# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=783 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 784 --- ## [Ingest Node Pipeline doesn't allow for "\\\[" pattern](https://discuss.elastic.co/t/ingest-node-pipeline-doesnt-allow-for-pattern/250227)
**Author:** [@madduck](https://discuss.elastic.co/u/madduck)\ **Replies:** 2\ **Last updated:** [October 19, 2020, 12:08pm UTC](https://discuss.elastic.co/t/ingest-node-pipeline-doesnt-allow-for-pattern/250227 "2020-10-19T12:08:33Z")
Hi gang, I'm trying to parse some logs into my index but I always get the GROK error: "Provided Grok expressions do not match field value" Error Message Provided Grok expressions do not match field value: \[Sep 28 17:1… --- ## [Value of index.blocks.write is auto changed to false](https://discuss.elastic.co/t/value-of-index-blocks-write-is-auto-changed-to-false/252207)
**Author:** [@kamils468](https://discuss.elastic.co/u/kamils468)\ **Replies:** 2\ **Last updated:** [October 19, 2020, 11:48am UTC](https://discuss.elastic.co/t/value-of-index-blocks-write-is-auto-changed-to-false/252207 "2020-10-19T11:48:53Z")
ES ver. 7.4 I want to block all write actions (create/update/delete) to my index. I need it to copy docs to another index using reindex action and keep 100% consistency between indicies. So what I do is: curl -X PUT \\… --- ## [DeleteByQuery using "from"](https://discuss.elastic.co/t/deletebyquery-using-from/251135)
**Author:** [@Alder](https://discuss.elastic.co/u/Alder)\ **Replies:** 3\ **Last updated:** [October 19, 2020, 11:35am UTC](https://discuss.elastic.co/t/deletebyquery-using-from/251135 "2020-10-19T11:35:32Z")
Hello everyone from elastic I try to exclude some docs by specifying the starting document offset. Based on the documentation below I write this C # code public async Task EraseData(string indexName, int from, int… --- ## [Term text cannot contain HOLE character U+001E; or unit separator character U+001F; this character is reserved](https://discuss.elastic.co/t/term-text-cannot-contain-hole-character-u-001e-or-unit-separator-character-u-001f-this-character-is-reserved/252484)
**Author:** [@Zoltan\_Kovacs](https://discuss.elastic.co/u/Zoltan_Kovacs)\ **Replies:** 1\ **Last updated:** [October 19, 2020, 11:29am UTC](https://discuss.elastic.co/t/term-text-cannot-contain-hole-character-u-001e-or-unit-separator-character-u-001f-this-character-is-reserved/252484 "2020-10-19T11:29:42Z")
I run today an interesting error message: Term text cannot contain HOLE character U+001E; this character is reserved Term text cannot contain unit separator character U+001F; this character is reserved in search s… --- ## [Update by query date field (painless) and add hours](https://discuss.elastic.co/t/update-by-query-date-field-painless-and-add-hours/252291)
**Author:** [@AClerk](https://discuss.elastic.co/u/AClerk)\ **Replies:** 3\ **Last updated:** [October 19, 2020, 11:15am UTC](https://discuss.elastic.co/t/update-by-query-date-field-painless-and-add-hours/252291 "2020-10-19T11:15:31Z")
Hi, Some basics in painless (the painful syntax) Trying to update a filed to have the timestamp value + X hours. I was trying the following POST index\*/\_update\_by\_query { "script": { "source": "ctx.\_source.time… --- ## [Authentication fails on a new node in a secure cluster](https://discuss.elastic.co/t/authentication-fails-on-a-new-node-in-a-secure-cluster/252517)
**Author:** [@aryon](https://discuss.elastic.co/u/aryon)\ **Replies:** 1\ **Last updated:** [October 19, 2020, 10:47am UTC](https://discuss.elastic.co/t/authentication-fails-on-a-new-node-in-a-secure-cluster/252517 "2020-10-19T10:47:47Z")
Hello, I have an Elasticsearch cluster with 2 nodes, on which I enabled xpack security a while ago (TLS on both transport and HTTP + local authentication). I want to add a new node to the cluster, I configured the node… --- ## [Dynamic\_templates vs Template API](https://discuss.elastic.co/t/dynamic-templates-vs-template-api/252478)
**Author:** [@vorapoap](https://discuss.elastic.co/u/vorapoap)\ **Replies:** 2\ **Last updated:** [October 19, 2020, 10:32am UTC](https://discuss.elastic.co/t/dynamic-templates-vs-template-api/252478 "2020-10-19T10:32:37Z")
In term of indexing performance. Which one is faster? between using dynamic\_templates vs Template API --- ## [Yellow Shard](https://discuss.elastic.co/t/yellow-shard/252514)
**Author:** [@laurent2](https://discuss.elastic.co/u/laurent2)\ **Replies:** 1\ **Last updated:** [October 19, 2020, 10:23am UTC](https://discuss.elastic.co/t/yellow-shard/252514 "2020-10-19T10:23:19Z")
Hello, I'm having some issue with an elasticsearch install, I don't have extensive knowledge on ES but your help would be appreciated. 2 issues: ES is regulary stuck and i have to restart it manually ES is in yellow … --- ## [Elasticsearch 6.8.12 & Magento 2.3.4](https://discuss.elastic.co/t/elasticsearch-6-8-12-magento-2-3-4/251241)
**Author:** [@mbob](https://discuss.elastic.co/u/mbob)\ **Replies:** 8\ **Last updated:** [October 19, 2020, 9:02am UTC](https://discuss.elastic.co/t/elasticsearch-6-8-12-magento-2-3-4/251241 "2020-10-19T09:02:33Z")
Hi, I was told to by your User Success Manager to ask for help in this forum regarding issues with using Elasticsearch and Magento 2. The problem: The test of the connection fails in Magento 2 (test fails in backend) w… --- ## [Search query - StartsWIth, Contains and Endswith](https://discuss.elastic.co/t/search-query-startswith-contains-and-endswith/252501)
**Author:** [@mruthyu](https://discuss.elastic.co/u/mruthyu)\ **Replies:** 1\ **Last updated:** [October 19, 2020, 8:41am UTC](https://discuss.elastic.co/t/search-query-startswith-contains-and-endswith/252501 "2020-10-19T08:41:24Z")
How to query elasticsearch with Startswith, contains and Endswith. \\Looks like it is not recommended to use wildcard \* at the beginning of the search term considering the performance impact. --- ## [Composite aggregation returns old version documents](https://discuss.elastic.co/t/composite-aggregation-returns-old-version-documents/252353)
**Author:** [@And390](https://discuss.elastic.co/u/And390)\ **Replies:** 6\ **Last updated:** [October 19, 2020, 7:40am UTC](https://discuss.elastic.co/t/composite-aggregation-returns-old-version-documents/252353 "2020-10-19T07:40:47Z")
Hello. I found that in some cases composite aggregation returns old documents (the initial indexed version instead of updated). Steps to reproduce: curl -X PUT -H 'Content-Type: application/json' localhost:9200/test -d … --- ## [Kafka to elasticsearch](https://discuss.elastic.co/t/kafka-to-elasticsearch/252487)
**Author:** [@sahil21](https://discuss.elastic.co/u/sahil21)\ **Replies:** 0\ **Last updated:** [October 19, 2020, 7:18am UTC](https://discuss.elastic.co/t/kafka-to-elasticsearch/252487 "2020-10-19T07:18:15Z")
Hi All, I have a kafka topic with some existing data in it. I want to send that data to elasticsearch index using a logstash config file. Currently my config file only send the data which is being entered while the pipe… --- ## [GET /\_cluster/settings empty](https://discuss.elastic.co/t/get-cluster-settings-empty/252471)
**Author:** [@smm](https://discuss.elastic.co/u/smm)\ **Replies:** 2\ **Last updated:** [October 19, 2020, 5:42am UTC](https://discuss.elastic.co/t/get-cluster-settings-empty/252471 "2020-10-19T05:42:40Z")
Hi there, I have a 7.5.1 production cluster of 3 nodes running. I am wondering: doing this GET /\_cluster/settings empty just gives me: I would expect more. Background: I have reached on all 3 nodes the disk waterma… --- ## [Restarting a cluster node](https://discuss.elastic.co/t/restarting-a-cluster-node/252468)
**Author:** [@Russell\_Fulton](https://discuss.elastic.co/u/Russell_Fulton)\ **Replies:** 1\ **Last updated:** [October 19, 2020, 4:30am UTC](https://discuss.elastic.co/t/restarting-a-cluster-node/252468 "2020-10-19T04:30:12Z")
Update with info I should have included! ES version 6.8.12. Three nodes in the cluster running on Linux. Two nodes have SSDs and one has rotating disks -- this was added for resilience -- all api calls go to the two w… --- ## [How to query - sort multiple nested fields in elasticsearch](https://discuss.elastic.co/t/how-to-query-sort-multiple-nested-fields-in-elasticsearch/252470)
**Author:** [@unnikr](https://discuss.elastic.co/u/unnikr)\ **Replies:** 0\ **Last updated:** [October 19, 2020, 4:18am UTC](https://discuss.elastic.co/t/how-to-query-sort-multiple-nested-fields-in-elasticsearch/252470 "2020-10-19T04:18:21Z")
I required multiple sorting in nested fields. I tried below code but it's not working. how can I do a multiple sorting in nested fields? data is stored like this. indent preformatted text by 4 spaces\[ { "\_index": "tes… --- ## [NEST 7.9 Bulk Partial Update failing](https://discuss.elastic.co/t/nest-7-9-bulk-partial-update-failing/250581)
**Author:** [@venkatsvr4](https://discuss.elastic.co/u/venkatsvr4)\ **Replies:** 1\ **Last updated:** [October 19, 2020, 2:09am UTC](https://discuss.elastic.co/t/nest-7-9-bulk-partial-update-failing/250581 "2020-10-19T02:09:11Z")
I am using Nest 7.9 client to bulk update documents in a huge index. Followed below 6.6 link to set up updates in C# List\ jiras = new List\(); JObject id1 = new JObject(); … --- ## [Using Leaflet with Elasticsearch](https://discuss.elastic.co/t/using-leaflet-with-elasticsearch/252433)
**Author:** [@morescratch](https://discuss.elastic.co/u/morescratch)\ **Replies:** 2\ **Last updated:** [October 19, 2020, 1:20am UTC](https://discuss.elastic.co/t/using-leaflet-with-elasticsearch/252433 "2020-10-19T01:20:22Z")
Hi all, I’ve been looking for examples on how to use Elasticsearch as a data source for a Leaflet map. I understand that Kibana uses leaflet so I am hoping there some code snippets out there that I can reuse. Anyone know… --- ## [Elasticsearch-to-csv made easy with Python](https://discuss.elastic.co/t/elasticsearch-to-csv-made-easy-with-python/252461)
**Author:** [@Fabio-sama](https://discuss.elastic.co/u/Fabio-sama)\ **Replies:** 0\ **Last updated:** [October 18, 2020, 10:38pm UTC](https://discuss.elastic.co/t/elasticsearch-to-csv-made-easy-with-python/252461 "2020-10-18T22:38:22Z")
Hi guys! This time I'm posting here not to ask for help but advice. I've developed a tool to make extremely easy data export from Elasticsearch to a CSV file, both raw and in a aggregated format. You can find much mor… --- ## [ElasticSearch: Mapping not applied to AWS ELK](https://discuss.elastic.co/t/elasticsearch-mapping-not-applied-to-aws-elk/252326)
**Author:** [@gyana\_nayak](https://discuss.elastic.co/u/gyana_nayak)\ **Replies:** 12\ **Last updated:** [October 18, 2020, 5:38am UTC](https://discuss.elastic.co/t/elasticsearch-mapping-not-applied-to-aws-elk/252326 "2020-10-18T05:38:00Z")
While applying below mapping to my local ElasticSearch 7.4.1 private static void addIndexMapping(RestHighLevelClient client, String indexName) throws IOException { PutMappingRequest request = new PutMappingReque… --- ## [Setting bind and publish IPs](https://discuss.elastic.co/t/setting-bind-and-publish-ips/252437)
**Author:** [@PeterC](https://discuss.elastic.co/u/PeterC)\ **Replies:** 0\ **Last updated:** [October 17, 2020, 11:07pm UTC](https://discuss.elastic.co/t/setting-bind-and-publish-ips/252437 "2020-10-17T23:07:58Z")
Hi There.. I know this is covered elsewhere... but I still seem to be having issues. Elasticsearch version 7.9.2 I have a cluster.. with 2 ,masters (I know.. its development), and 2 data nodes. All good. Set up to use … --- ## [Go-elasticsearch versus Olivere golang client](https://discuss.elastic.co/t/go-elasticsearch-versus-olivere-golang-client/252248)
**Author:** [@Sudd\_Ghosh](https://discuss.elastic.co/u/Sudd_Ghosh)\ **Replies:** 1\ **Last updated:** [October 16, 2020, 2:39pm UTC](https://discuss.elastic.co/t/go-elasticsearch-versus-olivere-golang-client/252248 "2020-10-16T14:39:50Z")
Hi, I am planning to migrate from golang Olivere to the official go-elasticsearch API for a data ingestion application running in K8s container. This I am doing mainly because I read Olivere is not committing to support… --- ## [Elastic SQL: How to get length of a field?](https://discuss.elastic.co/t/elastic-sql-how-to-get-length-of-a-field/252417)
**Author:** [@kelk](https://discuss.elastic.co/u/kelk)\ **Replies:** 5\ **Last updated:** [October 17, 2020, 4:06pm UTC](https://discuss.elastic.co/t/elastic-sql-how-to-get-length-of-a-field/252417 "2020-10-17T16:06:27Z")
SQL query fails when I do a String function The original data is SELECT "message" FROM ".kibana-event-log-7.9.1-000001" message ----------------- eventLog starting eventLog starting When I do a length POS… --- ## [Rollover error](https://discuss.elastic.co/t/rollover-error/252278)
**Author:** [@venku](https://discuss.elastic.co/u/venku)\ **Replies:** 10\ **Last updated:** [October 17, 2020, 2:28pm UTC](https://discuss.elastic.co/t/rollover-error/252278 "2020-10-17T14:28:11Z")
I am totally lost on how Rollover works. I keep ending up with an error. I deleted my indexes and started fresh but still the same error everytime. I am having following error and could not figure why this is happening.… --- ## [Unable remote debug my plugin installed in Elasticsearch in remote VM](https://discuss.elastic.co/t/unable-remote-debug-my-plugin-installed-in-elasticsearch-in-remote-vm/252411)
**Author:** [@ccnoufal](https://discuss.elastic.co/u/ccnoufal)\ **Replies:** 1\ **Last updated:** [October 17, 2020, 10:43am UTC](https://discuss.elastic.co/t/unable-remote-debug-my-plugin-installed-in-elasticsearch-in-remote-vm/252411 "2020-10-17T10:43:50Z")
I unable remote debug my plugin installed in Elasticsearch in remote VM in eclipse I am getting following error message in popup I have added following line in jvm.options file. -agentlib:jdwp=transport=dt\_socket,se… --- ## [Aggregation with OR filter](https://discuss.elastic.co/t/aggregation-with-or-filter/252390)
**Author:** [@alex-t0](https://discuss.elastic.co/u/alex-t0)\ **Replies:** 1\ **Last updated:** [October 17, 2020, 8:14am UTC](https://discuss.elastic.co/t/aggregation-with-or-filter/252390 "2020-10-17T08:14:01Z")
I have an index of jBPM usertasks. Each usertask has id, actualOwner and actualOwner.keyword, potentialOwners and potentialOwners.keyword, and processId fields. I need this aggregation: count of usertasks per process fo… --- ## [Elasticsearch Service Keeps shutting down](https://discuss.elastic.co/t/elasticsearch-service-keeps-shutting-down/252398)
**Author:** [@Jason\_Crews](https://discuss.elastic.co/u/Jason_Crews)\ **Replies:** 1\ **Last updated:** [October 17, 2020, 7:41am UTC](https://discuss.elastic.co/t/elasticsearch-service-keeps-shutting-down/252398 "2020-10-17T07:41:05Z")
When it's running Curl gives me { "name" : "llcjg9h", "cluster\_name" : "elasticsearch", "cluster\_uuid" : "dIg2d9-LRt-DIRP1\_P6MPg", "version" : { "number" : "6.8.12", "build\_flavor… --- ## [Can I store the json without creating a mapping](https://discuss.elastic.co/t/can-i-store-the-json-without-creating-a-mapping/251746)
**Author:** [@pkwenda](https://discuss.elastic.co/u/pkwenda)\ **Replies:** 1\ **Last updated:** [October 17, 2020, 1:16am UTC](https://discuss.elastic.co/t/can-i-store-the-json-without-creating-a-mapping/251746 "2020-10-17T01:16:54Z")
now , I save json use nested type , but create many mapping , I'm not going to use the json data for searching, is there a way to store the json without creating a mapping? The json I'm depositing is changing, so it's c… --- ## [Commercial Elastic: Powerful 3-nodes cluster vs weak 30-nodes cluster](https://discuss.elastic.co/t/commercial-elastic-powerful-3-nodes-cluster-vs-weak-30-nodes-cluster/252244)
**Author:** [@lamp123432](https://discuss.elastic.co/u/lamp123432)\ **Replies:** 6\ **Last updated:** [October 17, 2020, 12:47am UTC](https://discuss.elastic.co/t/commercial-elastic-powerful-3-nodes-cluster-vs-weak-30-nodes-cluster/252244 "2020-10-17T00:47:47Z")
I am wondering what is the difference between the cost of a powerful 3-nodes cluster (let's say, 320gb of RAM, tons of CPUs), vs a 30-nodes cluster but each node as 2gb RAM and 2 CPUs. It seems that the 3-nodes cluster … --- ## [Could Not index event to ElasticSearch](https://discuss.elastic.co/t/could-not-index-event-to-elasticsearch/250027)
**Author:** [@dhoman](https://discuss.elastic.co/u/dhoman)\ **Replies:** 37\ **Last updated:** [October 16, 2020, 7:05pm UTC](https://discuss.elastic.co/t/could-not-index-event-to-elasticsearch/250027 "2020-10-16T19:05:06Z")
I am new to Elasticsearch, and I had been running Elasticsearch, Kibana, Filebeat, and Zabbix Server. My visualization stopped on August 28. I can pull visualization before that just fine. But when I try to watch curren… --- ## [Suggestions on what Large test cluster footprint might look like?](https://discuss.elastic.co/t/suggestions-on-what-large-test-cluster-footprint-might-look-like/252388)
**Author:** [@rgeisman](https://discuss.elastic.co/u/rgeisman)\ **Replies:** 0\ **Last updated:** [October 16, 2020, 6:54pm UTC](https://discuss.elastic.co/t/suggestions-on-what-large-test-cluster-footprint-might-look-like/252388 "2020-10-16T18:54:24Z")
Hello all. Great conference by the way. Excellent question answer sessions and breakout talks. One question I wanted to ask is that I have setup an ELK stack to monitor 1000+ nodes with filebeat, metricbeat, Suricata and… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=782) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=784)