# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=782 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 783 --- ## [Implications during shrink and force merge on index rollover](https://discuss.elastic.co/t/implications-during-shrink-and-force-merge-on-index-rollover/252712)
**Author:** [@mjedynak](https://discuss.elastic.co/u/mjedynak)\ **Replies:** 0\ **Last updated:** [October 20, 2020, 3:55pm UTC](https://discuss.elastic.co/t/implications-during-shrink-and-force-merge-on-index-rollover/252712 "2020-10-20T15:55:49Z")
I have index lifecycle policy (hot phase 1 month -\> warm phase, read only) and during rollover there is automatic operation of shrink and force merge. My index has 2 primary shards + 1 replica (after shrinking it's 1 pr… --- ## [Upgrade from 6.8.12 oss to 7.9.2 basic](https://discuss.elastic.co/t/upgrade-from-6-8-12-oss-to-7-9-2-basic/250028)
**Author:** [@searchy](https://discuss.elastic.co/u/searchy)\ **Replies:** 2\ **Last updated:** [October 20, 2020, 3:37pm UTC](https://discuss.elastic.co/t/upgrade-from-6-8-12-oss-to-7-9-2-basic/250028 "2020-10-20T15:37:33Z")
Greetings wonderful elasticsearch wizards! I was wondering if there was any way to do a ROLLING UPGRADE from oss to basic? Specifically, we are looking to go from 6.8.12 oss to 7.9.2 elastic basic. I do see in some p… --- ## [Need help with setting up 1 masternode and two datanodes set up](https://discuss.elastic.co/t/need-help-with-setting-up-1-masternode-and-two-datanodes-set-up/251505)
**Author:** [@sk545](https://discuss.elastic.co/u/sk545)\ **Replies:** 10\ **Last updated:** [October 20, 2020, 2:09pm UTC](https://discuss.elastic.co/t/need-help-with-setting-up-1-masternode-and-two-datanodes-set-up/251505 "2020-10-20T14:09:56Z")
Hello All, As we are implementing ELK in our org as a pilot project, I'm trying to set up 3 nodes Elastic cluster (all acts master and data nodes ), I have created Ubuntu servers in Azure cloud with specific hardware c… --- ## [Calculate filtered document's size](https://discuss.elastic.co/t/calculate-filtered-documents-size/251969)
**Author:** [@rschirin](https://discuss.elastic.co/u/rschirin)\ **Replies:** 2\ **Last updated:** [October 20, 2020, 1:52pm UTC](https://discuss.elastic.co/t/calculate-filtered-documents-size/251969 "2020-10-20T13:52:11Z")
Hi all, Is there a way to calculate the amount of filtered documents size inside a specific index? I mean, in a daily log index I would like to know the index total size is divided. --- ## [How to remove duplicate search result in elasticsearch?](https://discuss.elastic.co/t/how-to-remove-duplicate-search-result-in-elasticsearch/252319)
**Author:** [@yen\_l\_ng\_th](https://discuss.elastic.co/u/yen_l_ng_th)\ **Replies:** 4\ **Last updated:** [October 20, 2020, 1:49pm UTC](https://discuss.elastic.co/t/how-to-remove-duplicate-search-result-in-elasticsearch/252319 "2020-10-20T13:49:37Z")
I use a paginated search by elasticseach. But the items are duplicated between pages. It is at the bottom of this page and at the top of the other page. I did like this but it still doesn't work $aggregations = \[ "uni… --- ## [Email alert per sourceip](https://discuss.elastic.co/t/email-alert-per-sourceip/251864)
**Author:** [@ianvera](https://discuss.elastic.co/u/ianvera)\ **Replies:** 5\ **Last updated:** [October 20, 2020, 1:42pm UTC](https://discuss.elastic.co/t/email-alert-per-sourceip/251864 "2020-10-20T13:42:40Z")
we created one watcher having multiple sourceip so that whenever the watcher matches the messages it will send email alert. Will it be possible that the watcher having multiple sourceip will send multiple email alerts b… --- ## [Parsing syslogs using Grok](https://discuss.elastic.co/t/parsing-syslogs-using-grok/252673)
**Author:** [@pacy1](https://discuss.elastic.co/u/pacy1)\ **Replies:** 0\ **Last updated:** [October 20, 2020, 11:59am UTC](https://discuss.elastic.co/t/parsing-syslogs-using-grok/252673 "2020-10-20T11:59:57Z")
Hi All, Hope you are good!! I need your help on how syslog configuration with the following raw event that is unstructured, how to parsing using grok filter: 2020-10-05T00:00:00+02:00 x.x.x.x 3 0 1 1 229eb9 1020 20201… --- ## [IOPS and elasticsearch](https://discuss.elastic.co/t/iops-and-elasticsearch/251576)
**Author:** [@Juicy45](https://discuss.elastic.co/u/Juicy45)\ **Replies:** 4\ **Last updated:** [October 20, 2020, 1:09pm UTC](https://discuss.elastic.co/t/iops-and-elasticsearch/251576 "2020-10-20T13:09:35Z")
Hi, I have an Elasticsearch cluster that needs to ingest 2000 EPS. What is the minimum amount of IOPS do I need on a virtual machine ? Thank you for your answer. --- ## [Separated filesystems for data and logs?](https://discuss.elastic.co/t/separated-filesystems-for-data-and-logs/252686)
**Author:** [@ffknob](https://discuss.elastic.co/u/ffknob)\ **Replies:** 0\ **Last updated:** [October 20, 2020, 12:56pm UTC](https://discuss.elastic.co/t/separated-filesystems-for-data-and-logs/252686 "2020-10-20T12:56:29Z")
Hi, I'd like to know your thoughts on the best/recommended approach to organize the filesystem of a VM that will run an Elasticsearch instance. How should I separate things in such a way for the service to have some de… --- ## [How to get all worlds which goes after "search word"](https://discuss.elastic.co/t/how-to-get-all-worlds-which-goes-after-search-word/252579)
**Author:** [@tfe2012](https://discuss.elastic.co/u/tfe2012)\ **Replies:** 4\ **Last updated:** [October 20, 2020, 12:16pm UTC](https://discuss.elastic.co/t/how-to-get-all-worlds-which-goes-after-search-word/252579 "2020-10-20T12:16:12Z")
Hi, for example, I have three documents like: { "description": "Small red fox" } { "description": "I see blue fox" } { "description": "I see small orange fox" } Is it possible to get all words which go after word… --- ## [Bad cluster name - change on the fly possible?](https://discuss.elastic.co/t/bad-cluster-name-change-on-the-fly-possible/252475)
**Author:** [@smm](https://discuss.elastic.co/u/smm)\ **Replies:** 2\ **Last updated:** [October 20, 2020, 11:45am UTC](https://discuss.elastic.co/t/bad-cluster-name-change-on-the-fly-possible/252475 "2020-10-20T11:45:09Z")
Hi there, I have a cluster name defined in the elasticsearch.ym defined as follows cluster.name: CLUSTERNAME" resulting e.g. in: 'CLUSTERNAME".log' So, I want to correct this. The cluster is made of 3 production nod… --- ## [Is it necessary to have elasticsearch ingest node?](https://discuss.elastic.co/t/is-it-necessary-to-have-elasticsearch-ingest-node/252661)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 1\ **Last updated:** [October 20, 2020, 11:25am UTC](https://discuss.elastic.co/t/is-it-necessary-to-have-elasticsearch-ingest-node/252661 "2020-10-20T11:25:59Z")
I am using elk stack and i want to ask that if i have logstash do i need another elasticsearch as ingest node ? becuase logstash can also preprocess the data --- ## [\[Watcher\] - Alerting on metricbeat monitored processes](https://discuss.elastic.co/t/watcher-alerting-on-metricbeat-monitored-processes/252660)
**Author:** [@bevano](https://discuss.elastic.co/u/bevano)\ **Replies:** 0\ **Last updated:** [October 20, 2020, 10:11am UTC](https://discuss.elastic.co/t/watcher-alerting-on-metricbeat-monitored-processes/252660 "2020-10-20T10:11:43Z")
Hi All, I need some advice on how to implement watcher alerting. For example, we have 10 application servers, that have 5 programs running as processes. I have already installed metricbeat on these servers, and can see … --- ## [Getting items with Qty equal to 0](https://discuss.elastic.co/t/getting-items-with-qty-equal-to-0/252657)
**Author:** [@Padam\_Sethia](https://discuss.elastic.co/u/Padam_Sethia)\ **Replies:** 0\ **Last updated:** [October 20, 2020, 9:55am UTC](https://discuss.elastic.co/t/getting-items-with-qty-equal-to-0/252657 "2020-10-20T09:55:52Z")
Hello , I am quite a beginner in elasticsearch . I really can't figure out how to get back items with qty as 0 , the problem is my index document is structured like this : { "children": \[\], "created": "2020-10-15T16:… --- ## [Query with function\_score and aggregation is too slow](https://discuss.elastic.co/t/query-with-function-score-and-aggregation-is-too-slow/252654)
**Author:** [@badreedine](https://discuss.elastic.co/u/badreedine)\ **Replies:** 0\ **Last updated:** [October 20, 2020, 9:43am UTC](https://discuss.elastic.co/t/query-with-function-score-and-aggregation-is-too-slow/252654 "2020-10-20T09:43:41Z")
I have an index of about 15M items, I am using version 6.7.0 installed in AWS. We adopted denormalisation approach in our design, each project has many items. A project has a title, description, tags, popularity, project… --- ## [Initializing\_shards got struck](https://discuss.elastic.co/t/initializing-shards-got-struck/252511)
**Author:** [@muthug](https://discuss.elastic.co/u/muthug)\ **Replies:** 30\ **Last updated:** [October 20, 2020, 8:55am UTC](https://discuss.elastic.co/t/initializing-shards-got-struck/252511 "2020-10-20T08:55:34Z")
Hi Team, initializing\_shards got struck, if i delete those shards wat will happen? it will become Green and will work smoothly? Kibana link is working for some time and its showing error timeout 30000ms some time. { … --- ## [Unable to delete the index (%{indexname}-%{type}-2020.09.19)](https://discuss.elastic.co/t/unable-to-delete-the-index-indexname-type-2020-09-19/252634)
**Author:** [@nikhilesh](https://discuss.elastic.co/u/nikhilesh)\ **Replies:** 2\ **Last updated:** [October 20, 2020, 7:16am UTC](https://discuss.elastic.co/t/unable-to-delete-the-index-indexname-type-2020-09-19/252634 "2020-10-20T07:16:51Z")
Hi All, I am using ES version 7.7 having a index with name "%{indexname}-%{type}-2020.09.19". trying to delete the index with the below command, but not working. can any please help on this. delete %{indexname}-%{type}… --- ## [Fields Coming as unknown in Index](https://discuss.elastic.co/t/fields-coming-as-unknown-in-index/252644)
**Author:** [@Ayush\_Agrahari](https://discuss.elastic.co/u/Ayush_Agrahari)\ **Replies:** 0\ **Last updated:** [October 20, 2020, 7:16am UTC](https://discuss.elastic.co/t/fields-coming-as-unknown-in-index/252644 "2020-10-20T07:16:39Z")
I am getting unknown fields in .monitoring-es-\* Index. I recently enabled stack monitoring in ELK Stack then I am getting data in .monitoring-\* Indices. I wanted to create alerts based on this data but I am unable to us… --- ## [Max data that can be stored based on memory configured](https://discuss.elastic.co/t/max-data-that-can-be-stored-based-on-memory-configured/251752)
**Author:** [@mrudrego](https://discuss.elastic.co/u/mrudrego)\ **Replies:** 6\ **Last updated:** [October 20, 2020, 6:57am UTC](https://discuss.elastic.co/t/max-data-that-can-be-stored-based-on-memory-configured/251752 "2020-10-20T06:57:15Z")
Hi, I was going through the blog which talks about shards in a cluster https://www.elastic.co/blog/how-many-shards-should-i-have-in-my-elasticsearch-cluster In one of their tips they say " A good rule-of-thumb is to en… --- ## [Auto detection of Data type](https://discuss.elastic.co/t/auto-detection-of-data-type/252571)
**Author:** [@rdeshmukh](https://discuss.elastic.co/u/rdeshmukh)\ **Replies:** 2\ **Last updated:** [October 20, 2020, 6:02am UTC](https://discuss.elastic.co/t/auto-detection-of-data-type/252571 "2020-10-20T06:02:13Z")
This is the mapping initially which I created, considering that Roll number will be limit to only numbers. But eventually as they are growing in the roll numbers are Alphanumeric and the data type is changed. PUT studen… --- ## [Migrate from rollover aliases to data streams](https://discuss.elastic.co/t/migrate-from-rollover-aliases-to-data-streams/252161)
**Author:** [@Julien\_HENRY](https://discuss.elastic.co/u/Julien_HENRY)\ **Replies:** 0\ **Last updated:** [October 15, 2020, 9:47am UTC](https://discuss.elastic.co/t/migrate-from-rollover-aliases-to-data-streams/252161 "2020-10-15T09:47:11Z")
Hi, I'm just discovering the new data stream concept in Elastic Cloud 7.9.2. We are ingesting time based documents, so this seems the perfect fit. Previously, we were using rollover\_alias. I have created the data str… --- ## [Sum of aggregated terms are not per bucket, but total](https://discuss.elastic.co/t/sum-of-aggregated-terms-are-not-per-bucket-but-total/252541)
**Author:** [@obayd.mir](https://discuss.elastic.co/u/obayd.mir)\ **Replies:** 1\ **Last updated:** [October 19, 2020, 9:14pm UTC](https://discuss.elastic.co/t/sum-of-aggregated-terms-are-not-per-bucket-but-total/252541 "2020-10-19T21:14:16Z")
I want to sum up a field value per bucket for that specific bucket, but instead of this, I'm getting the total for all buckets per bucket. See below for some details. Search request: GET index-001/\_search { "size": 0… --- ## [Varying hilightling behavior](https://discuss.elastic.co/t/varying-hilightling-behavior/252601)
**Author:** [@stevo](https://discuss.elastic.co/u/stevo)\ **Replies:** 0\ **Last updated:** [October 19, 2020, 7:35pm UTC](https://discuss.elastic.co/t/varying-hilightling-behavior/252601 "2020-10-19T19:35:52Z")
I am seeing some unexplainable behavior with highlighting returning different responses depending on the search text. Below are two examples of nearly identical queries with different search texts. I am not sure how to e… --- ## [Edit index template settings](https://discuss.elastic.co/t/edit-index-template-settings/251142)
**Author:** [@mikejdunphy](https://discuss.elastic.co/u/mikejdunphy)\ **Replies:** 1\ **Last updated:** [October 19, 2020, 5:07pm UTC](https://discuss.elastic.co/t/edit-index-template-settings/251142 "2020-10-19T17:07:10Z")
so I have 2 indexes created everyday on my elkstack filebeat-%{\[@metadata\]\[version\]}-2020.10.03 filebeat-7.9.2-2020.10.03 the filebeat-7.9.2-2020.10.03 is from the elk server itself and the other is from filebeat fro… --- ## [Running Two or more Elasticsearch clusters on one machine](https://discuss.elastic.co/t/running-two-or-more-elasticsearch-clusters-on-one-machine/252257)
**Author:** [@bretonj](https://discuss.elastic.co/u/bretonj)\ **Replies:** 1\ **Last updated:** [October 19, 2020, 3:19pm UTC](https://discuss.elastic.co/t/running-two-or-more-elasticsearch-clusters-on-one-machine/252257 "2020-10-19T15:19:59Z")
I'm trying to get a second elasticsearch cluster running on a machine which already has a cluster. I have 7.9.2 installed on Ubuntu 18.04, and it's working properly. I created a new service file for the new cluster, new … --- ## [Elastic 7.10 field type "version"](https://discuss.elastic.co/t/elastic-7-10-field-type-version/252545)
**Author:** [@videns](https://discuss.elastic.co/u/videns)\ **Replies:** 4\ **Last updated:** [October 19, 2020, 3:00pm UTC](https://discuss.elastic.co/t/elastic-7-10-field-type-version/252545 "2020-10-19T15:00:11Z")
First, create new index with mappings, one field has type "version": curl -X PUT "localhost:9200/version\_test\_v2?pretty" -H 'Content-Type: application/json' -d' { "mappings": { "properties": { "version": { … --- ## [Installing xpack plugin on 7.7.1 elastic](https://discuss.elastic.co/t/installing-xpack-plugin-on-7-7-1-elastic/252397)
**Author:** [@txmrlevine](https://discuss.elastic.co/u/txmrlevine)\ **Replies:** 4\ **Last updated:** [October 19, 2020, 1:54pm UTC](https://discuss.elastic.co/t/installing-xpack-plugin-on-7-7-1-elastic/252397 "2020-10-19T13:54:23Z")
I am trying to set up security on my stack. looks like from what I can see version 7.7.1 should have the plugin available to install but when I go to install it I only get this . ./elasticsearch-plugin install xpack -\>… --- ## [About TranslogWriter.assertNoSeqNumberConflict](https://discuss.elastic.co/t/about-translogwriter-assertnoseqnumberconflict/252521)
**Author:** [@kimnwuchong](https://discuss.elastic.co/u/kimnwuchong)\ **Replies:** 1\ **Last updated:** [October 19, 2020, 1:32pm UTC](https://discuss.elastic.co/t/about-translogwriter-assertnoseqnumberconflict/252521 "2020-10-19T13:32:10Z")
before process assertNoSeqNumberConflict, the tranlog has already added。i think the assert is not necessary。 --- ## [Enabling security in a cluster with two nodes in Elasticsearch](https://discuss.elastic.co/t/enabling-security-in-a-cluster-with-two-nodes-in-elasticsearch/252536)
**Author:** [@Techmod](https://discuss.elastic.co/u/Techmod)\ **Replies:** 3\ **Last updated:** [October 19, 2020, 1:09pm UTC](https://discuss.elastic.co/t/enabling-security-in-a-cluster-with-two-nodes-in-elasticsearch/252536 "2020-10-19T13:09:51Z")
Hi There, I'm trying to enable security feature in Elasticsearch nodes but whenever I turn on "xpack.security.enabled: true" , my Elasticsearch won't start at all. How can I resolve this? here's my configuration on bot… --- ## [Index Lifecycle Allocation Routed Step failing with NullPtrException](https://discuss.elastic.co/t/index-lifecycle-allocation-routed-step-failing-with-nullptrexception/252331)
**Author:** [@Benjamin\_saiz](https://discuss.elastic.co/u/Benjamin_saiz)\ **Replies:** 4\ **Last updated:** [October 19, 2020, 12:39pm UTC](https://discuss.elastic.co/t/index-lifecycle-allocation-routed-step-failing-with-nullptrexception/252331 "2020-10-19T12:39:40Z")
We are running an ElasticSearch 6.8.8 cluster. We just implemented ILM for our indexes. Here is our ILM Policy : { "policy": { "phases": { /\* Hot phase - Resync Priority 100 \*/ … [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=781) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=783)