# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=786 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 787 --- ## [Aggregation based on Array Intersection](https://discuss.elastic.co/t/aggregation-based-on-array-intersection/252068)
**Author:** [@Charles\_Lariviere](https://discuss.elastic.co/u/Charles_Lariviere)\ **Replies:** 2\ **Last updated:** [October 14, 2020, 4:53pm UTC](https://discuss.elastic.co/t/aggregation-based-on-array-intersection/252068 "2020-10-14T16:53:40Z")
Hi, I'm looking to write a query that will return the "most frequently co-occurring terms given an input of one or more terms", though I'm quite unclear as to how I would structure such a query (or if it is even possibl… --- ## [Issue with deploying Elasticsearch helm chart with dedicated nodes and deleting and re-deploying the release](https://discuss.elastic.co/t/issue-with-deploying-elasticsearch-helm-chart-with-dedicated-nodes-and-deleting-and-re-deploying-the-release/252067)
**Author:** [@mehta-ankit](https://discuss.elastic.co/u/mehta-ankit)\ **Replies:** 2\ **Last updated:** [October 14, 2020, 4:53pm UTC](https://discuss.elastic.co/t/issue-with-deploying-elasticsearch-helm-chart-with-dedicated-nodes-and-deleting-and-re-deploying-the-release/252067 "2020-10-14T16:53:36Z")
I have been using the elasticsearch helm chart from elastic for a long time now, but recently wanted to switch my architecture to use dedicated master and data nodes. I looked at the example provided here: https://githu… --- ## [Watcher case](https://discuss.elastic.co/t/watcher-case/251926)
**Author:** [@victor.vera](https://discuss.elastic.co/u/victor.vera)\ **Replies:** 2\ **Last updated:** [October 14, 2020, 4:41pm UTC](https://discuss.elastic.co/t/watcher-case/251926 "2020-10-14T16:41:48Z")
Good afternoon I'm trying to configure an alert in a unitary way, I mean, that from a field, I get out or equal to a term that I define; what I need is a term that I ask from the field "monitor.name.keyword" to get from … --- ## [Elasticsearch 5.5 - Ways Export Monitoring](https://discuss.elastic.co/t/elasticsearch-5-5-ways-export-monitoring/252069)
**Author:** [@Beuhlet\_Reseau](https://discuss.elastic.co/u/Beuhlet_Reseau)\ **Replies:** 0\ **Last updated:** [October 14, 2020, 4:13pm UTC](https://discuss.elastic.co/t/elasticsearch-5-5-ways-export-monitoring/252069 "2020-10-14T16:13:43Z")
Hello, I have a large elasticsearch cluster 60 instances Overview Version: 5.5.1 Uptime: 12 days Nodes: 60 Disk Available: 249TB / 413TB (60.26%) JVM Heap: 65.84% (1TB / 2TB) Indices: 2,855 Documents: 24,229,929… --- ## [First occurrence field value using ingest processor](https://discuss.elastic.co/t/first-occurrence-field-value-using-ingest-processor/251755)
**Author:** [@liorg2](https://discuss.elastic.co/u/liorg2)\ **Replies:** 2\ **Last updated:** [October 14, 2020, 3:37pm UTC](https://discuss.elastic.co/t/first-occurrence-field-value-using-ingest-processor/251755 "2020-10-14T15:37:54Z")
Hello is there a way to tag a document with "first occurrence of a field" using an ingest processor? for example first occurrence of traffic from Japan (country:Japan) thanks --- ## [Elasticserach 7.2 Unable to create cluster with error "Unable to lock JVM Memory: error=12, reason=Cannot allocate memory"](https://discuss.elastic.co/t/elasticserach-7-2-unable-to-create-cluster-with-error-unable-to-lock-jvm-memory-error-12-reason-cannot-allocate-memory/252050)
**Author:** [@bognad](https://discuss.elastic.co/u/bognad)\ **Replies:** 6\ **Last updated:** [October 14, 2020, 2:58pm UTC](https://discuss.elastic.co/t/elasticserach-7-2-unable-to-create-cluster-with-error-unable-to-lock-jvm-memory-error-12-reason-cannot-allocate-memory/252050 "2020-10-14T14:58:36Z")
Hello! Standalone (single-node) Elasticsearch is work fine. I tried creating one node cluster, but it results into error: elasticsearch\_1 | {"type": "server", "timestamp": "2020-10-14T11:38:41,989+0000", "level": "WA… --- ## [Elasticsearch cluster 5.5 under heavy load](https://discuss.elastic.co/t/elasticsearch-cluster-5-5-under-heavy-load/250471)
**Author:** [@Beuhlet\_Reseau](https://discuss.elastic.co/u/Beuhlet_Reseau)\ **Replies:** 6\ **Last updated:** [October 14, 2020, 1:12pm UTC](https://discuss.elastic.co/t/elasticsearch-cluster-5-5-under-heavy-load/250471 "2020-10-14T13:12:02Z")
Hey, I work on Elasticsearch cluster in 5.5 version. About 16 physical workers : 60 java instances (6 coordinators, 3 masters and data nodes) Coord/Data : 30 Go heap / instance Master : 15 Go / instance About 6 To d… --- ## [Caused by: java.lang.NullPointerException: Cannot invoke \\"org.elasticsearch.index.analysis.AnalyzerComponents.getCharFilters()\\" because \\"components\\" is null](https://discuss.elastic.co/t/caused-by-java-lang-nullpointerexception-cannot-invoke-org-elasticsearch-index-analysis-analyzercomponents-getcharfilters-because-components-is-null/251824)
**Author:** [@jdoucy](https://discuss.elastic.co/u/jdoucy)\ **Replies:** 1\ **Last updated:** [October 14, 2020, 12:25pm UTC](https://discuss.elastic.co/t/caused-by-java-lang-nullpointerexception-cannot-invoke-org-elasticsearch-index-analysis-analyzercomponents-getcharfilters-because-components-is-null/251824 "2020-10-14T12:25:05Z")
Hi there, I get an issue with \_reload\_search\_analyzers I simply try to reload a synonym file but it doesn't reload it, no error, just the new file is not taken into account. So I tried the old way, closing and re-open… --- ## [When \_index\_template is set \_template is ignored](https://discuss.elastic.co/t/when-index-template-is-set-template-is-ignored/252036)
**Author:** [@Petr.Simik](https://discuss.elastic.co/u/Petr.Simik)\ **Replies:** 0\ **Last updated:** [October 14, 2020, 11:45am UTC](https://discuss.elastic.co/t/when-index-template-is-set-template-is-ignored/252036 "2020-10-14T11:45:29Z")
I created default \_index\_template to add attribute to settings for hot nodes since I set this parameter all \_templates are ignored. There is some incompatibility between \_index\_template and \_template do I have to migr… --- ## [Doubt shard allocation balance between nodes](https://discuss.elastic.co/t/doubt-shard-allocation-balance-between-nodes/249638)
**Author:** [@adrian-arapiles](https://discuss.elastic.co/u/adrian-arapiles)\ **Replies:** 11\ **Last updated:** [October 14, 2020, 11:26am UTC](https://discuss.elastic.co/t/doubt-shard-allocation-balance-between-nodes/249638 "2020-10-14T11:26:12Z")
Hi, I have a doubt about shard node allocation in elasticsearch. Maybe I missed any page of documentation, but I didn't find a solution for my issue. I have a elasticsearch cluster with n number of nodes, and I have sp… --- ## [Visitor user agent information](https://discuss.elastic.co/t/visitor-user-agent-information/250515)
**Author:** [@sandikata](https://discuss.elastic.co/u/sandikata)\ **Replies:** 5\ **Last updated:** [October 14, 2020, 11:23am UTC](https://discuss.elastic.co/t/visitor-user-agent-information/250515 "2020-10-14T11:23:32Z")
Hello! I am trying to separate in fields the useragent information, i've followed instructions from user-agent-processor Everything looks good, but when i check in kibana frontend, everything is still on same line, no… --- ## [Elasticsearch won't start after 7.9.1 to 7.9.2 upgrade](https://discuss.elastic.co/t/elasticsearch-wont-start-after-7-9-1-to-7-9-2-upgrade/249878)
**Author:** [@craigothy](https://discuss.elastic.co/u/craigothy)\ **Replies:** 3\ **Last updated:** [October 14, 2020, 10:53am UTC](https://discuss.elastic.co/t/elasticsearch-wont-start-after-7-9-1-to-7-9-2-upgrade/249878 "2020-10-14T10:53:06Z")
For some reason, I am getting the following JVM error when starting elasticsearch 7.9.2 on CentOS7 after a yum upgrade. Any ideas? Thanks for any help: Exception in thread "main" java.lang.RuntimeException: starting ja… --- ## [Effective strategy to recover from failed upgrade](https://discuss.elastic.co/t/effective-strategy-to-recover-from-failed-upgrade/252021)
**Author:** [@amishar](https://discuss.elastic.co/u/amishar)\ **Replies:** 0\ **Last updated:** [October 14, 2020, 10:43am UTC](https://discuss.elastic.co/t/effective-strategy-to-recover-from-failed-upgrade/252021 "2020-10-14T10:43:42Z")
For a large Elasticsearch cluster that serve frequent index creation requests(lets say 1-2 per sec) and where it is not possible to pause these index creation during the rolling upgrade, what is the most effective strate… --- ## [Getting error in kibana \[Circuit breaking exception\]](https://discuss.elastic.co/t/getting-error-in-kibana-circuit-breaking-exception/252012)
**Author:** [@Dimple\_Goyal](https://discuss.elastic.co/u/Dimple_Goyal)\ **Replies:** 1\ **Last updated:** [October 14, 2020, 10:41am UTC](https://discuss.elastic.co/t/getting-error-in-kibana-circuit-breaking-exception/252012 "2020-10-14T10:41:08Z")
{ statusCode: 429, error: "Too Many Requests", message: "\[circuit\_breaking\_exception\] \[parent\] Data too large, data for \[\\] would be \[2047736072/1.9gb\], which is larger than the limit of \[2040109465/1.8gb\], … --- ## [Elastic search match query over array object](https://discuss.elastic.co/t/elastic-search-match-query-over-array-object/250786)
**Author:** [@aninda\_halder](https://discuss.elastic.co/u/aninda_halder)\ **Replies:** 2\ **Last updated:** [October 14, 2020, 10:23am UTC](https://discuss.elastic.co/t/elastic-search-match-query-over-array-object/250786 "2020-10-14T10:23:53Z")
Suppose i've 3 doc doc\_1 = { "citedIn": \[ "Bar Councils Act, 1926 - Section 15", "Contract Act, 1872 - Section 23" \] } doc\_2 = { "citedIn":\[ "15 C. B 400", "Contract Act, 18… --- ## [To find all the correlation id where response is not send back to the consumer](https://discuss.elastic.co/t/to-find-all-the-correlation-id-where-response-is-not-send-back-to-the-consumer/251896)
**Author:** [@rohitarorait82](https://discuss.elastic.co/u/rohitarorait82)\ **Replies:** 5\ **Last updated:** [October 14, 2020, 10:12am UTC](https://discuss.elastic.co/t/to-find-all-the-correlation-id-where-response-is-not-send-back-to-the-consumer/251896 "2020-10-14T10:12:55Z")
Hi All, In our logs; For a transaction , two legs will get generated "Consumer to backend" and "Backend to Consumer" .However in case of failure , only one leg "Consumer to backend" will get generated. Unique correlati… --- ## [Retrieve multiple nested documents around the query matched document](https://discuss.elastic.co/t/retrieve-multiple-nested-documents-around-the-query-matched-document/250139)
**Author:** [@verdict-lg](https://discuss.elastic.co/u/verdict-lg)\ **Replies:** 1\ **Last updated:** [October 14, 2020, 9:35am UTC](https://discuss.elastic.co/t/retrieve-multiple-nested-documents-around-the-query-matched-document/250139 "2020-10-14T09:35:10Z")
Is there a way to retrieve multiple documents around the matching nested document. For example in this document: Book ID: ISBN8137183 Book Name: Name of the Wind Chapters: { {Chapter ID: 1 Gist: some\_text\_1 }, {Chapter … --- ## [Can I use the aggregation with 'objetc' field?](https://discuss.elastic.co/t/can-i-use-the-aggregation-with-objetc-field/251869)
**Author:** [@icaruswu](https://discuss.elastic.co/u/icaruswu)\ **Replies:** 0\ **Last updated:** [October 13, 2020, 8:51am UTC](https://discuss.elastic.co/t/can-i-use-the-aggregation-with-objetc-field/251869 "2020-10-13T08:51:07Z")
I know that I can use aggreation with keyword type. But I wanna try to deal with some 'object' type in aggregation way. pls follow below: For this 'ddd' index, I build a 'human' object, then I will insert some 'object… --- ## [Many small indices vs One large index](https://discuss.elastic.co/t/many-small-indices-vs-one-large-index/252008)
**Author:** [@hemangr8](https://discuss.elastic.co/u/hemangr8)\ **Replies:** 5\ **Last updated:** [October 14, 2020, 8:50am UTC](https://discuss.elastic.co/t/many-small-indices-vs-one-large-index/252008 "2020-10-14T08:50:49Z")
I know this question has been asked many times, but I needed more clarity on this topic. Let's say I have 5000 customer data which has the same number of fields in each document but is independent of each other, i.e. I w… --- ## [Empty certificate chain after upgrading from ES 7.8.1 to ES 7.9.2](https://discuss.elastic.co/t/empty-certificate-chain-after-upgrading-from-es-7-8-1-to-es-7-9-2/250145)
**Author:** [@Nicolas\_Labrot](https://discuss.elastic.co/u/Nicolas_Labrot)\ **Replies:** 7\ **Last updated:** [October 14, 2020, 8:50am UTC](https://discuss.elastic.co/t/empty-certificate-chain-after-upgrading-from-es-7-8-1-to-es-7-9-2/250145 "2020-10-14T08:50:43Z")
Hello, After the upgrade from ES 7.8.1 to ES 7.9.2, Elastic threw in the logs an "empty certificate chain" exception. I was using the following configuration: xpack.security.transport.ssl.keystore.path: /usr/share/ela… --- ## [Elasticsearch to Oracle Table](https://discuss.elastic.co/t/elasticsearch-to-oracle-table/251998)
**Author:** [@tusharnemade](https://discuss.elastic.co/u/tusharnemade)\ **Replies:** 10\ **Last updated:** [October 14, 2020, 8:28am UTC](https://discuss.elastic.co/t/elasticsearch-to-oracle-table/251998 "2020-10-14T08:28:09Z")
Hello Team I have a requirement where in I have to move selected data from Elasticsearch INDEX to oracle Table {RDBMS} , in real-time. Could you please help me in suggesting the method / examples / links / blogs / op… --- ## [Detector field is not an aggregatable field](https://discuss.elastic.co/t/detector-field-is-not-an-aggregatable-field/252007)
**Author:** [@Ameeruddin\_Mohammed](https://discuss.elastic.co/u/Ameeruddin_Mohammed)\ **Replies:** 0\ **Last updated:** [October 14, 2020, 8:25am UTC](https://discuss.elastic.co/t/detector-field-is-not-an-aggregatable-field/252007 "2020-10-14T08:25:06Z")
hi, i get an error while creating an ml job. the field is "MONITORLOGGER" and in the template and in the index its mapped as keyword. "MONITORLOGGER": { "type": "keyword" } please support. --- ## [What's the best way to implement 'contains' search queries in combination with MultiMatch?](https://discuss.elastic.co/t/whats-the-best-way-to-implement-contains-search-queries-in-combination-with-multimatch/251909)
**Author:** [@DanglingNode](https://discuss.elastic.co/u/DanglingNode)\ **Replies:** 2\ **Last updated:** [October 14, 2020, 7:59am UTC](https://discuss.elastic.co/t/whats-the-best-way-to-implement-contains-search-queries-in-combination-with-multimatch/251909 "2020-10-14T07:59:55Z")
Hi, I have documents with most fields indexed as 'Keywords'. I currently want to perform a global search, over all indexed fields, which I've implemented as such: var result = await client.SearchAsync\(s =\>… --- ## [Watcher, Alert all result of the payload, not only the first](https://discuss.elastic.co/t/watcher-alert-all-result-of-the-payload-not-only-the-first/249831)
**Author:** [@Incauto](https://discuss.elastic.co/u/Incauto)\ **Replies:** 3\ **Last updated:** [October 14, 2020, 7:41am UTC](https://discuss.elastic.co/t/watcher-alert-all-result-of-the-payload-not-only-the-first/249831 "2020-10-14T07:41:15Z")
Im am quering a incident index..this index may contain documents separated by miliseconds, this is the query I have: "query": { "bool": { "must": \[ { … --- ## [Watcher, difference between setting the time range using contex and without using context](https://discuss.elastic.co/t/watcher-difference-between-setting-the-time-range-using-contex-and-without-using-context/251965)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 1\ **Last updated:** [October 14, 2020, 7:39am UTC](https://discuss.elastic.co/t/watcher-difference-between-setting-the-time-range-using-contex-and-without-using-context/251965 "2020-10-14T07:39:52Z")
Hi, What is the difference in setting an alert with watcher using context , like this: "range": { "@timestamp": { "gte": "{{ctx.trigger.scheduled\_time}}||-30m", … --- ## [Performance of a wildcard index search for \_id](https://discuss.elastic.co/t/performance-of-a-wildcard-index-search-for-id/249931)
**Author:** [@Munawwar1](https://discuss.elastic.co/u/Munawwar1)\ **Replies:** 8\ **Last updated:** [October 14, 2020, 7:33am UTC](https://discuss.elastic.co/t/performance-of-a-wildcard-index-search-for-id/249931 "2020-10-14T07:33:49Z")
Hi all. I am doing a term query search for \_id field (which happens to be a uuid in my case) across all indexes via a wildcard index name search. e.g. GET http://elasticsearch.endpoint/prod-\*/\_search { "query": { … --- ## [Elasticsearch version upgrade from 6.6. to 6.8](https://discuss.elastic.co/t/elasticsearch-version-upgrade-from-6-6-to-6-8/251055)
**Author:** [@tisandg](https://discuss.elastic.co/u/tisandg)\ **Replies:** 9\ **Last updated:** [October 14, 2020, 7:30am UTC](https://discuss.elastic.co/t/elasticsearch-version-upgrade-from-6-6-to-6-8/251055 "2020-10-14T07:30:47Z")
Hello. I have a server centOS 7 which have Elasticsearch 6.6 and I was trying to upgrade the version to it from 6.6 to 6.8. I followed each step of the guide and all the steps works well. However when I start again the … --- ## [Large numbers in kibana as keyword not searchable](https://discuss.elastic.co/t/large-numbers-in-kibana-as-keyword-not-searchable/251996)
**Author:** [@Petr.Simik](https://discuss.elastic.co/u/Petr.Simik)\ **Replies:** 0\ **Last updated:** [October 14, 2020, 6:51am UTC](https://discuss.elastic.co/t/large-numbers-in-kibana-as-keyword-not-searchable/251996 "2020-10-14T06:51:14Z")
I have problem to search the value in Kibana for field I Created mapping keyword and inserted number inside (see example below) "B\_ASSOCIAID": { "type" : "keyword"} "B\_ASSOCIAID" : 5947737601889008123, in this case Ki… --- ## [How to turn off automatic deletion upon expiration of data / index?](https://discuss.elastic.co/t/how-to-turn-off-automatic-deletion-upon-expiration-of-data-index/251736)
**Author:** [@dwlande](https://discuss.elastic.co/u/dwlande)\ **Replies:** 16\ **Last updated:** [October 14, 2020, 6:42am UTC](https://discuss.elastic.co/t/how-to-turn-off-automatic-deletion-upon-expiration-of-data-index/251736 "2020-10-14T06:42:46Z")
How to turn off automatic deletion upon expiration of data / index? --- ## [Elasticsearch-sql can't query unindexed field](https://discuss.elastic.co/t/elasticsearch-sql-cant-query-unindexed-field/251635)
**Author:** [@ITzhangqiang](https://discuss.elastic.co/u/ITzhangqiang)\ **Replies:** 26\ **Last updated:** [October 14, 2020, 2:52am UTC](https://discuss.elastic.co/t/elasticsearch-sql-cant-query-unindexed-field/251635 "2020-10-14T02:52:03Z")
As we know , unindexed field will store in \_source field,so we can get those unindexed fields in \_source.But Elasticsearch-sql can't get unindexed field. GET /\_sql/translate { "query":""" select \* from "view-laohu-s… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=785) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=787)