# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=810 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 811 --- ## [Unescape XML](https://discuss.elastic.co/t/unescape-xml/248548)
**Author:** [@BkQc](https://discuss.elastic.co/u/BkQc)\ **Replies:** 0\ **Last updated:** [September 14, 2020, 3:06pm UTC](https://discuss.elastic.co/t/unescape-xml/248548 "2020-09-14T15:06:28Z")
I have a field which contains data that came from an XML node. For some reason, this XML was not unescaped so I end up with values like instead of a line feed (CrLf). Is there any way of unescaping this in an… --- ## [GCP machine type (N1,N2 and N2D) recommendations for ELK](https://discuss.elastic.co/t/gcp-machine-type-n1-n2-and-n2d-recommendations-for-elk/248547)
**Author:** [@hemanth49841](https://discuss.elastic.co/u/hemanth49841)\ **Replies:** 0\ **Last updated:** [September 14, 2020, 2:58pm UTC](https://discuss.elastic.co/t/gcp-machine-type-n1-n2-and-n2d-recommendations-for-elk/248547 "2020-09-14T14:58:18Z")
Hi All, We are planning deploy elk stack on Google cloud Platform. What are best recommended instance type (N1,N2 ,N2D, Compute optimised and memory optimised) for elastic, logstash and kibana nodes. Thanks in Advance… --- ## [Es instance unusable](https://discuss.elastic.co/t/es-instance-unusable/247768)
**Author:** [@lizhu](https://discuss.elastic.co/u/lizhu)\ **Replies:** 6\ **Last updated:** [September 14, 2020, 2:39pm UTC](https://discuss.elastic.co/t/es-instance-unusable/247768 "2020-09-14T14:39:45Z")
Hi I have an es(version 6.8.0) cluster with 5 nodes which have 261 shards that max size is 40G and min size is 700M，vm nodes：16 cpu and 32 G. It became unusable sometimes and print such logs how to trouble shoot? … --- ## [Ingest-Attachment: Enabling OCR](https://discuss.elastic.co/t/ingest-attachment-enabling-ocr/248527)
**Author:** [@roelandw](https://discuss.elastic.co/u/roelandw)\ **Replies:** 1\ **Last updated:** [September 14, 2020, 12:52pm UTC](https://discuss.elastic.co/t/ingest-attachment-enabling-ocr/248527 "2020-09-14T12:52:57Z")
Hi there, I'm trying to index some various documents using the Ingest-Attachment plugin. Some of these documents are image-based pdf documents that require OCR processing. According to this page on StackOverflow, Inges… --- ## [Did elasticsearch cluster name includes special characters](https://discuss.elastic.co/t/did-elasticsearch-cluster-name-includes-special-characters/248329)
**Author:** [@chandu2](https://discuss.elastic.co/u/chandu2)\ **Replies:** 10\ **Last updated:** [September 14, 2020, 12:50pm UTC](https://discuss.elastic.co/t/did-elasticsearch-cluster-name-includes-special-characters/248329 "2020-09-14T12:50:19Z")
Did elasticsearch cluster name includes special characters. If Iam including I am getting error. Please anyone clarify on this. How can I use special characters also --- ## [Access elasticsearch from public ip instead of LAN ipv4](https://discuss.elastic.co/t/access-elasticsearch-from-public-ip-instead-of-lan-ipv4/248087)
**Author:** [@Abdul\_Samad](https://discuss.elastic.co/u/Abdul_Samad)\ **Replies:** 12\ **Last updated:** [September 14, 2020, 12:46pm UTC](https://discuss.elastic.co/t/access-elasticsearch-from-public-ip-instead-of-lan-ipv4/248087 "2020-09-14T12:46:42Z")
I have elasticsearch installed in one machine with local LAN ipv4 = 192.168.. public ip = 39...\* i have http.port: 9200 network.host: 0.0.0.0 in my elasticsearch.yml I can access this with in same network: ipv4:9… --- ## [Time between two timestamps in different files](https://discuss.elastic.co/t/time-between-two-timestamps-in-different-files/248327)
**Author:** [@Tommie](https://discuss.elastic.co/u/Tommie)\ **Replies:** 5\ **Last updated:** [September 14, 2020, 11:09am UTC](https://discuss.elastic.co/t/time-between-two-timestamps-in-different-files/248327 "2020-09-14T11:09:10Z")
Hi, Can you please advise me setting up the following? There are multiple log files (csv) coming from multiple sources. The logfiles contains data from transactions which are first processed in system A, then processe… --- ## [How to settings a elasticsearch cluster correctly](https://discuss.elastic.co/t/how-to-settings-a-elasticsearch-cluster-correctly/248500)
**Author:** [@djuwa4](https://discuss.elastic.co/u/djuwa4)\ **Replies:** 8\ **Last updated:** [September 14, 2020, 11:08am UTC](https://discuss.elastic.co/t/how-to-settings-a-elasticsearch-cluster-correctly/248500 "2020-09-14T11:08:09Z")
Hello! According to the terms of reference, I have to set up a cluster of five nodes. I have a number of questions. Can I specify one of the nodes simultaneously as a master node and as a data node? If I specifie… --- ## [ElasticSearch Performance](https://discuss.elastic.co/t/elasticsearch-performance/248026)
**Author:** [@oliverlucas](https://discuss.elastic.co/u/oliverlucas)\ **Replies:** 3\ **Last updated:** [September 14, 2020, 10:31am UTC](https://discuss.elastic.co/t/elasticsearch-performance/248026 "2020-09-14T10:31:35Z")
Hi All, So quite new to ElasticSearch, and very new to large amounts of data that we seem to be collecting, and because of this i have a few problems that hopefully someone can help with. Background: We're collecting… --- ## [Refresh interval on indices with no changes](https://discuss.elastic.co/t/refresh-interval-on-indices-with-no-changes/248368)
**Author:** [@Silas\_Hansen](https://discuss.elastic.co/u/Silas_Hansen)\ **Replies:** 2\ **Last updated:** [September 14, 2020, 10:29am UTC](https://discuss.elastic.co/t/refresh-interval-on-indices-with-no-changes/248368 "2020-09-14T10:29:16Z")
If I explicitly set a refresh\_interval on an index, will it still run the refresh operation, even if no new documents have been indexed to it since the last refresh? I'm trying to understand if setting an explicit refre… --- ## [Elasticsearch Docker: flood stage disk watermark \[95%\] exceeded](https://discuss.elastic.co/t/elasticsearch-docker-flood-stage-disk-watermark-95-exceeded/248479)
**Author:** [@Stimmot](https://discuss.elastic.co/u/Stimmot)\ **Replies:** 3\ **Last updated:** [September 14, 2020, 9:53am UTC](https://discuss.elastic.co/t/elasticsearch-docker-flood-stage-disk-watermark-95-exceeded/248479 "2020-09-14T09:53:30Z")
I have a problem with my Elasticsearch nodes running in a docker environment. I'm starting them up with docker-compose and after a few minutes they tell me: flood stage disk watermark \[95%\] exceeded I'm running it on a… --- ## [Iso 8601 time duration support](https://discuss.elastic.co/t/iso-8601-time-duration-support/248410)
**Author:** [@bnarang](https://discuss.elastic.co/u/bnarang)\ **Replies:** 5\ **Last updated:** [September 14, 2020, 8:44am UTC](https://discuss.elastic.co/t/iso-8601-time-duration-support/248410 "2020-09-14T08:44:36Z")
Does elasticsearch supports iso time duration P\[n\]Y\[n\]M\[n\]DT\[n\]H\[n\]M\[n\]S? I would be receiving data in this format, want to index in the same format and would like the range operation available on that. --- ## [When getting a CompletedReindexResponse, I'm receiving an interesting message: Invalid NEST response built from a null ApiCall which is highly exceptional, please open a bug if you see this](https://discuss.elastic.co/t/when-getting-a-completedreindexresponse-im-receiving-an-interesting-message-invalid-nest-response-built-from-a-null-apicall-which-is-highly-exceptional-please-open-a-bug-if-you-see-this/248164)
**Author:** [@CollabcoAndy](https://discuss.elastic.co/u/CollabcoAndy)\ **Replies:** 7\ **Last updated:** [September 14, 2020, 7:59am UTC](https://discuss.elastic.co/t/when-getting-a-completedreindexresponse-im-receiving-an-interesting-message-invalid-nest-response-built-from-a-null-apicall-which-is-highly-exceptional-please-open-a-bug-if-you-see-this/248164 "2020-09-14T07:59:22Z")
Hi all, I'm exploring the NEST client currently and followed the code for ReindexOnServer here: https://www.elastic.co/guide/en/elasticsearch/client/net-api/current/reindexing-documents.html I have followed the code p… --- ## [How to get total term frequency through aggregation in elastic](https://discuss.elastic.co/t/how-to-get-total-term-frequency-through-aggregation-in-elastic/248483)
**Author:** [@Ubeta](https://discuss.elastic.co/u/Ubeta)\ **Replies:** 0\ **Last updated:** [September 14, 2020, 7:57am UTC](https://discuss.elastic.co/t/how-to-get-total-term-frequency-through-aggregation-in-elastic/248483 "2020-09-14T07:57:45Z")
Hi! In a search result, I want to get the total number of times a term has showed in the list of documents returned. By only using term aggregations, I can only get the doc count but what I want is the total number of t… --- ## [Pod goes to crashloopbackoff](https://discuss.elastic.co/t/pod-goes-to-crashloopbackoff/248476)
**Author:** [@knagasri](https://discuss.elastic.co/u/knagasri)\ **Replies:** 0\ **Last updated:** [September 14, 2020, 7:26am UTC](https://discuss.elastic.co/t/pod-goes-to-crashloopbackoff/248476 "2020-09-14T07:26:29Z")
When I deployed Elasticsearch in GCP, It works fine , Suddenly one of my ingest pod goes to crashLoop Backoff, remaining all pods are running fine. I am running with 4 ingest nodes and 3 master nodes. Operator version … --- ## [Elastic Cloud Cross Cluster Replication](https://discuss.elastic.co/t/elastic-cloud-cross-cluster-replication/248464)
**Author:** [@Aaron\_Chen](https://discuss.elastic.co/u/Aaron_Chen)\ **Replies:** 0\ **Last updated:** [September 14, 2020, 1:20am UTC](https://discuss.elastic.co/t/elastic-cloud-cross-cluster-replication/248464 "2020-09-14T01:20:00Z")
As far as I concerned, Elastic is providing cross-cluster replication whereby user can have a secondary cluster serving as a hot backup -- https://www.elastic.co/guide/en/elasticsearch/reference/current/xpack-ccr.html H… --- ## [Kibana website is not working](https://discuss.elastic.co/t/kibana-website-is-not-working/248277)
**Author:** [@muthug](https://discuss.elastic.co/u/muthug)\ **Replies:** 1\ **Last updated:** [September 13, 2020, 11:30pm UTC](https://discuss.elastic.co/t/kibana-website-is-not-working/248277 "2020-09-13T23:30:16Z")
Till yesterday everything was working fine, from today both node is not working. Node 1: root@sys1 init.d# curl -XGET localhost:9200/\_cluster/health?pretty { "cluster\_name" : "BPElasticSearch", "status" : "red", "t… --- ## [Unable to start elasticsearch 7.8 container with a password](https://discuss.elastic.co/t/unable-to-start-elasticsearch-7-8-container-with-a-password/248304)
**Author:** [@Ayush\_Agrahari](https://discuss.elastic.co/u/Ayush_Agrahari)\ **Replies:** 1\ **Last updated:** [September 13, 2020, 11:29pm UTC](https://discuss.elastic.co/t/unable-to-start-elasticsearch-7-8-container-with-a-password/248304 "2020-09-13T23:29:37Z")
Hello, I am attempting to setup an elastisearch cluster using a hot and warm bode using one docker-compose. However, when starting up the setup I am unable to log in, and see the following error in docker logs: "stackt… --- ## [Filebeat upload log to es5 , 403](https://discuss.elastic.co/t/filebeat-upload-log-to-es5-403/248266)
**Author:** [@Adonis\_Zzq](https://discuss.elastic.co/u/Adonis_Zzq)\ **Replies:** 9\ **Last updated:** [September 13, 2020, 11:24pm UTC](https://discuss.elastic.co/t/filebeat-upload-log-to-es5-403/248266 "2020-09-13T23:24:29Z")
I use es 5.6.4 , filebeat upload log to es, return 403 ,What could cause this? The log is as follows: 2020-09-11T14:14:25+08:00 ERR Failed to perform any bulk index operations: 403 Forbidden 2020-09-11T14:14:25+08:00 … --- ## [Is HTTP on each node will enable by default](https://discuss.elastic.co/t/is-http-on-each-node-will-enable-by-default/248325)
**Author:** [@chandu2](https://discuss.elastic.co/u/chandu2)\ **Replies:** 3\ **Last updated:** [September 13, 2020, 11:21pm UTC](https://discuss.elastic.co/t/is-http-on-each-node-will-enable-by-default/248325 "2020-09-13T23:21:42Z")
Will HTTP enable by default. If enabled by default. How can we disable it. Anyone help me out this. To disable, Can I use http.enabled : false --- ## [Access elasticsearch from outside network \< my static public ip address \>:9200](https://discuss.elastic.co/t/access-elasticsearch-from-outside-network-my-static-public-ip-address-9200/248340)
**Author:** [@Abdul\_Samad](https://discuss.elastic.co/u/Abdul_Samad)\ **Replies:** 2\ **Last updated:** [September 13, 2020, 11:19pm UTC](https://discuss.elastic.co/t/access-elasticsearch-from-outside-network-my-static-public-ip-address-9200/248340 "2020-09-13T23:19:01Z")
I have my Elasticsearch running on my windows 10 server. I want to access it with \< my static public ip address \>:9200 I can access it with: localhost:9200 127.0.0.1:9200 \< my ipv4 address from ipconfig \>:9200 But i … --- ## [Not performing POST when running command twice](https://discuss.elastic.co/t/not-performing-post-when-running-command-twice/248454)
**Author:** [@gdiaz](https://discuss.elastic.co/u/gdiaz)\ **Replies:** 1\ **Last updated:** [September 13, 2020, 10:28pm UTC](https://discuss.elastic.co/t/not-performing-post-when-running-command-twice/248454 "2020-09-13T22:28:00Z")
Hi all, I'm running es with the following command docker run -d -p 9200:9200 -p 9300:9300 --name=elasticsearch -e "discovery.type=single-node" -v elasticsearch-data:/usr/share/elasticsearch/data docker.elastic.co/elast… --- ## [Nested search and bulk update](https://discuss.elastic.co/t/nested-search-and-bulk-update/248421)
**Author:** [@doniv](https://discuss.elastic.co/u/doniv)\ **Replies:** 5\ **Last updated:** [September 13, 2020, 7:12pm UTC](https://discuss.elastic.co/t/nested-search-and-bulk-update/248421 "2020-09-13T19:12:44Z")
Hello, guys. I am trying to figured out the best practice to solve following case: I have two data tables in sql db: transactions and bank\_accounts (one transaction has one bank account). And i would like to search tho… --- ## [Query not working in different environments](https://discuss.elastic.co/t/query-not-working-in-different-environments/245609)
**Author:** [@gdiaz](https://discuss.elastic.co/u/gdiaz)\ **Replies:** 4\ **Last updated:** [September 13, 2020, 7:07pm UTC](https://discuss.elastic.co/t/query-not-working-in-different-environments/245609 "2020-09-13T19:07:09Z")
I have an elastic instance running in the cloud. I'm developing a REST service in Node. The same elastic instance is used when Node is in localhost and when is in develop env. When Node runs in localhost all queries work… --- ## [Index Failover to Warm node not happening](https://discuss.elastic.co/t/index-failover-to-warm-node-not-happening/248199)
**Author:** [@ajesh](https://discuss.elastic.co/u/ajesh)\ **Replies:** 4\ **Last updated:** [September 13, 2020, 3:45pm UTC](https://discuss.elastic.co/t/index-failover-to-warm-node-not-happening/248199 "2020-09-13T15:45:13Z")
Hi Team, My index is not rolling over to Warm nodes as per the ILM policy , it just simply grows. Please see the attached . ILM policy is set to Index size 50GB or 30 Days. Index stats and screenshots attached , i could… --- ## [java.lang.NoClassDefFoundError: Could not initialize class com.sun.jna.Native](https://discuss.elastic.co/t/java-lang-noclassdeffounderror-could-not-initialize-class-com-sun-jna-native/248441)
**Author:** [@muthug](https://discuss.elastic.co/u/muthug)\ **Replies:** 13\ **Last updated:** [September 13, 2020, 3:24pm UTC](https://discuss.elastic.co/t/java-lang-noclassdeffounderror-could-not-initialize-class-com-sun-jna-native/248441 "2020-09-13T15:24:26Z")
Hi, Greetings !! I have installed ES 7.9 version and jdk 8u202 version. But unable to start the ES service. Sep 13 16:03:20 FRAKHRPL100N systemd-entrypoint\[72677\]: fatal error in thread \[main\], exiting Sep 13 16:03:2… --- ## [java.lang.IllegalArgumentException: unknown setting \[path.conf\] please check that any required plugins are installed, or check the breaking changes documentation for removed settings](https://discuss.elastic.co/t/java-lang-illegalargumentexception-unknown-setting-path-conf-please-check-that-any-required-plugins-are-installed-or-check-the-breaking-changes-documentation-for-removed-settings/248438)
**Author:** [@muthug](https://discuss.elastic.co/u/muthug)\ **Replies:** 2\ **Last updated:** [September 13, 2020, 2:53pm UTC](https://discuss.elastic.co/t/java-lang-illegalargumentexception-unknown-setting-path-conf-please-check-that-any-required-plugins-are-installed-or-check-the-breaking-changes-documentation-for-removed-settings/248438 "2020-09-13T14:53:49Z")
Hi All, Greeting !! I am creating the new setup of ELK, and now i am unable to start ES service. Logs are below for reference. ES Version: 7.9 elasticsearch.yml config:- cluster.name: BPOConnectElasticSearch 2 node… --- ## [Lucene query on nested type](https://discuss.elastic.co/t/lucene-query-on-nested-type/248434)
**Author:** [@Yuval99](https://discuss.elastic.co/u/Yuval99)\ **Replies:** 1\ **Last updated:** [September 13, 2020, 10:43am UTC](https://discuss.elastic.co/t/lucene-query-on-nested-type/248434 "2020-09-13T10:43:48Z")
Hi guys! We are trying to make a search based on lucene syntax on object with nested type fields. We looked on DSL but it's not fitted to our requirements. Our data looks like: { scans: \[ { ip: "1.2.3.4", is\_malware:… --- ## [Phrase suggester doesn't provide the correct suggestions](https://discuss.elastic.co/t/phrase-suggester-doesnt-provide-the-correct-suggestions/248428)
**Author:** [@smuthuka](https://discuss.elastic.co/u/smuthuka)\ **Replies:** 0\ **Last updated:** [September 13, 2020, 3:18am UTC](https://discuss.elastic.co/t/phrase-suggester-doesnt-provide-the-correct-suggestions/248428 "2020-09-13T03:18:47Z")
Phrase suggester doesn't provide the correct suggestions. This usually happens after adding/deleting documents. Index Mapping PUT sugg\_test { "settings": { "index": { "number\_of\_shards": "1", "number\_… --- ## [Alternative to using filtered index alias](https://discuss.elastic.co/t/alternative-to-using-filtered-index-alias/248419)
**Author:** [@ilya.rybak](https://discuss.elastic.co/u/ilya.rybak)\ **Replies:** 1\ **Last updated:** [September 12, 2020, 8:32pm UTC](https://discuss.elastic.co/t/alternative-to-using-filtered-index-alias/248419 "2020-09-12T20:32:51Z")
I'm trying to figure out possible solution to the following problem. In my current implementation I'm relying on so called filtered aliases where I can create a view of the same index for each user e.g.: POST /aliases { … [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=809) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=811)