# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=796 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 797 --- ## [Clustered elasticsearch setup (two master nodes)](https://discuss.elastic.co/t/clustered-elasticsearch-setup-two-master-nodes/250383)
**Author:** [@yisaac](https://discuss.elastic.co/u/yisaac)\ **Replies:** 2\ **Last updated:** [October 1, 2020, 1:37am UTC](https://discuss.elastic.co/t/clustered-elasticsearch-setup-two-master-nodes/250383 "2020-10-01T01:37:44Z")
Hi, We are currently setting up an environment with two elasticsearch instances (clustered servers). Since it's clustered, we need to make sure that data (indexes) are synched between the two instances. We do not have… --- ## [Cannot cast from \[Long\] to \[long\]. Painless script in query](https://discuss.elastic.co/t/cannot-cast-from-long-to-long-painless-script-in-query/250537)
**Author:** [@awatkins](https://discuss.elastic.co/u/awatkins)\ **Replies:** 0\ **Last updated:** [September 30, 2020, 4:00pm UTC](https://discuss.elastic.co/t/cannot-cast-from-long-to-long-painless-script-in-query/250537 "2020-09-30T16:00:03Z")
Getting error, "Cannot cast from \[Long\] to \[long\]" and have tried many many things to no avail. The data to query against: "Data": { "Number of Components": 3, "Number of Components Array": \[ { "Component": 1, … --- ## [Context Suggester across multiple indices with same schema](https://discuss.elastic.co/t/context-suggester-across-multiple-indices-with-same-schema/250559)
**Author:** [@Bhavik92](https://discuss.elastic.co/u/Bhavik92)\ **Replies:** 3\ **Last updated:** [September 30, 2020, 11:38pm UTC](https://discuss.elastic.co/t/context-suggester-across-multiple-indices-with-same-schema/250559 "2020-09-30T23:38:37Z")
We're evaluating ElasticSearch for our use-case where customer can search over a data repository with multiple topics. Sometimes the user will select a topic to filter the results and sometimes he might want to query all… --- ## [Logging indices for separate websites](https://discuss.elastic.co/t/logging-indices-for-separate-websites/250361)
**Author:** [@bram](https://discuss.elastic.co/u/bram)\ **Replies:** 2\ **Last updated:** [September 30, 2020, 10:10pm UTC](https://discuss.elastic.co/t/logging-indices-for-separate-websites/250361 "2020-09-30T22:10:14Z")
Hey, We're running multiple webshops on the same application. And we're logging some API calls we're making (with separate index for each logging use-case). We have one shared logging elasticsearch cluster. But for the… --- ## [Can not open Stack monitoring](https://discuss.elastic.co/t/can-not-open-stack-monitoring/237772)
**Author:** [@v.n](https://discuss.elastic.co/u/v.n)\ **Replies:** 45\ **Last updated:** [September 30, 2020, 8:16pm UTC](https://discuss.elastic.co/t/can-not-open-stack-monitoring/237772 "2020-09-30T20:16:15Z")
Hi, Recently I couldn't open Stack Monitoring. Then I decided to upgrade to new version 7.8.0. But after upgrading my problem still exists. My user has role superuser so I don't understand why I cannot have access to m… --- ## [Problem with regex scripted field kibana using painless lang!](https://discuss.elastic.co/t/problem-with-regex-scripted-field-kibana-using-painless-lang/249291)
**Author:** [@le\_ba\_nam](https://discuss.elastic.co/u/le_ba_nam)\ **Replies:** 0\ **Last updated:** [September 21, 2020, 3:19am UTC](https://discuss.elastic.co/t/problem-with-regex-scripted-field-kibana-using-painless-lang/249291 "2020-09-21T03:19:30Z")
I want to create my own regex to get substring from some logs. This is my script: if (doc\['message.keyword'\].length == 0) { return "unavailable"; } else { def m = /.\*?http(.\*?)wsdl.\*?\\n/.matcher(doc\['message.keywor… --- ## [Getting Started with 7.9.2 on Debian 10](https://discuss.elastic.co/t/getting-started-with-7-9-2-on-debian-10/250411)
**Author:** [@epretorious](https://discuss.elastic.co/u/epretorious)\ **Replies:** 7\ **Last updated:** [September 30, 2020, 4:56pm UTC](https://discuss.elastic.co/t/getting-started-with-7-9-2-on-debian-10/250411 "2020-09-30T16:56:06Z")
Hello, All! I've installed Elasticsearch using the .tar.gz method onto my Debian 10 host. But when I attempt to verify that Elasticsearch is listening and responding to inquiries by sending an HTTP request to port 9200 … --- ## [Storage Size exceeding ILM rollover max\_size](https://discuss.elastic.co/t/storage-size-exceeding-ilm-rollover-max-size/250428)
**Author:** [@markroland](https://discuss.elastic.co/u/markroland)\ **Replies:** 2\ **Last updated:** [September 30, 2020, 3:57pm UTC](https://discuss.elastic.co/t/storage-size-exceeding-ilm-rollover-max-size/250428 "2020-09-30T15:57:12Z")
I have read through the ILM documentation and it's my understanding that if I have a rollover policy with a max\_age and a max\_size set, that the index should rollover when one of these conditions is met, but that's not w… --- ## [Where can I find an exhaustive list of search exceptions thrown by ES?](https://discuss.elastic.co/t/where-can-i-find-an-exhaustive-list-of-search-exceptions-thrown-by-es/250522)
**Author:** [@michele\_crudele](https://discuss.elastic.co/u/michele_crudele)\ **Replies:** 0\ **Last updated:** [September 30, 2020, 2:31pm UTC](https://discuss.elastic.co/t/where-can-i-find-an-exhaustive-list-of-search-exceptions-thrown-by-es/250522 "2020-09-30T14:31:47Z")
There are users sending bad queries. Some examples are queries with offending characters like /, : \\ and so on; queries with more than 1024 clauses; queries with syntax errors. We'd like to discriminate these cases fro… --- ## [Datastream gets no data](https://discuss.elastic.co/t/datastream-gets-no-data/250516)
**Author:** [@Tuckson](https://discuss.elastic.co/u/Tuckson)\ **Replies:** 2\ **Last updated:** [September 30, 2020, 2:22pm UTC](https://discuss.elastic.co/t/datastream-gets-no-data/250516 "2020-09-30T14:22:18Z")
Hi, Being new to the datastream subject, I tried setting up a datastream using the documentation here: https://www.elastic.co/guide/en/elasticsearch/reference/current/set-up-a-data-stream.html and index towards it. … --- ## [Set authentification on elasticsearch using ansible](https://discuss.elastic.co/t/set-authentification-on-elasticsearch-using-ansible/248561)
**Author:** [@smutel](https://discuss.elastic.co/u/smutel)\ **Replies:** 5\ **Last updated:** [September 30, 2020, 1:41pm UTC](https://discuss.elastic.co/t/set-authentification-on-elasticsearch-using-ansible/248561 "2020-09-30T13:41:38Z")
Hello, I would like to setup TLS and basic authentification for elasticsearch 6.8. To deploy elasticsearch I used the official ansible playbook. I followed also this documentation: https://github.com/elastic/ansible-e… --- ## [Terms Aggregation Bucket Sort when doc\_count is equal](https://discuss.elastic.co/t/terms-aggregation-bucket-sort-when-doc-count-is-equal/250509)
**Author:** [@aan](https://discuss.elastic.co/u/aan)\ **Replies:** 0\ **Last updated:** [September 30, 2020, 1:13pm UTC](https://discuss.elastic.co/t/terms-aggregation-bucket-sort-when-doc-count-is-equal/250509 "2020-09-30T13:13:10Z")
Hey. The documentation states that: By default, the terms aggregation will return the buckets for the top ten terms ordered by the doc\_count I was just wondering what happens, when the doc\_count of several buckets i… --- ## [ES query to match all elements in array](https://discuss.elastic.co/t/es-query-to-match-all-elements-in-array/250364)
**Author:** [@GeorgetaPojoga](https://discuss.elastic.co/u/GeorgetaPojoga)\ **Replies:** 1\ **Last updated:** [September 30, 2020, 12:03pm UTC](https://discuss.elastic.co/t/es-query-to-match-all-elements-in-array/250364 "2020-09-30T12:03:24Z")
So I got this document with a nested array that I want to filter with this query. I want ES to return all documents where all items have changes = 0 and that only. If document has even a single item in the list with a c… --- ## [Why do the greater than comparison and the greater than equal comparsion not return the same count of documents](https://discuss.elastic.co/t/why-do-the-greater-than-comparison-and-the-greater-than-equal-comparsion-not-return-the-same-count-of-documents/250497)
**Author:** [@Florian1](https://discuss.elastic.co/u/Florian1)\ **Replies:** 0\ **Last updated:** [September 30, 2020, 11:35am UTC](https://discuss.elastic.co/t/why-do-the-greater-than-comparison-and-the-greater-than-equal-comparsion-not-return-the-same-count-of-documents/250497 "2020-09-30T11:35:40Z")
I have create a new Index and then added two documents to it. PUT test\_index PUT /test\_index/\_doc/1 { "A" : "5" } PUT /test\_index/\_doc/2 { "B" : "5" } After that I searched for every document with A greater than … --- ## [Gc - allocation failure](https://discuss.elastic.co/t/gc-allocation-failure/250495)
**Author:** [@zen.xen](https://discuss.elastic.co/u/zen.xen)\ **Replies:** 0\ **Last updated:** [September 30, 2020, 11:33am UTC](https://discuss.elastic.co/t/gc-allocation-failure/250495 "2020-09-30T11:33:21Z")
Hello, I found something in gc.log. I try to find any info in the Internet what it means but I didn't. What should I do to fix it and where set proper value(s)? Entering safepoint region: GenCollectForAllocation GC(1) … --- ## [100% CPU after the upgrade from 7.6.1 to 7.8.1](https://discuss.elastic.co/t/100-cpu-after-the-upgrade-from-7-6-1-to-7-8-1/244822)
**Author:** [@Jehu\_T](https://discuss.elastic.co/u/Jehu_T)\ **Replies:** 5\ **Last updated:** [September 30, 2020, 10:29am UTC](https://discuss.elastic.co/t/100-cpu-after-the-upgrade-from-7-6-1-to-7-8-1/244822 "2020-09-30T10:29:57Z")
Hi, After upgrading to Elasticsearch 7.8.1 from 7.6.1, the CPU usage is reaching 100% most of the time on all 4 nodes. We didn't have this issue before the upgrade. The GC is almost 0% after the upgrade. It was noticed… --- ## [Script sorting](https://discuss.elastic.co/t/script-sorting/250338)
**Author:** [@flatmap101](https://discuss.elastic.co/u/flatmap101)\ **Replies:** 4\ **Last updated:** [September 30, 2020, 10:19am UTC](https://discuss.elastic.co/t/script-sorting/250338 "2020-09-30T10:19:20Z")
hi all! i am getting some very strange behavior while using scripted sorting. the script itself looks approximately like that: if (doc\['fieldName1'\].size() != 0 && doc\['fieldName2'\].size() != 0) { // 1 - might not be … --- ## [Use Script to Autogenerate Reports is not working](https://discuss.elastic.co/t/use-script-to-autogenerate-reports-is-not-working/250462)
**Author:** [@RamyaGowda](https://discuss.elastic.co/u/RamyaGowda)\ **Replies:** 6\ **Last updated:** [September 30, 2020, 10:09am UTC](https://discuss.elastic.co/t/use-script-to-autogenerate-reports-is-not-working/250462 "2020-09-30T10:09:45Z")
Hi Team, As per the steps given in the documentation using Curl user should be able to generate reports using custom script. I tried the below curl command by following the steps given in the document , it's throwing … --- ## [Update indexed data based on a value from a new record still does not indexed](https://discuss.elastic.co/t/update-indexed-data-based-on-a-value-from-a-new-record-still-does-not-indexed/250429)
**Author:** [@Marcelo\_Lavor](https://discuss.elastic.co/u/Marcelo_Lavor)\ **Replies:** 2\ **Last updated:** [September 30, 2020, 9:34am UTC](https://discuss.elastic.co/t/update-indexed-data-based-on-a-value-from-a-new-record-still-does-not-indexed/250429 "2020-09-30T09:34:08Z")
Hello! I need to update a field of several records already indexed based on a value from a new record still not indexed? Is there any way to implement it? Thanks Marcelo --- ## [Case Heavy load : How we can search all search request cancellable to cancellation](https://discuss.elastic.co/t/case-heavy-load-how-we-can-search-all-search-request-cancellable-to-cancellation/250472)
**Author:** [@Beuhlet\_Reseau](https://discuss.elastic.co/u/Beuhlet_Reseau)\ **Replies:** 3\ **Last updated:** [September 30, 2020, 9:38am UTC](https://discuss.elastic.co/t/case-heavy-load-how-we-can-search-all-search-request-cancellable-to-cancellation/250472 "2020-09-30T09:38:17Z")
Hello, Maybe our cluster become unreacheable or with high latency. I personally believe that tasks cancellation can be help to decrease load in cluster ? I try this : GET /\_cat/thread\_pool/search?v&h=node\_name,name,a… --- ## [How to Cleanup Full Disk on Elasticsearch Node while Elasticsearch is not running](https://discuss.elastic.co/t/how-to-cleanup-full-disk-on-elasticsearch-node-while-elasticsearch-is-not-running/249640)
**Author:** [@Rohail\_Abbas](https://discuss.elastic.co/u/Rohail_Abbas)\ **Replies:** 5\ **Last updated:** [September 30, 2020, 9:36am UTC](https://discuss.elastic.co/t/how-to-cleanup-full-disk-on-elasticsearch-node-while-elasticsearch-is-not-running/249640 "2020-09-30T09:36:06Z")
I have Elasticsearch 7.4 with 1 master and 5 data nodes (Amazon ec2 instances). I have cluster.routing.allocation.disk.threshold\_enabled setting = false Now one of the disk in a node became full and elasticsearch stopped… --- ## [Elasticsearch maintenance procedure](https://discuss.elastic.co/t/elasticsearch-maintenance-procedure/250465)
**Author:** [@rschirin](https://discuss.elastic.co/u/rschirin)\ **Replies:** 1\ **Last updated:** [September 30, 2020, 8:25am UTC](https://discuss.elastic.co/t/elasticsearch-maintenance-procedure/250465 "2020-09-30T08:25:08Z")
hi all, I'm starting to think about the correct procedure to apply security patches on the ES nodes (OS: CentOS). I have several clusters with different purpose but I focused on the most important; this cluster is comp… --- ## [o.e.b.Bootstrap](https://discuss.elastic.co/t/o-e-b-bootstrap/250365)
**Author:** [@muthug](https://discuss.elastic.co/u/muthug)\ **Replies:** 4\ **Last updated:** [September 30, 2020, 6:52am UTC](https://discuss.elastic.co/t/o-e-b-bootstrap/250365 "2020-09-30T06:52:47Z")
\[2020-09-29T15:25:43,752\]\[ERROR\]\[o.e.b.Bootstrap \] \[VDCGraylogNode02\] Exception java.lang.IllegalArgumentException: node settings must not contain any index level settings at org.elasticsearch.common.settings.… --- ## [ES rally benchmarking for existing cluster on AWS](https://discuss.elastic.co/t/es-rally-benchmarking-for-existing-cluster-on-aws/250182)
**Author:** [@naga2](https://discuss.elastic.co/u/naga2)\ **Replies:** 4\ **Last updated:** [September 30, 2020, 6:50am UTC](https://discuss.elastic.co/t/es-rally-benchmarking-for-existing-cluster-on-aws/250182 "2020-09-30T06:50:39Z")
I want to benchmark Elastic cluster which was on AWS with ES Rally on local machine. I got the below error when tried with following benchmarking command. Input: esrally --track=data --target-hosts= \[cluster public ip… --- ## [Query fails when value is empty - how do I work around this?](https://discuss.elastic.co/t/query-fails-when-value-is-empty-how-do-i-work-around-this/250439)
**Author:** [@M\_Gibbs](https://discuss.elastic.co/u/M_Gibbs)\ **Replies:** 1\ **Last updated:** [September 30, 2020, 6:44am UTC](https://discuss.elastic.co/t/query-fails-when-value-is-empty-how-do-i-work-around-this/250439 "2020-09-30T06:44:58Z")
Hi there, We are parsing our query via a form, and this form has 29+ inputs. Therefore there are many occassions where part of the full JSON query might have an empty value if the end user does not use one of the 29 + … --- ## [Elasticsearch Cluster Adding node](https://discuss.elastic.co/t/elasticsearch-cluster-adding-node/249637)
**Author:** [@kkhadka](https://discuss.elastic.co/u/kkhadka)\ **Replies:** 4\ **Last updated:** [September 30, 2020, 6:42am UTC](https://discuss.elastic.co/t/elasticsearch-cluster-adding-node/249637 "2020-09-30T06:42:33Z")
Hi, I want to switch from single node elasticsearch to three node cluster without the data loss. For that, I have modified the configuration files correctly. Let node1 be the one with data and node2, node3 are new node… --- ## [How is data encrypted on Elastic Cloud for the scenarios: Data at rest and Data in Transit](https://discuss.elastic.co/t/how-is-data-encrypted-on-elastic-cloud-for-the-scenarios-data-at-rest-and-data-in-transit/249984)
**Author:** [@Pooja](https://discuss.elastic.co/u/Pooja)\ **Replies:** 4\ **Last updated:** [September 30, 2020, 5:59am UTC](https://discuss.elastic.co/t/how-is-data-encrypted-on-elastic-cloud-for-the-scenarios-data-at-rest-and-data-in-transit/249984 "2020-09-30T05:59:12Z")
When you host Elasticsearch on Elastic Cloud and send logs from Azure Cloud and Onprem Logstash instances, How is data encrypted while in transit and How is the data that is at rest encrypted? --- ## [Primary vs replica inconsistency in ES5.6](https://discuss.elastic.co/t/primary-vs-replica-inconsistency-in-es5-6/249893)
**Author:** [@Priyanka\_Raju](https://discuss.elastic.co/u/Priyanka_Raju)\ **Replies:** 3\ **Last updated:** [September 30, 2020, 4:57am UTC](https://discuss.elastic.co/t/primary-vs-replica-inconsistency-in-es5-6/249893 "2020-09-30T04:57:30Z")
Hi, I recently noticed that some of our queries returned inconsistent results, digging deep, I found that the query returned 0 results when the query was executed against one replica and returned results when executed a… --- ## [Custom log collection using filebeat with seperate ILM policy for each log](https://discuss.elastic.co/t/custom-log-collection-using-filebeat-with-seperate-ilm-policy-for-each-log/250432)
**Author:** [@naveenkumarsp](https://discuss.elastic.co/u/naveenkumarsp)\ **Replies:** 1\ **Last updated:** [September 30, 2020, 1:48am UTC](https://discuss.elastic.co/t/custom-log-collection-using-filebeat-with-seperate-ilm-policy-for-each-log/250432 "2020-09-30T01:48:03Z")
i have a requirement where i am collecting custom log from a container in a Kuberentes Cluster via filebeat agent. The same filebeat agent also collects containers logs as well. Currently the logs are dumped to hostPath… --- ## [Adding analysers to an ES Index without downtime](https://discuss.elastic.co/t/adding-analysers-to-an-es-index-without-downtime/249614)
**Author:** [@Ryan\_Davey](https://discuss.elastic.co/u/Ryan_Davey)\ **Replies:** 1\ **Last updated:** [September 29, 2020, 11:43pm UTC](https://discuss.elastic.co/t/adding-analysers-to-an-es-index-without-downtime/249614 "2020-09-29T23:43:27Z")
Just looking for some direction on solving a problem. Our requirements need us to change our index occasionally to add new mappings and filters/normalizers/analyzers. These operations are not always allowed as an updat… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=795) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=797)