# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=817 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 818 --- ## [Does watcher support EQL or KQL or eSQL?](https://discuss.elastic.co/t/does-watcher-support-eql-or-kql-or-esql/247596)
**Author:** [@kelk](https://discuss.elastic.co/u/kelk)\ **Replies:** 1\ **Last updated:** [September 4, 2020, 9:04pm UTC](https://discuss.elastic.co/t/does-watcher-support-eql-or-kql-or-esql/247596 "2020-09-04T21:04:51Z")
Does watcher support EQL or SQL type syntax? it is too complex to understand DSL if someone else have written it in watcher and it recurses on and on :frowning: in DSL if watcher doesn't support a simplified language, W… --- ## [How to update Lucene version of an huge indices?](https://discuss.elastic.co/t/how-to-update-lucene-version-of-an-huge-indices/247460)
**Author:** [@Thek10patil](https://discuss.elastic.co/u/Thek10patil)\ **Replies:** 5\ **Last updated:** [September 4, 2020, 8:44pm UTC](https://discuss.elastic.co/t/how-to-update-lucene-version-of-an-huge-indices/247460 "2020-09-04T20:44:19Z")
Hello Geeks, I have 10 indices of 2 TB size each on ES 7.7 version. Lucene version of those indices is around 7.x. I want to update Lucene version of these indices to latest version that is 8.5? I am aware of following… --- ## [Machine learning typical value not set at the moment of firing watcher Part 2](https://discuss.elastic.co/t/machine-learning-typical-value-not-set-at-the-moment-of-firing-watcher-part-2/246933)
**Author:** [@Josip\_Cagalj](https://discuss.elastic.co/u/Josip_Cagalj)\ **Replies:** 6\ **Last updated:** [September 4, 2020, 7:57pm UTC](https://discuss.elastic.co/t/machine-learning-typical-value-not-set-at-the-moment-of-firing-watcher-part-2/246933 "2020-09-04T19:57:16Z")
Hi, this thread is a continuation of the previous thread which was closed due to inactivity and can be found here I urge you to visit it. Back at that time, I couldn't provide more info (watcher execution data, etc.) b… --- ## [Elasticsearch not able to see all the indices](https://discuss.elastic.co/t/elasticsearch-not-able-to-see-all-the-indices/247590)
**Author:** [@anantvir](https://discuss.elastic.co/u/anantvir)\ **Replies:** 1\ **Last updated:** [September 4, 2020, 7:39pm UTC](https://discuss.elastic.co/t/elasticsearch-not-able-to-see-all-the-indices/247590 "2020-09-04T19:39:30Z")
I am using an index file which looks like '9L9\_imsWTYO3-1p9y0MtKg' from some one else's elastic index and trying to put the file in 'elasticsearch\\data\\nodes\\0\\indices'. But my elasticsearch cannot read that particular i… --- ## [Elasticsearch cluster in Yellow state and 1 Unassigned Shard](https://discuss.elastic.co/t/elasticsearch-cluster-in-yellow-state-and-1-unassigned-shard/247290)
**Author:** [@zaeemmasood](https://discuss.elastic.co/u/zaeemmasood)\ **Replies:** 26\ **Last updated:** [September 4, 2020, 7:00pm UTC](https://discuss.elastic.co/t/elasticsearch-cluster-in-yellow-state-and-1-unassigned-shard/247290 "2020-09-04T19:00:13Z")
Hi All, I am running ELK 7.6.2 stack. Recently the cluster state went "Yellow" and it started showing one Unassigned Shard. Please see below: { "cluster\_name" : "elkcluster-prod", "status" : "yellow", "timed\_ou… --- ## [Memory issues and Query Limitations](https://discuss.elastic.co/t/memory-issues-and-query-limitations/247451)
**Author:** [@fallenreaper](https://discuss.elastic.co/u/fallenreaper)\ **Replies:** 2\ **Last updated:** [September 4, 2020, 6:15pm UTC](https://discuss.elastic.co/t/memory-issues-and-query-limitations/247451 "2020-09-04T18:15:00Z")
Optimizing my system Step by Step, starting from 1 master-slave node. I noticed 2 problems I was having. 1) Queries would start to time out due to the size of my cluster and 2) With Ingestion, it seems that shards woul… --- ## [Elastic-Agent No Index/Data](https://discuss.elastic.co/t/elastic-agent-no-index-data/247431)
**Author:** [@crazedmeph](https://discuss.elastic.co/u/crazedmeph)\ **Replies:** 8\ **Last updated:** [September 4, 2020, 4:34pm UTC](https://discuss.elastic.co/t/elastic-agent-no-index-data/247431 "2020-09-04T16:34:43Z")
I am trying to test out this ingestion manager and i enrolled a agent that is doing metrics and nginx and i never seem to get any new indicies that have 7.9. I go through kibana -\> Stack management -\> Index Management -\> … --- ## [Parser exception when use "include\_upper":true in date range query](https://discuss.elastic.co/t/parser-exception-when-use-include-upper-true-in-date-range-query/247428)
**Author:** [@silvina](https://discuss.elastic.co/u/silvina)\ **Replies:** 4\ **Last updated:** [September 4, 2020, 3:39pm UTC](https://discuss.elastic.co/t/parser-exception-when-use-include-upper-true-in-date-range-query/247428 "2020-09-04T15:39:14Z")
Hi, I get parse\_exception when I try to do this query: { "from":0, "size":999, "query":{ "bool":{ "filter":\[ { "r… --- ## [Email Connector in Elastic Cloud](https://discuss.elastic.co/t/email-connector-in-elastic-cloud/246331)
**Author:** [@Kirtash](https://discuss.elastic.co/u/Kirtash)\ **Replies:** 3\ **Last updated:** [September 4, 2020, 3:23pm UTC](https://discuss.elastic.co/t/email-connector-in-elastic-cloud/246331 "2020-09-04T15:23:49Z")
Good morning, I'm using the elastic cloud and I would like configure the email alerts when I detect errors using the APM. I configured the watcher using my email in the whitelist and it works, the first question is: Is… --- ## [V8 - breaking changes - dangling indexes?](https://discuss.elastic.co/t/v8-breaking-changes-dangling-indexes/247551)
**Author:** [@ethrbunny](https://discuss.elastic.co/u/ethrbunny)\ **Replies:** 0\ **Last updated:** [September 4, 2020, 1:49pm UTC](https://discuss.elastic.co/t/v8-breaking-changes-dangling-indexes/247551 "2020-09-04T13:49:17Z")
Upgraded to 7.9.1 this morning and had a bit of a shock when my data wasn't reloading. Finally RTFM and saw the note about dangling indexes no longer reloaded by default. Oh boy. Anyway - when v8 rolls around - how are … --- ## [Doc\_count is not returning for the index in "multi index approach" if no data present in that index](https://discuss.elastic.co/t/doc-count-is-not-returning-for-the-index-in-multi-index-approach-if-no-data-present-in-that-index/247539)
**Author:** [@Muna](https://discuss.elastic.co/u/Muna)\ **Replies:** 0\ **Last updated:** [September 4, 2020, 12:56pm UTC](https://discuss.elastic.co/t/doc-count-is-not-returning-for-the-index-in-multi-index-approach-if-no-data-present-in-that-index/247539 "2020-09-04T12:56:03Z")
Hi, In case of multi Index approach, if the data for the specific index is not present in the Elastic \[index is empty\]. while doing the aggregation in multi index it should return at least doc\_count as '0' . tried solu… --- ## [Deploy elastic-agent with cert?](https://discuss.elastic.co/t/deploy-elastic-agent-with-cert/247397)
**Author:** [@elk6](https://discuss.elastic.co/u/elk6)\ **Replies:** 5\ **Last updated:** [September 4, 2020, 11:29am UTC](https://discuss.elastic.co/t/deploy-elastic-agent-with-cert/247397 "2020-09-04T11:29:05Z")
I'm trying to deploy the agent but my kibana instance requires a certificate which won't let me connect to it. Is there a way to give it a certificate or another way around this? fail to enroll: fail to execute request … --- ## [How to get position of matched token](https://discuss.elastic.co/t/how-to-get-position-of-matched-token/247521)
**Author:** [@drewblin](https://discuss.elastic.co/u/drewblin)\ **Replies:** 0\ **Last updated:** [September 4, 2020, 11:02am UTC](https://discuss.elastic.co/t/how-to-get-position-of-matched-token/247521 "2020-09-04T11:02:29Z")
Hi I want to migrate from Sphinxsearch to Elastic. But have task, that i don't know how to solve in elastic. I have documents with 2 fields. First field - "title". It is array of words. And each word can have some syn… --- ## [Average Aggregation over two fields](https://discuss.elastic.co/t/average-aggregation-over-two-fields/247516)
**Author:** [@Daniel\_Garcia](https://discuss.elastic.co/u/Daniel_Garcia)\ **Replies:** 0\ **Last updated:** [September 4, 2020, 10:14am UTC](https://discuss.elastic.co/t/average-aggregation-over-two-fields/247516 "2020-09-04T10:14:10Z")
What I would like to achieve is, given this type of docs: { "my\_index": { "mappings": { "result": { "dynamic": "false", "\_all": { "enabled": false … --- ## [Elasticsearch failed to start](https://discuss.elastic.co/t/elasticsearch-failed-to-start/247409)
**Author:** [@Bigranawab](https://discuss.elastic.co/u/Bigranawab)\ **Replies:** 7\ **Last updated:** [September 4, 2020, 8:57am UTC](https://discuss.elastic.co/t/elasticsearch-failed-to-start/247409 "2020-09-04T08:57:47Z")
Hi, My elasticsearch instance was working just fine, I made some changes to elasticsearch.yml file for email setting and restarted service, but elasticsearch failed to start and I could not even connect to elasticsearch… --- ## [Ingesting Data via Python to Elastic](https://discuss.elastic.co/t/ingesting-data-via-python-to-elastic/247230)
**Author:** [@Rahul0711](https://discuss.elastic.co/u/Rahul0711)\ **Replies:** 5\ **Last updated:** [September 4, 2020, 8:52am UTC](https://discuss.elastic.co/t/ingesting-data-via-python-to-elastic/247230 "2020-09-04T08:52:14Z")
Hello Team I need help in ingesting the data via python into elastic. I have a cert that I have already uploaded the cert on the browser. After pre-processing is completed, I converted dataframe into dict. Now I want to… --- ## [Where Elasticsearch stores kibana users?](https://discuss.elastic.co/t/where-elasticsearch-stores-kibana-users/247475)
**Author:** [@recordable542](https://discuss.elastic.co/u/recordable542)\ **Replies:** 3\ **Last updated:** [September 4, 2020, 8:41am UTC](https://discuss.elastic.co/t/where-elasticsearch-stores-kibana-users/247475 "2020-09-04T08:41:49Z")
I'm Investigating peculiar behavior which kibana lose connection after a few day after installation (It connects well to elasticsearch right after the installation) My Environment: ECK (kubernetes). What I did: I fi… --- ## [ElasticsearchError error=“400 - Rejected by Elasticsearch](https://discuss.elastic.co/t/elasticsearcherror-error-400-rejected-by-elasticsearch/247477)
**Author:** [@akhinair](https://discuss.elastic.co/u/akhinair)\ **Replies:** 1\ **Last updated:** [September 4, 2020, 5:37am UTC](https://discuss.elastic.co/t/elasticsearcherror-error-400-rejected-by-elasticsearch/247477 "2020-09-04T05:37:25Z")
I am using EFK stack in my GKE cluster and recently i observed below errors in my fluentd logs. This has started after adding new data point for geopoint in the fluentd. can somebody please help on this? 2020-09-03 16… --- ## [Dot replace is not working](https://discuss.elastic.co/t/dot-replace-is-not-working/247481)
**Author:** [@KrishK](https://discuss.elastic.co/u/KrishK)\ **Replies:** 0\ **Last updated:** [September 4, 2020, 5:15am UTC](https://discuss.elastic.co/t/dot-replace-is-not-working/247481 "2020-09-04T05:15:19Z")
Hi Support, I have below configuration for index. PUT dottest { "settings":{ "index" : { "number\_of\_shards" : 1, "number\_of\_replicas" : 0 }, "analysis": { "analyzer": { "splchar\_analyzer": { "tokenizer": "st… --- ## [Security\_exception: action \[indices:admin/rollover\] is unauthorized for user](https://discuss.elastic.co/t/security-exception-action-indices-admin-rollover-is-unauthorized-for-user/245593)
**Author:** [@hendry.lim](https://discuss.elastic.co/u/hendry.lim)\ **Replies:** 4\ **Last updated:** [September 4, 2020, 2:58am UTC](https://discuss.elastic.co/t/security-exception-action-indices-admin-rollover-is-unauthorized-for-user/245593 "2020-09-04T02:58:16Z")
Elasticsearch: 7.9.0 Kibana: 7.9.0 I am hitting the issue described in #47500. I believe the same issue has been raised a few times. However, adding manage privilege on the index level for the role does not seem to wo… --- ## [Es forcemerge question](https://discuss.elastic.co/t/es-forcemerge-question/247467)
**Author:** [@taidengpub](https://discuss.elastic.co/u/taidengpub)\ **Replies:** 4\ **Last updated:** [September 4, 2020, 2:29am UTC](https://discuss.elastic.co/t/es-forcemerge-question/247467 "2020-09-04T02:29:52Z")
i use ilm to run forcemerge with max\_num\_segments=5 and this index have 5shard a one replication,so it have 10 shards total "warm": { "min\_age": "25h", "actions": { … --- ## [Disk space problem for ELK stack running in an azure VM](https://discuss.elastic.co/t/disk-space-problem-for-elk-stack-running-in-an-azure-vm/247330)
**Author:** [@Rowshan\_Sathi](https://discuss.elastic.co/u/Rowshan_Sathi)\ **Replies:** 1\ **Last updated:** [September 4, 2020, 12:50am UTC](https://discuss.elastic.co/t/disk-space-problem-for-elk-stack-running-in-an-azure-vm/247330 "2020-09-04T00:50:03Z")
Hi, I have installed ELK stack on Azure VM. The details of my system- Ubuntu 18.04 ELasticsearch- 7.8.1 I have configured curator script and runing it every morning and also I am clearing logs according to its size b… --- ## [\_cat/indices response explanation for replica shards](https://discuss.elastic.co/t/cat-indices-response-explanation-for-replica-shards/247447)
**Author:** [@sha1](https://discuss.elastic.co/u/sha1)\ **Replies:** 2\ **Last updated:** [September 4, 2020, 12:14am UTC](https://discuss.elastic.co/t/cat-indices-response-explanation-for-replica-shards/247447 "2020-09-04T00:14:00Z")
The \_cat/indices endpoint returns primary shard count and replica factor, e.g. health status index uuid pri rep docs.count docs.deleted store.size pri.store.size yellow open hioqq… --- ## [Illegal\_argument\_exception: index.lifecycle.rollover\_alias does not point to index](https://discuss.elastic.co/t/illegal-argument-exception-index-lifecycle-rollover-alias-does-not-point-to-index/247089)
**Author:** [@sgreszcz](https://discuss.elastic.co/u/sgreszcz)\ **Replies:** 5\ **Last updated:** [September 3, 2020, 11:50pm UTC](https://discuss.elastic.co/t/illegal-argument-exception-index-lifecycle-rollover-alias-does-not-point-to-index/247089 "2020-09-03T23:50:17Z")
Hi there, I am getting ILM errors on all of my indexes. For example: illegal\_argument\_exception: index.lifecycle.rollover\_alias \[ucv-voice-events-cube\] does not point to index \[ucv-voice-events-cube-2020.08.28\] In my… --- ## [Force\_merge Thread\_pool](https://discuss.elastic.co/t/force-merge-thread-pool/245108)
**Author:** [@Thek10patil](https://discuss.elastic.co/u/Thek10patil)\ **Replies:** 8\ **Last updated:** [September 3, 2020, 10:40pm UTC](https://discuss.elastic.co/t/force-merge-thread-pool/245108 "2020-09-03T22:40:46Z")
Hi Everyone, I need to run force\_merge frequently to have max\_num\_segments = 1. It takes lot of time. I want to make force\_merge faster. What are the possible option do I have? I read and found that max size of threads… --- ## [Elasticsearch to get the content length](https://discuss.elastic.co/t/elasticsearch-to-get-the-content-length/247417)
**Author:** [@EvelynC](https://discuss.elastic.co/u/EvelynC)\ **Replies:** 0\ **Last updated:** [September 3, 2020, 3:27pm UTC](https://discuss.elastic.co/t/elasticsearch-to-get-the-content-length/247417 "2020-09-03T15:27:05Z")
Hi all, I was getting back the error saying "content length is too long for configured buffer limit (104857600)" in production environment. But when I try to reproduce the issue, it is not reproducible in lower environ… --- ## [Elasticsearch NEST client copatibilty](https://discuss.elastic.co/t/elasticsearch-nest-client-copatibilty/247430)
**Author:** [@Ayoub96](https://discuss.elastic.co/u/Ayoub96)\ **Replies:** 1\ **Last updated:** [September 3, 2020, 7:48pm UTC](https://discuss.elastic.co/t/elasticsearch-nest-client-copatibilty/247430 "2020-09-03T19:48:01Z")
Hello, According to the NEST matrix compatibility https://github.com/elastic/elasticsearch-net/blob/master/readme.md#compatibility-matrix, i'm having some troubles!, we worked for a long time with NEST 2.5 client & Elas… --- ## [Rollover alias with date does not put the right date](https://discuss.elastic.co/t/rollover-alias-with-date-does-not-put-the-right-date/247273)
**Author:** [@pingz](https://discuss.elastic.co/u/pingz)\ **Replies:** 4\ **Last updated:** [September 3, 2020, 6:37pm UTC](https://discuss.elastic.co/t/rollover-alias-with-date-does-not-put-the-right-date/247273 "2020-09-03T18:37:52Z")
Hi: I need to have a new index every day with the myindex + datetime (myindex-YYYY.MM.DD). I created an index with initial name myindex-2020.09.01-000001. index\_body = { "aliases": { "myindex": {… --- ## [Optimization of Elasticsearch Based on different Parameters and Techniques](https://discuss.elastic.co/t/optimization-of-elasticsearch-based-on-different-parameters-and-techniques/247432)
**Author:** [@Yashasvi\_Raj\_Pant](https://discuss.elastic.co/u/Yashasvi_Raj_Pant)\ **Replies:** 0\ **Last updated:** [September 3, 2020, 6:21pm UTC](https://discuss.elastic.co/t/optimization-of-elasticsearch-based-on-different-parameters-and-techniques/247432 "2020-09-03T18:21:55Z")
I am planning to pursue my master thesis researching about different parameters and techniques that can affect the Elasticsearch performance. Can somebody guide me to the quality research materials/papers I can refer to… --- ## [7.9 Watcher bug - Cannot save Watchers with an index set via a transform](https://discuss.elastic.co/t/7-9-watcher-bug-cannot-save-watchers-with-an-index-set-via-a-transform/247136)
**Author:** [@jessvin.thomas](https://discuss.elastic.co/u/jessvin.thomas)\ **Replies:** 1\ **Last updated:** [September 3, 2020, 4:41pm UTC](https://discuss.elastic.co/t/7-9-watcher-bug-cannot-save-watchers-with-an-index-set-via-a-transform/247136 "2020-09-03T16:41:55Z")
I was going to submit this as a confirmed bug, but I figured I would check here first. Anyone notice if I'm doing anything wrong or can reproduce my issue? I'll submit as a bug if no response or if no one finds a mista… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=816) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=818)