10:46pm UTC](https://discuss.elastic.co/t/state-execution-watcher-condition/252909 "2020-10-21T22:46:55Z")

</div>

How to make a condition that is met if the state of execution of a watch is executed, to send me an email, but only if the condition is met. { "trigger": { "schedule": { "interval": "24h" } }, "input…

[Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=779)

[Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=781)
