# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=799 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 800 --- ## [Safe way to downgrade 7.8.1 index to 7.7.1](https://discuss.elastic.co/t/safe-way-to-downgrade-7-8-1-index-to-7-7-1/250117)
**Author:** [@chakradarraju](https://discuss.elastic.co/u/chakradarraju)\ **Replies:** 2\ **Last updated:** [September 28, 2020, 4:56am UTC](https://discuss.elastic.co/t/safe-way-to-downgrade-7-8-1-index-to-7-7-1/250117 "2020-09-28T04:56:07Z")
I have ES installed using helm in kubernetes v7.8.1, we're migrating to EKS and latest supported version in Amazon Elasticsearch service is 7.7. Trying to restore 7.8.1 snapshot in 7.7 is failing and I tried to delete a… --- ## [Elastic search gives exception '"too\_many\_buckets\_exception" not able to catch it in high level rest client](https://discuss.elastic.co/t/elastic-search-gives-exception-too-many-buckets-exception-not-able-to-catch-it-in-high-level-rest-client/250120)
**Author:** [@charvi23](https://discuss.elastic.co/u/charvi23)\ **Replies:** 0\ **Last updated:** [September 28, 2020, 4:29am UTC](https://discuss.elastic.co/t/elastic-search-gives-exception-too-many-buckets-exception-not-able-to-catch-it-in-high-level-rest-client/250120 "2020-09-28T04:29:13Z")
I am trying to create a table using elastic search, but I get the following exception at times when the count of my bucket increases the limit. I am fine to have this exception as long I am able to send it to user that t… --- ## [At least one primary shard for the index \[.security-7\] is unavailable](https://discuss.elastic.co/t/at-least-one-primary-shard-for-the-index-security-7-is-unavailable/249508)
**Author:** [@naveenj](https://discuss.elastic.co/u/naveenj)\ **Replies:** 4\ **Last updated:** [September 28, 2020, 4:28am UTC](https://discuss.elastic.co/t/at-least-one-primary-shard-for-the-index-security-7-is-unavailable/249508 "2020-09-28T04:28:25Z")
Getting bellow error but elastic and kibana both working fine. Let me know the issue? org.elasticsearch.action.UnavailableShardsException: at least one primary shard for the index \[.security-7\] is unavailable at org.el… --- ## [Authen to elastic with ldap config on which nodes?](https://discuss.elastic.co/t/authen-to-elastic-with-ldap-config-on-which-nodes/249894)
**Author:** [@lusynda](https://discuss.elastic.co/u/lusynda)\ **Replies:** 3\ **Last updated:** [September 28, 2020, 3:55am UTC](https://discuss.elastic.co/t/authen-to-elastic-with-ldap-config-on-which-nodes/249894 "2020-09-28T03:55:53Z")
Hi all I have been testing for the feature to authen mine elastic server with ldap with one of my testing server, now i want to deploy it on the whole cluster, so which nodes do i have to config to get the feature worki… --- ## [Unable to install and start the elasticsearch in RHEL 7 due to polkit error](https://discuss.elastic.co/t/unable-to-install-and-start-the-elasticsearch-in-rhel-7-due-to-polkit-error/249847)
**Author:** [@aknraj](https://discuss.elastic.co/u/aknraj)\ **Replies:** 1\ **Last updated:** [September 28, 2020, 3:51am UTC](https://discuss.elastic.co/t/unable-to-install-and-start-the-elasticsearch-in-rhel-7-due-to-polkit-error/249847 "2020-09-28T03:51:15Z")
I am unable to start hte elasticsearch after the installation due to the below error. I have tried multiple options as recommended in other topics like reinstalling, enusing right java\_home, giving full permissions, but … --- ## [Elasticsearch cluster and 2 servers went down](https://discuss.elastic.co/t/elasticsearch-cluster-and-2-servers-went-down/249898)
**Author:** [@rohitarorait82](https://discuss.elastic.co/u/rohitarorait82)\ **Replies:** 1\ **Last updated:** [September 28, 2020, 3:46am UTC](https://discuss.elastic.co/t/elasticsearch-cluster-and-2-servers-went-down/249898 "2020-09-28T03:46:06Z")
Hi Team, I have 6 server cluster with 5 data node and 1 coordinating node , 2 of the server went completely down because of the heavy load. On one server even telnet is not working on 22 port and on the other sever whe… --- ## [How to increase disk size for Elastic search](https://discuss.elastic.co/t/how-to-increase-disk-size-for-elastic-search/249925)
**Author:** [@pnamburi](https://discuss.elastic.co/u/pnamburi)\ **Replies:** 1\ **Last updated:** [September 28, 2020, 3:44am UTC](https://discuss.elastic.co/t/how-to-increase-disk-size-for-elastic-search/249925 "2020-09-28T03:44:25Z")
I just executed the below command which returned the elastic search disk space GET \_cat/nodes?v&h=id,diskTotal,diskUsed,diskAvail,diskUsedPercent Output: id diskTotal diskUsed diskAvail diskUsedPercent qzxs 9.6gb 8.7… --- ## [Unauthorized to indices:admin/settings/update](https://discuss.elastic.co/t/unauthorized-to-indices-admin-settings-update/249987)
**Author:** [@ffknob](https://discuss.elastic.co/u/ffknob)\ **Replies:** 0\ **Last updated:** [September 25, 2020, 2:10pm UTC](https://discuss.elastic.co/t/unauthorized-to-indices-admin-settings-update/249987 "2020-09-25T14:10:14Z")
Hello do you know what privilege I have to include in a role in order for this user to be able to execute that action? \[2020-09-24T19:47:08,114\]\[ERROR\]\[o.e.x.i.IndexLifecycleRunner\] \[node01\] policy \[apm-rollover-30-day… --- ## [If i try to Add search search.max\_buckets then getting below error CURL -XGET "http://localhost:9200/\_cluster/settings {"persistent":{},"transient":{"search.max\_buckets": 200000}} curl: (3) \[globbing\] nested brace in column 53](https://discuss.elastic.co/t/if-i-try-to-add-search-search-max-buckets-then-getting-below-error-curl-xget-http-localhost-9200-cluster-settings-persistent-transient-search-max-buckets-200000-curl-3-globbing-nested-brace-in-column-53/250004)
**Author:** [@Suparna\_Shankar](https://discuss.elastic.co/u/Suparna_Shankar)\ **Replies:** 1\ **Last updated:** [September 28, 2020, 3:38am UTC](https://discuss.elastic.co/t/if-i-try-to-add-search-search-max-buckets-then-getting-below-error-curl-xget-http-localhost-9200-cluster-settings-persistent-transient-search-max-buckets-200000-curl-3-globbing-nested-brace-in-column-53/250004 "2020-09-28T03:38:06Z")
if i try to Add search search.max\_buckets then getting below error CURL -XGET "http://localhost:9200/\_cluster/settings {"persistent":{},"transient":{"search.max\_buckets": 200000}} curl: (3) \[globbing\] nested brace in col… --- ## [Failed to parse the field](https://discuss.elastic.co/t/failed-to-parse-the-field/250026)
**Author:** [@Ramalakshmi](https://discuss.elastic.co/u/Ramalakshmi)\ **Replies:** 1\ **Last updated:** [September 28, 2020, 3:35am UTC](https://discuss.elastic.co/t/failed-to-parse-the-field/250026 "2020-09-28T03:35:55Z")
Hi I am sending logs to kibana using filebeat ,and I am facing below error while sending logs .Some of the events doesn't have host in raw data facing error for that events. \[2020-09-24T09:20:40,591\]\[WARN \]\[logstash.ou… --- ## [Get histogram of documents per hour per term](https://discuss.elastic.co/t/get-histogram-of-documents-per-hour-per-term/250106)
**Author:** [@pocorschi](https://discuss.elastic.co/u/pocorschi)\ **Replies:** 1\ **Last updated:** [September 28, 2020, 3:28am UTC](https://discuss.elastic.co/t/get-histogram-of-documents-per-hour-per-term/250106 "2020-09-28T03:28:40Z")
Hi everybody. Been looking around for a while trying to come up with an answer to this but no luck so far. My documents are simple. One timestamp and one device\_id. Given a start and end date, I would want to get a hist… --- ## [Not able to start elasticsearch](https://discuss.elastic.co/t/not-able-to-start-elasticsearch/250018)
**Author:** [@pradnya\_05](https://discuss.elastic.co/u/pradnya_05)\ **Replies:** 1\ **Last updated:** [September 28, 2020, 3:23am UTC](https://discuss.elastic.co/t/not-able-to-start-elasticsearch/250018 "2020-09-28T03:23:44Z")
I have just started reading about elasticsearch concept so I am new in this concept. I have downloaded zip file of elasticseach as I am using windows. But after running batch file from cmd with admin access, getting exce… --- ## [Licensing DEV and CONS Nodes](https://discuss.elastic.co/t/licensing-dev-and-cons-nodes/249999)
**Author:** [@northwine](https://discuss.elastic.co/u/northwine)\ **Replies:** 1\ **Last updated:** [September 28, 2020, 1:30am UTC](https://discuss.elastic.co/t/licensing-dev-and-cons-nodes/249999 "2020-09-28T01:30:29Z")
Hi, i have found a note in this post regarding the licensing of dev environments (in addition to allready licensed prod nodes). Where can I find a reference that there is no need for additional licenses for DEV / CONS n… --- ## [Elastic 401 error with xpack security off](https://discuss.elastic.co/t/elastic-401-error-with-xpack-security-off/250085)
**Author:** [@jividi](https://discuss.elastic.co/u/jividi)\ **Replies:** 0\ **Last updated:** [September 27, 2020, 12:48pm UTC](https://discuss.elastic.co/t/elastic-401-error-with-xpack-security-off/250085 "2020-09-27T12:48:02Z")
Hi, I have an elastic 7.8 on docker that I want to connect to it from a remote server on the internet with the domain, I have several other local vms that connects to logstash and logstash works fine with local IP but I … --- ## [Upgrade elasticsearch](https://discuss.elastic.co/t/upgrade-elasticsearch/249491)
**Author:** [@blomqc](https://discuss.elastic.co/u/blomqc)\ **Replies:** 3\ **Last updated:** [September 28, 2020, 12:34am UTC](https://discuss.elastic.co/t/upgrade-elasticsearch/249491 "2020-09-28T00:34:33Z")
after upgrading elasticsearch binaries from 1.7.x to 2.x, elasticsearch takes very long (~20h) get back online. From the log it looks like data is moved around ? Only seen this issue when elasticsearch is configured wi… --- ## [Script for a Force Merge on indexes in ES](https://discuss.elastic.co/t/script-for-a-force-merge-on-indexes-in-es/250021)
**Author:** [@elasticuserxxx](https://discuss.elastic.co/u/elasticuserxxx)\ **Replies:** 1\ **Last updated:** [September 27, 2020, 6:04pm UTC](https://discuss.elastic.co/t/script-for-a-force-merge-on-indexes-in-es/250021 "2020-09-27T18:04:26Z")
I need to run force merge on indexes which are older (no longer being written to or not in active state) for more than "48hours for daily/quaterly indexes" and "33 days for monthly indexes". This should be run by a scri… --- ## [Tagging data based on lookup table](https://discuss.elastic.co/t/tagging-data-based-on-lookup-table/250097)
**Author:** [@Adi\_Pacht](https://discuss.elastic.co/u/Adi_Pacht)\ **Replies:** 0\ **Last updated:** [September 27, 2020, 5:09pm UTC](https://discuss.elastic.co/t/tagging-data-based-on-lookup-table/250097 "2020-09-27T17:09:48Z")
Hey everyone, I’m trying to tag my data according to a lookup table. The lookup table has these fields: • Key- represent the field name in the data I want to tag. In the real data the field is a subfield of “Headers”… --- ## [ES is not starting after upgrading it to 7.9.2](https://discuss.elastic.co/t/es-is-not-starting-after-upgrading-it-to-7-9-2/250081)
**Author:** [@NiranjanMurali](https://discuss.elastic.co/u/NiranjanMurali)\ **Replies:** 8\ **Last updated:** [September 27, 2020, 2:37pm UTC](https://discuss.elastic.co/t/es-is-not-starting-after-upgrading-it-to-7-9-2/250081 "2020-09-27T14:37:14Z")
Elasticsearch is not starting after updating it to 7.9.2. It throws below error. OS-CentOS7 Exception in thread "main" java.lang.RuntimeException: starting java failed with \[1\] output: error: Unrecognized VM option … --- ## [Scoring individual documents](https://discuss.elastic.co/t/scoring-individual-documents/250090)
**Author:** [@thernstig](https://discuss.elastic.co/u/thernstig)\ **Replies:** 0\ **Last updated:** [September 27, 2020, 1:56pm UTC](https://discuss.elastic.co/t/scoring-individual-documents/250090 "2020-09-27T13:56:55Z")
I understand that Elasticsearch is a great database to search amongst documents and to score them amongst eachother, thus being able to return to most relevant document for the search. But I want to use Elasticsearch in… --- ## [Elasticsearch cross-index query with aggregations](https://discuss.elastic.co/t/elasticsearch-cross-index-query-with-aggregations/249100)
**Author:** [@ArtemSavelev](https://discuss.elastic.co/u/ArtemSavelev)\ **Replies:** 1\ **Last updated:** [September 26, 2020, 11:22pm UTC](https://discuss.elastic.co/t/elasticsearch-cross-index-query-with-aggregations/249100 "2020-09-26T23:22:10Z")
I use: Elasticsearch 7.7 , Kibana 7.7 For example, lets take two indexes: User index with simple mapping: PUT /user\_index { "mappings": { "properties": { "user\_id": { "type": "text" }, "user\_phone… --- ## [Monitor failed elastic user logins](https://discuss.elastic.co/t/monitor-failed-elastic-user-logins/250045)
**Author:** [@borna\_talebi](https://discuss.elastic.co/u/borna_talebi)\ **Replies:** 1\ **Last updated:** [September 26, 2020, 10:54pm UTC](https://discuss.elastic.co/t/monitor-failed-elastic-user-logins/250045 "2020-09-26T22:54:39Z")
Hi, I was wondering if there is a way to temporarily ban an IP or even a user profile who entered its password wrong for N time. In general, is there a way to monitor user login attempts and automatically act upon it? --- ## [Documentation on Elastic search upgrade](https://discuss.elastic.co/t/documentation-on-elastic-search-upgrade/250043)
**Author:** [@GOKUL\_R](https://discuss.elastic.co/u/GOKUL_R)\ **Replies:** 1\ **Last updated:** [September 26, 2020, 1:45pm UTC](https://discuss.elastic.co/t/documentation-on-elastic-search-upgrade/250043 "2020-09-26T13:45:46Z")
Hi, I have been trying to upgrade the ELasticsearch version from 7.1.1 to 7.8.0 and unfortunately it has broke our Kibana. I had a good reference on breaking changes and new upgrades for each version with the help of do… --- ## [I get an exception after enabling transport layer security . Can someone help me here?](https://discuss.elastic.co/t/i-get-an-exception-after-enabling-transport-layer-security-can-someone-help-me-here/250049)
**Author:** [@snehadarshini](https://discuss.elastic.co/u/snehadarshini)\ **Replies:** 1\ **Last updated:** [September 26, 2020, 11:13am UTC](https://discuss.elastic.co/t/i-get-an-exception-after-enabling-transport-layer-security-can-someone-help-me-here/250049 "2020-09-26T11:13:45Z")
\[2020-09-26T05:29:15,468\]\[WARN \]\[o.e.t.TcpTransport \] \[master-2\] exception caught on transport layer \[Netty4TcpChannel{localAddress=/10.0.1.102:9300, remoteAddress=/10.0.1.101:34044}\], closing connection io.netty.h… --- ## [Data loss incase of elasticsearch data node going down](https://discuss.elastic.co/t/data-loss-incase-of-elasticsearch-data-node-going-down/250042)
**Author:** [@rohitarorait82](https://discuss.elastic.co/u/rohitarorait82)\ **Replies:** 2\ **Last updated:** [September 26, 2020, 9:28am UTC](https://discuss.elastic.co/t/data-loss-incase-of-elasticsearch-data-node-going-down/250042 "2020-09-26T09:28:01Z")
Hi All, We have 5 data nodes in our cluster, out of these 2 nodes went down and it looks like , I will take at-least a week to recover it. Is there a way to work with remaining 3 data nodes and we can recover other 2 da… --- ## [Re-evaluating shard setup](https://discuss.elastic.co/t/re-evaluating-shard-setup/249793)
**Author:** [@claohr](https://discuss.elastic.co/u/claohr)\ **Replies:** 9\ **Last updated:** [September 26, 2020, 6:58am UTC](https://discuss.elastic.co/t/re-evaluating-shard-setup/249793 "2020-09-26T06:58:25Z")
I'm running 3 node (26 GB EBS volume, 4GB Memory, c5.large) ES cluster v7.7 (AWS) for 1 index with the following setting PUT /my-index { "settings": { "number\_of\_shards": 1, "number\_of\_replicas": 1 } } A… --- ## [Dynamic facets with applied filters](https://discuss.elastic.co/t/dynamic-facets-with-applied-filters/250039)
**Author:** [@cmodijk](https://discuss.elastic.co/u/cmodijk)\ **Replies:** 0\ **Last updated:** [September 26, 2020, 4:51am UTC](https://discuss.elastic.co/t/dynamic-facets-with-applied-filters/250039 "2020-09-26T04:51:08Z")
Hi, I have been looking for a solution for the following case and tried searching for multiple terms on the Google and here on the forum. I'm not sure what the best solution is for this case so maybe someone here can po… --- ## [Unable to set search.max\_buckets for \_cluster/settings](https://discuss.elastic.co/t/unable-to-set-search-max-buckets-for-cluster-settings/250015)
**Author:** [@Suparna\_Shankar](https://discuss.elastic.co/u/Suparna_Shankar)\ **Replies:** 5\ **Last updated:** [September 25, 2020, 10:00pm UTC](https://discuss.elastic.co/t/unable-to-set-search-max-buckets-for-cluster-settings/250015 "2020-09-25T22:00:00Z")
m trying to curl -XPUT "http://localhost:9200/\_cluster/settings -H 'Content-Type: application/json'{"transient":{"search.max\_buckets": 200000}} but am getting below error please correct me if i am wrong C:\\Users\\ssuparn… --- ## [OutOfMemoryError occurred on ES host accessed via Kibana](https://discuss.elastic.co/t/outofmemoryerror-occurred-on-es-host-accessed-via-kibana/250005)
**Author:** [@novaksam](https://discuss.elastic.co/u/novaksam)\ **Replies:** 0\ **Last updated:** [September 25, 2020, 4:37pm UTC](https://discuss.elastic.co/t/outofmemoryerror-occurred-on-es-host-accessed-via-kibana/250005 "2020-09-25T16:37:10Z")
Kinda similar to OutOfMemoryError occurred in coordinating node · Issue #49699 · elastic/elasticsearch · GitHub in that I have a significant amount of my heap being consumed by byte arrays, seemingly being utilized by th… --- ## [How can we read data from Qualys to any of E L K?](https://discuss.elastic.co/t/how-can-we-read-data-from-qualys-to-any-of-e-l-k/249754)
**Author:** [@Pooja](https://discuss.elastic.co/u/Pooja)\ **Replies:** 3\ **Last updated:** [September 25, 2020, 1:45pm UTC](https://discuss.elastic.co/t/how-can-we-read-data-from-qualys-to-any-of-e-l-k/249754 "2020-09-25T13:45:06Z")
Continuing the discussion from Qualys API integration into Elasticsearch: --- ## [Slow refresh times for large indices](https://discuss.elastic.co/t/slow-refresh-times-for-large-indices/249811)
**Author:** [@yogevyuval](https://discuss.elastic.co/u/yogevyuval)\ **Replies:** 2\ **Last updated:** [September 25, 2020, 12:56pm UTC](https://discuss.elastic.co/t/slow-refresh-times-for-large-indices/249811 "2020-09-25T12:56:44Z")
Hi, We are experiencing a very high load on the cluster, which seems to happen from a very high iops rate (\>5000), when indexing to very specific indices. In this graph you can see our disk iops during indexing to thos… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=798) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=800)