# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=785 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 786 --- ## [Watcher, Transform UTC timestamp on the payload to local time](https://discuss.elastic.co/t/watcher-transform-utc-timestamp-on-the-payload-to-local-time/252279)
**Author:** [@Juan\_David\_Jaramillo](https://discuss.elastic.co/u/Juan_David_Jaramillo)\ **Replies:** 0\ **Last updated:** [October 15, 2020, 10:12pm UTC](https://discuss.elastic.co/t/watcher-transform-utc-timestamp-on-the-payload-to-local-time/252279 "2020-10-15T22:12:38Z")
I'm trying to convert the time to my local time, but I get an error, I need to send to the mail the real time which is GMT-5 America/Bogota { "trigger": { "schedule": { "interval": "1h" } }, "input":… --- ## [Changing Elasticsearch + Fscrawler tokenizing methods to recognize Social Security Numbers/Passport Machine Readable Zones](https://discuss.elastic.co/t/changing-elasticsearch-fscrawler-tokenizing-methods-to-recognize-social-security-numbers-passport-machine-readable-zones/251502)
**Author:** [@morningkaren](https://discuss.elastic.co/u/morningkaren)\ **Replies:** 4\ **Last updated:** [October 15, 2020, 8:34pm UTC](https://discuss.elastic.co/t/changing-elasticsearch-fscrawler-tokenizing-methods-to-recognize-social-security-numbers-passport-machine-readable-zones/251502 "2020-10-15T20:34:09Z")
Hello, I have used fscrawler to index some files that have social security numbers in the format of XXX-XX-XXXX and also the machine readable zones of passports such as \<\<\<\<\<\ **Author:** [@Juan\_David\_Jaramillo](https://discuss.elastic.co/u/Juan_David_Jaramillo)\ **Replies:** 0\ **Last updated:** [October 15, 2020, 8:31pm UTC](https://discuss.elastic.co/t/watchers-condition-summary-down-0-and-1/252269 "2020-10-15T20:31:34Z") Hi, I need help in a watcher's condition: I don't know if a for or a while is useful: I need the following: I have a variable "summary.down" with two values 0 and 1, so I need it to be executed infinitely and when it ch… --- ## [More shards = more throughput?](https://discuss.elastic.co/t/more-shards-more-throughput/252223)
**Author:** [@David\_Hopkins](https://discuss.elastic.co/u/David_Hopkins)\ **Replies:** 8\ **Last updated:** [October 15, 2020, 8:15pm UTC](https://discuss.elastic.co/t/more-shards-more-throughput/252223 "2020-10-15T20:15:16Z")
I've been trying to better understand the effect sharing has on performance but the theory doesn't seem to match the reality so clearly one of those things must be wrong :wink: After watching this video on Quantitative … --- ## [@timestamp field in a datastream](https://discuss.elastic.co/t/timestamp-field-in-a-datastream/252258)
**Author:** [@MichaelKopaniov](https://discuss.elastic.co/u/MichaelKopaniov)\ **Replies:** 0\ **Last updated:** [October 15, 2020, 7:15pm UTC](https://discuss.elastic.co/t/timestamp-field-in-a-datastream/252258 "2020-10-15T19:15:41Z")
Hi, I'm currently examining the migration of an old ES cluster into an ILM managed https://www.elastic.co/guide/en/elasticsearch/reference/master/data-streams.html. I do not fully understand the role of the required @t… --- ## [Elasticsearch graceful restart without rebalancing shards](https://discuss.elastic.co/t/elasticsearch-graceful-restart-without-rebalancing-shards/251660)
**Author:** [@GabrielM](https://discuss.elastic.co/u/GabrielM)\ **Replies:** 3\ **Last updated:** [October 15, 2020, 3:54pm UTC](https://discuss.elastic.co/t/elasticsearch-graceful-restart-without-rebalancing-shards/251660 "2020-10-15T15:54:43Z")
Hello, I wanted to know if it is possible to restart a node of an Elasticsearch cluster in a graceful way? When I restart a node in the cluster, searches that use that node fail (shards are replicated). Is it possible … --- ## [Elasticsearch 6.8.1 xpack](https://discuss.elastic.co/t/elasticsearch-6-8-1-xpack/252076)
**Author:** [@chris1967](https://discuss.elastic.co/u/chris1967)\ **Replies:** 0\ **Last updated:** [October 14, 2020, 4:46pm UTC](https://discuss.elastic.co/t/elasticsearch-6-8-1-xpack/252076 "2020-10-14T16:46:04Z")
I enabled xpack.security (xpack.security.enabled: true) and i set the built in passwords initially with the elasticsearch-setup-passwords. But now i have to change the URL, because i want to change the network.node in th… --- ## [Coordinating nodes cpu usage dropped down while data nodes rise up after upgrade elastic 7.4.0 to 7.8.1](https://discuss.elastic.co/t/coordinating-nodes-cpu-usage-dropped-down-while-data-nodes-rise-up-after-upgrade-elastic-7-4-0-to-7-8-1/252228)
**Author:** [@hadars](https://discuss.elastic.co/u/hadars)\ **Replies:** 0\ **Last updated:** [October 15, 2020, 3:40pm UTC](https://discuss.elastic.co/t/coordinating-nodes-cpu-usage-dropped-down-while-data-nodes-rise-up-after-upgrade-elastic-7-4-0-to-7-8-1/252228 "2020-10-15T15:40:25Z")
Hey, A year +- we decided to change our ingesting pipeline to work with coordinating nodes. (https://www.elastic.co/guide/en/elasticsearch/reference/current/modules-node.html#coordinating-node) This helped us a lot, al… --- ## [Snapshot exception](https://discuss.elastic.co/t/snapshot-exception/251861)
**Author:** [@pmk](https://discuss.elastic.co/u/pmk)\ **Replies:** 12\ **Last updated:** [October 15, 2020, 3:41pm UTC](https://discuss.elastic.co/t/snapshot-exception/251861 "2020-10-15T15:41:25Z")
Hi i'm trying to take snapshot for every 30 min , The following problems occur. ERROR) { "type": "concurrent\_snapshot\_execution\_exception", "reason": "\[reponm-prd-snapshots:scheduled-lm\_rkid\_qtoa75fr0qvlca\] a snap… --- ## [Hot-Warm Setup using Docker](https://discuss.elastic.co/t/hot-warm-setup-using-docker/252227)
**Author:** [@adityak248](https://discuss.elastic.co/u/adityak248)\ **Replies:** 0\ **Last updated:** [October 15, 2020, 3:37pm UTC](https://discuss.elastic.co/t/hot-warm-setup-using-docker/252227 "2020-10-15T15:37:12Z")
Hello All, Looking for some support here on elastic stack setup over docker with Hot-Warm architecture approach. --- ## [How to get this Year and This Month with Date Range Query](https://discuss.elastic.co/t/how-to-get-this-year-and-this-month-with-date-range-query/252224)
**Author:** [@rkhapre](https://discuss.elastic.co/u/rkhapre)\ **Replies:** 0\ **Last updated:** [October 15, 2020, 3:20pm UTC](https://discuss.elastic.co/t/how-to-get-this-year-and-this-month-with-date-range-query/252224 "2020-10-15T15:20:24Z")
Hi All Currently i have a date field where data is distributed from 2015 to 2020 I am interested in retrieving This Year, Last Year, This Month, Last Month I am able to retrieve Rolling 1 Year = From : now-1y, To :… --- ## [Job for elasticsearch.service failed because the control process exited with error code](https://discuss.elastic.co/t/job-for-elasticsearch-service-failed-because-the-control-process-exited-with-error-code/252219)
**Author:** [@Cesrion](https://discuss.elastic.co/u/Cesrion)\ **Replies:** 0\ **Last updated:** [October 15, 2020, 2:42pm UTC](https://discuss.elastic.co/t/job-for-elasticsearch-service-failed-because-the-control-process-exited-with-error-code/252219 "2020-10-15T14:42:19Z")
Hello community... I am installing ELASTICSEARCH on my CentOS7.8 server BUT I am facing this error when i try to Start and enable elasticsearch service on boot, take in mind this is my second installation... ERROR: J… --- ## [Slow performance of shape query](https://discuss.elastic.co/t/slow-performance-of-shape-query/252158)
**Author:** [@inomad](https://discuss.elastic.co/u/inomad)\ **Replies:** 0\ **Last updated:** [October 15, 2020, 9:09am UTC](https://discuss.elastic.co/t/slow-performance-of-shape-query/252158 "2020-10-15T09:09:49Z")
I am using Shape field type to store multi-point 2D trajectory paths (LINESTRING). All coordinates are normalized to the range \[0..1\]. And it seems that query performance (say search for intersection with 2-point line) … --- ## [Java Heap Size for ElasticSearch Nodes](https://discuss.elastic.co/t/java-heap-size-for-elasticsearch-nodes/252178)
**Author:** [@gizem](https://discuss.elastic.co/u/gizem)\ **Replies:** 3\ **Last updated:** [October 15, 2020, 1:22pm UTC](https://discuss.elastic.co/t/java-heap-size-for-elasticsearch-nodes/252178 "2020-10-15T13:22:39Z")
Hello, I have an elasticsearch cluster with two nodes. I have read that java heap size sould not be more than 50% of physical memory. Is it valid for sum of all nodes heap size or just one? For instance, my computer's … --- ## [Default Shard Allocation Status](https://discuss.elastic.co/t/default-shard-allocation-status/252201)
**Author:** [@dawiro](https://discuss.elastic.co/u/dawiro)\ **Replies:** 0\ **Last updated:** [October 15, 2020, 1:14pm UTC](https://discuss.elastic.co/t/default-shard-allocation-status/252201 "2020-10-15T13:14:48Z")
Hi, I'm looking to track cluster.routing.allocation.enable. The obvious way is via cluster settings. However, that is not always explicitly set. What can I query to always return a value for this setting? Thx D --- ## [Elasticsearch Thread Pool Details](https://discuss.elastic.co/t/elasticsearch-thread-pool-details/252164)
**Author:** [@cpiment](https://discuss.elastic.co/u/cpiment)\ **Replies:** 0\ **Last updated:** [October 15, 2020, 9:59am UTC](https://discuss.elastic.co/t/elasticsearch-thread-pool-details/252164 "2020-10-15T09:59:51Z")
Hi everyone, Sometimes we have some elasticsearch nodes that get a write queue size \> 200, so they begin rejecting requests. I have been searching this forum and the documentation for a way to get the details of the wr… --- ## [ElasticSearch cluster for DC failure tolerance](https://discuss.elastic.co/t/elasticsearch-cluster-for-dc-failure-tolerance/251840)
**Author:** [@vodka\_pivo](https://discuss.elastic.co/u/vodka_pivo)\ **Replies:** 2\ **Last updated:** [October 15, 2020, 8:48am UTC](https://discuss.elastic.co/t/elasticsearch-cluster-for-dc-failure-tolerance/251840 "2020-10-15T08:48:56Z")
I have a 5 node ElasticSearch cluster which locates in 3 DataCenters DC1: ES01 (master-eligible, data) ES02 (data) DC2: ES03 (master-eligible, data) ES04 (data) DC3: ES05 (Master only node) so i need to continue R… --- ## [What's the best way to backup ILM policies & index templates](https://discuss.elastic.co/t/whats-the-best-way-to-backup-ilm-policies-index-templates/251231)
**Author:** [@Chr0my](https://discuss.elastic.co/u/Chr0my)\ **Replies:** 4\ **Last updated:** [October 15, 2020, 7:26am UTC](https://discuss.elastic.co/t/whats-the-best-way-to-backup-ilm-policies-index-templates/251231 "2020-10-15T07:26:51Z")
Hi everyone, I'm currently looking for a way to backup ILM policies and index templates automatically, but I cannot find where these informations are stored, and I don't want to snapshot my entire cluster. Is it stored… --- ## [LDAPS and chain of certificates](https://discuss.elastic.co/t/ldaps-and-chain-of-certificates/250724)
**Author:** [@v.n](https://discuss.elastic.co/u/v.n)\ **Replies:** 2\ **Last updated:** [October 15, 2020, 6:59am UTC](https://discuss.elastic.co/t/ldaps-and-chain-of-certificates/250724 "2020-10-15T06:59:54Z")
I try to set up authentication through Active Directory. My problem is in connection using LDAPS. We have our own CA service and all certificates are issued by one of them. So we have root CA, then Sub CA which issues al… --- ## [Benefits/Drawbacks of using custom HTTP calls VS curator?](https://discuss.elastic.co/t/benefits-drawbacks-of-using-custom-http-calls-vs-curator/251931)
**Author:** [@vazma](https://discuss.elastic.co/u/vazma)\ **Replies:** 1\ **Last updated:** [October 15, 2020, 6:12am UTC](https://discuss.elastic.co/t/benefits-drawbacks-of-using-custom-http-calls-vs-curator/251931 "2020-10-15T06:12:46Z")
Hi, I am thinking to use normal HTTP calls to DELETE some indexes instead of using curator. IS curator except DELETE also executes more checks? What are the drawbacks of just using simple HTTP calls? Thank you --- ## [Elastic search considers date field send by java service as string](https://discuss.elastic.co/t/elastic-search-considers-date-field-send-by-java-service-as-string/251924)
**Author:** [@Mohan\_vel](https://discuss.elastic.co/u/Mohan_vel)\ **Replies:** 2\ **Last updated:** [October 15, 2020, 5:56am UTC](https://discuss.elastic.co/t/elastic-search-considers-date-field-send-by-java-service-as-string/251924 "2020-10-15T05:56:46Z")
Hi I have created a java service and i am indexing the response into elasticseaarch i am sending a date value but elasticsearch considers it as string. Code is already deployed in production. How to change the incoming f… --- ## [How can buckets be sorted by doc\_count ratio?](https://discuss.elastic.co/t/how-can-buckets-be-sorted-by-doc-count-ratio/250068)
**Author:** [@yanglingqiang](https://discuss.elastic.co/u/yanglingqiang)\ **Replies:** 1\ **Last updated:** [October 15, 2020, 4:45am UTC](https://discuss.elastic.co/t/how-can-buckets-be-sorted-by-doc-count-ratio/250068 "2020-10-15T04:45:40Z")
I have data { "id": 1, "buyer\_id": 101, "total\_count": 2 } { "id": 2, "buyer\_id": 101, "total\_count": 2 } { "id": 3, "buyer\_id": 102, "total\_count": 1 } After aggregation by buyer\_id, I want to sort by… --- ## [How to search special characters in elasticsearch](https://discuss.elastic.co/t/how-to-search-special-characters-in-elasticsearch/251997)
**Author:** [@yen\_l\_ng\_th](https://discuss.elastic.co/u/yen_l_ng_th)\ **Replies:** 2\ **Last updated:** [October 15, 2020, 2:40am UTC](https://discuss.elastic.co/t/how-to-search-special-characters-in-elasticsearch/251997 "2020-10-15T02:40:44Z")
I want query terms name in string "9.999%". But it not working. setting document 'analysis' =\> \[ 'analyzer' =\> \[ 'default' =\> \[ 'type' =\> 'custom', 'tokenizer' =\> 'whitespace', 'filter' =\> \[ 'lowercase', 'word\_d… --- ## [Time stamp is wrong](https://discuss.elastic.co/t/time-stamp-is-wrong/251958)
**Author:** [@Juan\_David\_Jaramillo](https://discuss.elastic.co/u/Juan_David_Jaramillo)\ **Replies:** 10\ **Last updated:** [October 14, 2020, 10:14pm UTC](https://discuss.elastic.co/t/time-stamp-is-wrong/251958 "2020-10-14T22:14:28Z")
I have a problem with the time stamp I get the date right, but the time is wrong I get like 5 hours in advance, the date is right but I do not know why I get another time of execution, set the time zone in kibana, but I … --- ## [The time zone of the time stamp is incorrect](https://discuss.elastic.co/t/the-time-zone-of-the-time-stamp-is-incorrect/252081)
**Author:** [@Juan\_David\_Jaramillo](https://discuss.elastic.co/u/Juan_David_Jaramillo)\ **Replies:** 2\ **Last updated:** [October 14, 2020, 9:24pm UTC](https://discuss.elastic.co/t/the-time-zone-of-the-time-stamp-is-incorrect/252081 "2020-10-14T21:24:14Z")
I have a problem with the time stamp, I have the correct date, but the time is wrong, I have like 5 hours in advance, the date is correct but I do not know why I have another time of execution, I put the time zone but it… --- ## [ILM keeping rolling over the same old indexes daily](https://discuss.elastic.co/t/ilm-keeping-rolling-over-the-same-old-indexes-daily/252097)
**Author:** [@dobesv](https://discuss.elastic.co/u/dobesv)\ **Replies:** 7\ **Last updated:** [October 14, 2020, 8:27pm UTC](https://discuss.elastic.co/t/ilm-keeping-rolling-over-the-same-old-indexes-daily/252097 "2020-10-14T20:27:52Z")
Hi, I have fluentd pushing logs into elasticsearch with index names based on the date, e.g. logs.kubelet.YYYY.MM.DD and using index lifecycle management (ILM). I have set the ILM policy to roll over after 50GB or daily… --- ## [Clarification required for Snapshot policy option \`Wait for snapshot policy\`](https://discuss.elastic.co/t/clarification-required-for-snapshot-policy-option-wait-for-snapshot-policy/252091)
**Author:** [@ajesh](https://discuss.elastic.co/u/ajesh)\ **Replies:** 0\ **Last updated:** [October 14, 2020, 6:25pm UTC](https://discuss.elastic.co/t/clarification-required-for-snapshot-policy-option-wait-for-snapshot-policy/252091 "2020-10-14T18:25:08Z")
Hi There, Can you please help in clarifying below doubts for the option Wait for snapshot policy in the ILM policy. I have a snapshot policy created for auditbeat indices with index pattern selected as auditbeat-\* whic… --- ## [How to get size (total) of events send by a host per day](https://discuss.elastic.co/t/how-to-get-size-total-of-events-send-by-a-host-per-day/251912)
**Author:** [@kelk](https://discuss.elastic.co/u/kelk)\ **Replies:** 3\ **Last updated:** [October 14, 2020, 6:17pm UTC](https://discuss.elastic.co/t/how-to-get-size-total-of-events-send-by-a-host-per-day/251912 "2020-10-14T18:17:41Z")
We have been asked different scenarios What is the original size/volume of data send by a particular host? What is the size/volume of data indexed into ES from a particular host For (1) it is actually the size of the … --- ## [Analysing active directory users and computers](https://discuss.elastic.co/t/analysing-active-directory-users-and-computers/252085)
**Author:** [@carpetpants](https://discuss.elastic.co/u/carpetpants)\ **Replies:** 0\ **Last updated:** [October 14, 2020, 5:30pm UTC](https://discuss.elastic.co/t/analysing-active-directory-users-and-computers/252085 "2020-10-14T17:30:57Z")
Hi There, I am looking to analyse active directory users and computers in elastic and wondered if anyone has done this before and able to offer some guidance. What I am looking to achieve is report on the total number o… --- ## [Coordinating node configuration](https://discuss.elastic.co/t/coordinating-node-configuration/252080)
**Author:** [@deeps](https://discuss.elastic.co/u/deeps)\ **Replies:** 1\ **Last updated:** [October 14, 2020, 5:19pm UTC](https://discuss.elastic.co/t/coordinating-node-configuration/252080 "2020-10-14T17:19:46Z")
hey there, could someone share the coordinator node config for elasticsearch 7.8.1 version? I tried with node.roles: \[ \] but its not accepting (i believe this is for 7.9 version) and throwing below error: Caused by: … [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=784) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=786)