# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=812 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 813 --- ## [ES SQL - Order by Count](https://discuss.elastic.co/t/es-sql-order-by-count/248195)
**Author:** [@Jose\_H](https://discuss.elastic.co/u/Jose_H)\ **Replies:** 2\ **Last updated:** [September 11, 2020, 7:02am UTC](https://discuss.elastic.co/t/es-sql-order-by-count/248195 "2020-09-11T07:02:51Z")
Hi all, Im trying to order and display by the highest count for @computed.message field, but encountering the below error: POST /\_sql?format=txt { "query":"SELECT \\"@timestamp\\", \\"@computed.message\\", \\"@computed.… --- ## [This action would add \[2\] total shards, but this cluster currently has \[2000\]/\[2000\] maximum shards open;](https://discuss.elastic.co/t/this-action-would-add-2-total-shards-but-this-cluster-currently-has-2000-2000-maximum-shards-open/248255)
**Author:** [@Maricar\_Laygo](https://discuss.elastic.co/u/Maricar_Laygo)\ **Replies:** 1\ **Last updated:** [September 11, 2020, 5:12am UTC](https://discuss.elastic.co/t/this-action-would-add-2-total-shards-but-this-cluster-currently-has-2000-2000-maximum-shards-open/248255 "2020-09-11T05:12:05Z")
Invalid Bulk items: operation\[0\]: index returned 400 \_index: transactions-es-nfnxl530-20200911 \_type: \_doc \_id: 909090892 \_version: 0 error: Type: validation\_exception Reason: Validation Failed: 1: this action would add … --- ## [Elasticsearch group by, having and pagenation](https://discuss.elastic.co/t/elasticsearch-group-by-having-and-pagenation/248251)
**Author:** [@coolyrat](https://discuss.elastic.co/u/coolyrat)\ **Replies:** 0\ **Last updated:** [September 11, 2020, 2:24am UTC](https://discuss.elastic.co/t/elasticsearch-group-by-having-and-pagenation/248251 "2020-09-11T02:24:42Z")
I have a SQL that would like to query the same result set in ES. The result set would need to pagination. So I've tried Composite aggregation, it works fine for pagination and order. But I have no idea how to filter with… --- ## [Index Allocation based on attribute not working](https://discuss.elastic.co/t/index-allocation-based-on-attribute-not-working/248147)
**Author:** [@gruselglatz](https://discuss.elastic.co/u/gruselglatz)\ **Replies:** 9\ **Last updated:** [September 11, 2020, 6:25am UTC](https://discuss.elastic.co/t/index-allocation-based-on-attribute-not-working/248147 "2020-09-11T06:25:38Z")
Hi! Can someone pls explain to me why some shards dont get relocated to the correct node in my cluster? I want no shard on node-4 at the moment. Infos: GET \_cat/nodeattrs node-4 172.21.2.174 172.21.2.174 ml.machine\_m… --- ## [What is elasticsearch xpack? it is available for all elasticsearch versions ? example 4](https://discuss.elastic.co/t/what-is-elasticsearch-xpack-it-is-available-for-all-elasticsearch-versions-example-4/248262)
**Author:** [@muthug](https://discuss.elastic.co/u/muthug)\ **Replies:** 1\ **Last updated:** [September 11, 2020, 5:26am UTC](https://discuss.elastic.co/t/what-is-elasticsearch-xpack-it-is-available-for-all-elasticsearch-versions-example-4/248262 "2020-09-11T05:26:17Z")
what is elasticsearch xpack? it is available for all elasticsearch versions ? example version 4.2 Kibana 4.2 --- ## [Documents with duplicate \_id in an index split by time?](https://discuss.elastic.co/t/documents-with-duplicate-id-in-an-index-split-by-time/248260)
**Author:** [@mykael](https://discuss.elastic.co/u/mykael)\ **Replies:** 1\ **Last updated:** [September 11, 2020, 5:05am UTC](https://discuss.elastic.co/t/documents-with-duplicate-id-in-an-index-split-by-time/248260 "2020-09-11T05:05:10Z")
Might just be me misunderstanding how ids and indexing work here. I've got a stream of records and I write them to an index - my\_data Now, to keep it manigable, because there are lots of records, I'm telling logstash t… --- ## [Elastic NEST attribute mapping for multiple fields](https://discuss.elastic.co/t/elastic-nest-attribute-mapping-for-multiple-fields/247542)
**Author:** [@user7](https://discuss.elastic.co/u/user7)\ **Replies:** 1\ **Last updated:** [September 11, 2020, 3:18am UTC](https://discuss.elastic.co/t/elastic-nest-attribute-mapping-for-multiple-fields/247542 "2020-09-11T03:18:12Z")
I have an alias on two very large indices that have many common properties. The property names on the indices have however different naming conventions. For example: "index1" : { "mappings" : { "X" : { … --- ## [Most efficient way to search an array for a value (Painless)](https://discuss.elastic.co/t/most-efficient-way-to-search-an-array-for-a-value-painless/248247)
**Author:** [@emarthinsen](https://discuss.elastic.co/u/emarthinsen)\ **Replies:** 0\ **Last updated:** [September 10, 2020, 10:51pm UTC](https://discuss.elastic.co/t/most-efficient-way-to-search-an-array-for-a-value-painless/248247 "2020-09-10T22:51:14Z")
I wrote a script for generating a calculated field. It's written in Painless. I'm adding a feature to it where I need to see if an array that is on the document has a value in it. The property in the document is called c… --- ## [License Elasticsearch 8.x nodes](https://discuss.elastic.co/t/license-elasticsearch-8-x-nodes/248244)
**Author:** [@mv\_guy](https://discuss.elastic.co/u/mv_guy)\ **Replies:** 1\ **Last updated:** [September 10, 2020, 10:36pm UTC](https://discuss.elastic.co/t/license-elasticsearch-8-x-nodes/248244 "2020-09-10T22:36:49Z")
Hi, We recently purchased a 3 node Premium license for our work environment. I'm planning on running the newest 8.x stack, however when attempting to update the license, only up to 7.x is available to be downloaded/used… --- ## [Best practices for validating elasticsearch snapshots](https://discuss.elastic.co/t/best-practices-for-validating-elasticsearch-snapshots/248240)
**Author:** [@proton](https://discuss.elastic.co/u/proton)\ **Replies:** 0\ **Last updated:** [September 10, 2020, 9:54pm UTC](https://discuss.elastic.co/t/best-practices-for-validating-elasticsearch-snapshots/248240 "2020-09-10T21:54:12Z")
We used verify the snapshots on daily bases to make sure they are in good state i.e has no corrupted data. We do this by spinning up a new cluster and restoring it to validate the we have at least one good snapshot. How… --- ## [Best practices to auto-update html table from elasticsearch server](https://discuss.elastic.co/t/best-practices-to-auto-update-html-table-from-elasticsearch-server/247980)
**Author:** [@pastoreerrante](https://discuss.elastic.co/u/pastoreerrante)\ **Replies:** 1\ **Last updated:** [September 10, 2020, 8:09pm UTC](https://discuss.elastic.co/t/best-practices-to-auto-update-html-table-from-elasticsearch-server/247980 "2020-09-10T20:09:24Z")
Hi there, I'm trying to build a simple event visualization web-dashboard based on elasticsearch. Diagram: browser --- web framework (node.js api layer) --- elasticsearch Basically, I'll have a lot of network-applianc… --- ## [Red cluster status master not discovered exception](https://discuss.elastic.co/t/red-cluster-status-master-not-discovered-exception/248142)
**Author:** [@mohitchavda](https://discuss.elastic.co/u/mohitchavda)\ **Replies:** 1\ **Last updated:** [September 10, 2020, 8:08pm UTC](https://discuss.elastic.co/t/red-cluster-status-master-not-discovered-exception/248142 "2020-09-10T20:08:20Z")
we have facing issues of red cluster status and out of 3, only 1 node is visible. before that, we have t2.small instance and to resolve the red cluster status, we have upgrade instance type t2.medium still, clusters ar… --- ## [Is there a way to query elasticsearch index using timeuuid functionality?](https://discuss.elastic.co/t/is-there-a-way-to-query-elasticsearch-index-using-timeuuid-functionality/248033)
**Author:** [@Kyle\_Neal](https://discuss.elastic.co/u/Kyle_Neal)\ **Replies:** 1\ **Last updated:** [September 10, 2020, 8:06pm UTC](https://discuss.elastic.co/t/is-there-a-way-to-query-elasticsearch-index-using-timeuuid-functionality/248033 "2020-09-10T20:06:34Z")
I have an elasticsearch index that is holding a timeuuid field that originally comes from cassandra. The type is keyword and it's named event\_ts. Is it even possible to search elasticsearch index using timeuuid functiona… --- ## [Searching and indexing priority](https://discuss.elastic.co/t/searching-and-indexing-priority/248166)
**Author:** [@ssiws](https://discuss.elastic.co/u/ssiws)\ **Replies:** 1\ **Last updated:** [September 10, 2020, 7:56pm UTC](https://discuss.elastic.co/t/searching-and-indexing-priority/248166 "2020-09-10T19:56:11Z")
Hello, generally speaking, how does Elasticsearch handles searching "priority" while indexing ? I noticed that when someone performs a query with a timerange of multiple weeks, indexing almost halts while the query is … --- ## [Delete index command from kibana not working](https://discuss.elastic.co/t/delete-index-command-from-kibana-not-working/248215)
**Author:** [@baidwan007](https://discuss.elastic.co/u/baidwan007)\ **Replies:** 2\ **Last updated:** [September 10, 2020, 6:32pm UTC](https://discuss.elastic.co/t/delete-index-command-from-kibana-not-working/248215 "2020-09-10T18:32:42Z")
I am running DELETE /\ command from kibana. I get acknowledged:true response from kibana but Instead of the index getting deleted, i see that a replica shard appears instead while the primary index also stays.… --- ## [Mapping fields cannot be replaced during template composition](https://discuss.elastic.co/t/mapping-fields-cannot-be-replaced-during-template-composition/248217)
**Author:** [@Lolo\_Bee](https://discuss.elastic.co/u/Lolo_Bee)\ **Replies:** 0\ **Last updated:** [September 10, 2020, 6:18pm UTC](https://discuss.elastic.co/t/mapping-fields-cannot-be-replaced-during-template-composition/248217 "2020-09-10T18:18:47Z")
Hi, I'm trying to setup a template index composed of some component templates. One of the component templates creates new fields mapping on an existing object, and this raises the following error "mapping fields \[tcp\] c… --- ## [Efficient way to sort by different fields by client](https://discuss.elastic.co/t/efficient-way-to-sort-by-different-fields-by-client/248206)
**Author:** [@taichi](https://discuss.elastic.co/u/taichi)\ **Replies:** 0\ **Last updated:** [September 10, 2020, 4:48pm UTC](https://discuss.elastic.co/t/efficient-way-to-sort-by-different-fields-by-client/248206 "2020-09-10T16:48:17Z")
I have an index named items . And we have many stores (now around 100, and in the future it may be 10,000) . Each item has a price for each store. So item document may look like this: { "item\_id": 1, "description":… --- ## [Elasticsearch(7.8) NEST(C#) aggregations](https://discuss.elastic.co/t/elasticsearch-7-8-nest-c-aggregations/248094)
**Author:** [@Joseph\_Tucci](https://discuss.elastic.co/u/Joseph_Tucci)\ **Replies:** 1\ **Last updated:** [September 10, 2020, 4:14pm UTC](https://discuss.elastic.co/t/elasticsearch-7-8-nest-c-aggregations/248094 "2020-09-10T16:14:47Z")
document count ~10 billion documents elastics disk usage ~2TB elasticsearch 7.8 via NEST/C# api. my model is a transaction receipt. a simplified schema \[keyword\] string customer\_id { get; set; } //cardinality 100M \[k… --- ## [Suggestions for person names doens't work so well](https://discuss.elastic.co/t/suggestions-for-person-names-doenst-work-so-well/248035)
**Author:** [@Daniele\_Renda](https://discuss.elastic.co/u/Daniele_Renda)\ **Replies:** 4\ **Last updated:** [September 10, 2020, 4:08pm UTC](https://discuss.elastic.co/t/suggestions-for-person-names-doenst-work-so-well/248035 "2020-09-10T16:08:18Z")
Hi guys, I know that this use case is quite common but I'm a bit confused after I've read several tutorials and docs. In my application I'm trying to help the user when he digits a person's name in the form. I'd like t… --- ## [Elasticsearch vertical clustering](https://discuss.elastic.co/t/elasticsearch-vertical-clustering/248006)
**Author:** [@cham](https://discuss.elastic.co/u/cham)\ **Replies:** 4\ **Last updated:** [September 10, 2020, 3:50pm UTC](https://discuss.elastic.co/t/elasticsearch-vertical-clustering/248006 "2020-09-10T15:50:51Z")
Hi, We are setting up ES cluster in our env and have 2 concerns. Is it advisable to do vertical clustering (putting more than one node per server) is it possible to move the elasticsearch.yml configuration file to a s… --- ## [Synonym graph filterにてエラーの出る単語を一括検知に関して](https://discuss.elastic.co/t/synonym-graph-filter/248196)
**Author:** [@nuko](https://discuss.elastic.co/u/nuko)\ **Replies:** 0\ **Last updated:** [September 10, 2020, 3:15pm UTC](https://discuss.elastic.co/t/synonym-graph-filter/248196 "2020-09-10T15:15:17Z")
kuromoji\_tokenizerを "search"モードで指定して、 synonym graph filterを使用している場合、 辞書に入ってない単語をシノニムとして指定すると、 シノニムファイルのロード時に、下記のようなレスポンスとなります。 （ POST /indexname/\_reload\_search\_analyzers でリロードをかけています） { "error" : { "root\_caus… --- ## [Index rollover given an error for alias](https://discuss.elastic.co/t/index-rollover-given-an-error-for-alias/246049)
**Author:** [@jijo.john](https://discuss.elastic.co/u/jijo.john)\ **Replies:** 6\ **Last updated:** [September 10, 2020, 2:55pm UTC](https://discuss.elastic.co/t/index-rollover-given-an-error-for-alias/246049 "2020-09-10T14:55:13Z")
Hi Team, Kindly help us to resolve below error which we are receiving for our custom index created from filebeat cisco asa module. illegal\_argument\_exception: index.lifecycle.rollover\_alias \[ciscobeat-7.6.2\] does not … --- ## [When using SQL, the IN statement does not work in the SELECT section of a query](https://discuss.elastic.co/t/when-using-sql-the-in-statement-does-not-work-in-the-select-section-of-a-query/247118)
**Author:** [@meadows.120](https://discuss.elastic.co/u/meadows.120)\ **Replies:** 2\ **Last updated:** [September 10, 2020, 2:47pm UTC](https://discuss.elastic.co/t/when-using-sql-the-in-statement-does-not-work-in-the-select-section-of-a-query/247118 "2020-09-10T14:47:09Z")
ES Version: 7.8 I’m trying to run the following in SQL Workbench, and one query works, but the other one does not…any thoughts? Successful: SELECT \* FROM my\_index WHERE a.b IN ('115') Failure: SELECT a.b IN … --- ## [Index pattern type in Elasticsearch](https://discuss.elastic.co/t/index-pattern-type-in-elasticsearch/248183)
**Author:** [@Ganesh2303](https://discuss.elastic.co/u/Ganesh2303)\ **Replies:** 2\ **Last updated:** [September 10, 2020, 2:27pm UTC](https://discuss.elastic.co/t/index-pattern-type-in-elasticsearch/248183 "2020-09-10T14:27:33Z")
HI Team, I would like to take some suggestion to create index pattern in ELK. As per my current configuration in production, i'm index data in ES by monthly index with 1 Primary Shard and 2 replicas. Due to that i was… --- ## [Comparison of two lists in Elsticsearch](https://discuss.elastic.co/t/comparison-of-two-lists-in-elsticsearch/248182)
**Author:** [@rohitarorait82](https://discuss.elastic.co/u/rohitarorait82)\ **Replies:** 0\ **Last updated:** [September 10, 2020, 1:43pm UTC](https://discuss.elastic.co/t/comparison-of-two-lists-in-elsticsearch/248182 "2020-09-10T13:43:44Z")
Hi All, I am new to ELK and facing issues with below scenario. I am trying to compare two lists, listA and listB. This should provide a list of numbers which are present in listB but are not there in listA. I have wri… --- ## [Sql Query vs Dsl Query](https://discuss.elastic.co/t/sql-query-vs-dsl-query/247048)
**Author:** [@Nupur](https://discuss.elastic.co/u/Nupur)\ **Replies:** 2\ **Last updated:** [September 10, 2020, 1:32pm UTC](https://discuss.elastic.co/t/sql-query-vs-dsl-query/247048 "2020-09-10T13:32:07Z")
querying through sql access api or querying through dsl .. which is faster in searching . Is there is performance difference in both. --- ## [Composite Aggregation Sorting Based on Field Which is Not Key](https://discuss.elastic.co/t/composite-aggregation-sorting-based-on-field-which-is-not-key/248146)
**Author:** [@mstzn](https://discuss.elastic.co/u/mstzn)\ **Replies:** 3\ **Last updated:** [September 10, 2020, 1:07pm UTC](https://discuss.elastic.co/t/composite-aggregation-sorting-based-on-field-which-is-not-key/248146 "2020-09-10T13:07:17Z")
Hello Everyone, I have a composite aggregation which aggregate bucket based on a term field like number field. Composite aggregation orders buckets by natural order of key. I want to order buckets based on max date on … --- ## [Time entry in Index different from application](https://discuss.elastic.co/t/time-entry-in-index-different-from-application/248161)
**Author:** [@fastxl](https://discuss.elastic.co/u/fastxl)\ **Replies:** 0\ **Last updated:** [September 10, 2020, 11:49am UTC](https://discuss.elastic.co/t/time-entry-in-index-different-from-application/248161 "2020-09-10T11:49:55Z")
I am trying to learn Elasticsearch and I have made a Python script that will send data to an index. One of the things I am sending is the date/time. The format of the date/time in my output is 'date': '2020-09-10T06:45… --- ## [Not able to view the index in elastic search and kibana](https://discuss.elastic.co/t/not-able-to-view-the-index-in-elastic-search-and-kibana/248157)
**Author:** [@Jaya\_chandra](https://discuss.elastic.co/u/Jaya_chandra)\ **Replies:** 0\ **Last updated:** [September 10, 2020, 11:38am UTC](https://discuss.elastic.co/t/not-able-to-view-the-index-in-elastic-search-and-kibana/248157 "2020-09-10T11:38:18Z")
Hi, I am trying to import the s3 data from aws to logstash. However, when i look at elastic search/kibana i am not able to find the index. Below is my configuration details of logstash: input { s3 { "access\_key\_id" … --- ## [Retain long data type value in SQL output](https://discuss.elastic.co/t/retain-long-data-type-value-in-sql-output/246997)
**Author:** [@askids](https://discuss.elastic.co/u/askids)\ **Replies:** 1\ **Last updated:** [September 10, 2020, 11:01am UTC](https://discuss.elastic.co/t/retain-long-data-type-value-in-sql-output/246997 "2020-09-10T11:01:28Z")
hi, I am trying to get min value of an attribute using SQL api. My query looks like this SELECT MIN(attr1) as min\_val from index\_name However, in the output, the value is getting converted to scientific value and is l… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=811) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=813)