# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=818 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 819 --- ## [Separate data stream per customer?](https://discuss.elastic.co/t/separate-data-stream-per-customer/247300)
**Author:** [@Adam\_Wilson](https://discuss.elastic.co/u/Adam_Wilson)\ **Replies:** 10\ **Last updated:** [September 3, 2020, 4:36pm UTC](https://discuss.elastic.co/t/separate-data-stream-per-customer/247300 "2020-09-03T16:36:08Z")
Hello! I'm evaluating whether to use Elasticsearch as an OLAP backend for our Reports+Dashboards feature We have timeseries data that's ingested for different customers The data between these customers is 100% independ… --- ## [Will replica shards in single node cluster consume jvm heap memory](https://discuss.elastic.co/t/will-replica-shards-in-single-node-cluster-consume-jvm-heap-memory/246940)
**Author:** [@divya\_lakshmi](https://discuss.elastic.co/u/divya_lakshmi)\ **Replies:** 7\ **Last updated:** [September 3, 2020, 4:14pm UTC](https://discuss.elastic.co/t/will-replica-shards-in-single-node-cluster-consume-jvm-heap-memory/246940 "2020-09-03T16:14:31Z")
Hi, I am using single node with 8 GB JVM (half of total 16 GB). Total shards = 1951 I know ES will refuse to allocate both the primary shard and a replica shard on the same machine.but is this replica shards consuming… --- ## [Sort result by distance ranges](https://discuss.elastic.co/t/sort-result-by-distance-ranges/247286)
**Author:** [@r3vile](https://discuss.elastic.co/u/r3vile)\ **Replies:** 4\ **Last updated:** [September 3, 2020, 3:05pm UTC](https://discuss.elastic.co/t/sort-result-by-distance-ranges/247286 "2020-09-03T15:05:32Z")
I have a document with many restaurants including their location. Is it possible to get all of them in a 100km range and group them into 3 ranges. So I will first see all which are at max 10km away from my location, sor… --- ## [Cannot parse numeric values in a search template](https://discuss.elastic.co/t/cannot-parse-numeric-values-in-a-search-template/247088)
**Author:** [@mekanix](https://discuss.elastic.co/u/mekanix)\ **Replies:** 1\ **Last updated:** [September 3, 2020, 2:59pm UTC](https://discuss.elastic.co/t/cannot-parse-numeric-values-in-a-search-template/247088 "2020-09-03T14:59:31Z")
Fx. if I take the example from Elasticsearch Reference \[7.9\] » REST APIs » Search APIs » Search Template and render it I get POST \_render/template { "source" : { "query": { "match" : { "{{my\_field}}" : "{{my\_value… --- ## [Elastic watcher, log multiple fields](https://discuss.elastic.co/t/elastic-watcher-log-multiple-fields/247343)
**Author:** [@Abdelhalim](https://discuss.elastic.co/u/Abdelhalim)\ **Replies:** 1\ **Last updated:** [September 3, 2020, 1:44pm UTC](https://discuss.elastic.co/t/elastic-watcher-log-multiple-fields/247343 "2020-09-03T13:44:59Z")
Hello everybody, I just began using elastic watcher to alert when I detect a port scanner (I wanna build my own one to understand how the watcher works that's why I didn't use the one in elastic Github ) so my watcher … --- ## [How to return multiline or long list of values in painless?](https://discuss.elastic.co/t/how-to-return-multiline-or-long-list-of-values-in-painless/247385)
**Author:** [@kelk](https://discuss.elastic.co/u/kelk)\ **Replies:** 0\ **Last updated:** [September 3, 2020, 1:11pm UTC](https://discuss.elastic.co/t/how-to-return-multiline-or-long-list-of-values-in-painless/247385 "2020-09-03T13:11:40Z")
hi, I've quite a large set of key-value fields to return in the transform as below. But I wanted it to look clean and copy-paste friendly, but fails (if I put all into one line it works) "index\_alert": { "tra… --- ## [Index not rolloving over based on any param](https://discuss.elastic.co/t/index-not-rolloving-over-based-on-any-param/247384)
**Author:** [@Pardha\_Saradhi](https://discuss.elastic.co/u/Pardha_Saradhi)\ **Replies:** 0\ **Last updated:** [September 3, 2020, 12:57pm UTC](https://discuss.elastic.co/t/index-not-rolloving-over-based-on-any-param/247384 "2020-09-03T12:57:03Z")
Hi, I am on es 7.9.0. I have created a policy to rollover But its been 29 minutes and the index is still in hot phase. The data has grown to 2.5 GB and docs count is also way above the mentioned limit. This the ou… --- ## [Nodes disabled from Cluster when XPack SSL is enabled](https://discuss.elastic.co/t/nodes-disabled-from-cluster-when-xpack-ssl-is-enabled/247000)
**Author:** [@kkhadka](https://discuss.elastic.co/u/kkhadka)\ **Replies:** 3\ **Last updated:** [September 3, 2020, 11:52am UTC](https://discuss.elastic.co/t/nodes-disabled-from-cluster-when-xpack-ssl-is-enabled/247000 "2020-09-03T11:52:45Z")
I am following the steps given in this Node-1 elasticsearch.yml file cluster.name: as-cluster node.name: as-node1 node.master: true node.data: true network.host: 10.71.34.27 http.port: 9200 discovery.seed\_hosts: \["10.7… --- ## [How to find quorum of the cluster in elasticsearch 7.x](https://discuss.elastic.co/t/how-to-find-quorum-of-the-cluster-in-elasticsearch-7-x/247335)
**Author:** [@bhavya](https://discuss.elastic.co/u/bhavya)\ **Replies:** 4\ **Last updated:** [September 3, 2020, 11:15am UTC](https://discuss.elastic.co/t/how-to-find-quorum-of-the-cluster-in-elasticsearch-7-x/247335 "2020-09-03T11:15:29Z")
I am using Elasticsearch 7.9 version. I want to find the quorum value of my cluster. Before 7.x version, discovery.zen.minimum\_master\_nodes controlled the minimum number of eligible master nodes that a node should “se… --- ## [Cannot connect to elasticsearch but i have connected to kibana](https://discuss.elastic.co/t/cannot-connect-to-elasticsearch-but-i-have-connected-to-kibana/247224)
**Author:** [@talaatkamal](https://discuss.elastic.co/u/talaatkamal)\ **Replies:** 10\ **Last updated:** [September 3, 2020, 10:51am UTC](https://discuss.elastic.co/t/cannot-connect-to-elasticsearch-but-i-have-connected-to-kibana/247224 "2020-09-03T10:51:54Z")
I cannot connect to elasticsearch , when I try to connect it through client winlogbeat , connection refused by server. --- ## [.ml-state too big](https://discuss.elastic.co/t/ml-state-too-big/247366)
**Author:** [@usrigp](https://discuss.elastic.co/u/usrigp)\ **Replies:** 1\ **Last updated:** [September 3, 2020, 10:50am UTC](https://discuss.elastic.co/t/ml-state-too-big/247366 "2020-09-03T10:50:00Z")
Hi We have the index .ml\_state with a size in disk almost 60Gb on disk. Is it possible to purge any data or apply an ILM policy to make rollover? As it is a system index we do not know if it is possible to apply ILM. E… --- ## [Elasticsearch: JSON processor issue in Elastic V7.8.1](https://discuss.elastic.co/t/elasticsearch-json-processor-issue-in-elastic-v7-8-1/247360)
**Author:** [@Hung\_M\_Le](https://discuss.elastic.co/u/Hung_M_Le)\ **Replies:** 0\ **Last updated:** [September 3, 2020, 9:57am UTC](https://discuss.elastic.co/t/elasticsearch-json-processor-issue-in-elastic-v7-8-1/247360 "2020-09-03T09:57:49Z")
Hi I have followed the example outlined inside the document about the JSON processor: https://www.elastic.co/guide/en/elasticsearch/reference/6.8/json-processor.html Here is the code: { "json" : { "field" : "st… --- ## [Use wildcard data type ,The number of events does not match when querying](https://discuss.elastic.co/t/use-wildcard-data-type-the-number-of-events-does-not-match-when-querying/247318)
**Author:** [@woxiang-H](https://discuss.elastic.co/u/woxiang-H)\ **Replies:** 5\ **Last updated:** [September 3, 2020, 10:01am UTC](https://discuss.elastic.co/t/use-wildcard-data-type-the-number-of-events-does-not-match-when-querying/247318 "2020-09-03T10:01:03Z")
I use two field types: text and wildcard to store the same error log. When I query, I find the missing content GET test-wildcard/\_search { "query": { "match": { "json.thrown.stack": "\*invokeWithoutCircuitBre… --- ## [.task index to large](https://discuss.elastic.co/t/task-index-to-large/247352)
**Author:** [@tjmartins](https://discuss.elastic.co/u/tjmartins)\ **Replies:** 0\ **Last updated:** [September 3, 2020, 9:25am UTC](https://discuss.elastic.co/t/task-index-to-large/247352 "2020-09-03T09:25:16Z")
I'm using elasticsearch 5.6.1 and when I list my indexes I have a .task index with almost 80GB. Is there anything I can do to shrink or delete (if possible) this index? Any help please? Best regards, Tiago Martins --- ## [Installer package vs elastic licence](https://discuss.elastic.co/t/installer-package-vs-elastic-licence/247337)
**Author:** [@Adam\_Grabek](https://discuss.elastic.co/u/Adam_Grabek)\ **Replies:** 1\ **Last updated:** [September 3, 2020, 8:42am UTC](https://discuss.elastic.co/t/installer-package-vs-elastic-licence/247337 "2020-09-03T08:42:17Z")
Hi, I would like to ask if what I want to do is not violating elastic licence. Client asked me to create bundled installer package that will utilize available windows installers for elasticsearch, kibana etc. The idea… --- ## [\[Solved\] Rolling upgrade 7.6.1 -\> 7.9.0 suddenly failed on node: Java error?](https://discuss.elastic.co/t/solved-rolling-upgrade-7-6-1-7-9-0-suddenly-failed-on-node-java-error/247217)
**Author:** [@alexolivan](https://discuss.elastic.co/u/alexolivan)\ **Replies:** 4\ **Last updated:** [September 3, 2020, 8:33am UTC](https://discuss.elastic.co/t/solved-rolling-upgrade-7-6-1-7-9-0-suddenly-failed-on-node-java-error/247217 "2020-09-03T08:33:41Z")
Hi... I'm doing a rolling upgrade... overall, never had an issue with this.. The cluster is 7.6.1 and I'm going to latest 7.9.0 All nodes are identical machines: Debian stable machines... so far so good. I tried upgra… --- ## [Set score lower bound](https://discuss.elastic.co/t/set-score-lower-bound/247342)
**Author:** [@Alex\_D](https://discuss.elastic.co/u/Alex_D)\ **Replies:** 0\ **Last updated:** [September 3, 2020, 8:33am UTC](https://discuss.elastic.co/t/set-score-lower-bound/247342 "2020-09-03T08:33:02Z")
Hi all ! I am trying to set score lower bound for query. If I use simple query construction, "min\_score" works properly GET my-index/\_search { "query": { "match": { "textField": "something" } }, "… --- ## [Could not index event to Elasticsearch, mapper \[geoip.location\] of different type](https://discuss.elastic.co/t/could-not-index-event-to-elasticsearch-mapper-geoip-location-of-different-type/247254)
**Author:** [@real\_user](https://discuss.elastic.co/u/real_user)\ **Replies:** 4\ **Last updated:** [September 3, 2020, 8:27am UTC](https://discuss.elastic.co/t/could-not-index-event-to-elasticsearch-mapper-geoip-location-of-different-type/247254 "2020-09-03T08:27:00Z")
Hi All I have configured logstash and elasticsearch v7.8. This is the logstash part geoip { source =\> "\[iis\]\[access\]\[client\_ip\]" } Index template: GET /\_template/iis { "iis" : { "order" : 0, … --- ## [Cron Job Expression to take snapshot in Each 15 Mins](https://discuss.elastic.co/t/cron-job-expression-to-take-snapshot-in-each-15-mins/247334)
**Author:** [@Ayush\_Agrahari](https://discuss.elastic.co/u/Ayush_Agrahari)\ **Replies:** 0\ **Last updated:** [September 3, 2020, 7:35am UTC](https://discuss.elastic.co/t/cron-job-expression-to-take-snapshot-in-each-15-mins/247334 "2020-09-03T07:35:27Z")
Hello, Could you please help me to create Cron Job expression to take snapshot in Each 15 mins in SLM Policy. Currently I am using below format. 'curl -X PUT "localhost:9200/\_slm/policy/policy-name?pretty" -H 'Conten… --- ## [Java version in Elasticsearch 7.8.0](https://discuss.elastic.co/t/java-version-in-elasticsearch-7-8-0/247329)
**Author:** [@pratiksha](https://discuss.elastic.co/u/pratiksha)\ **Replies:** 1\ **Last updated:** [September 3, 2020, 7:04am UTC](https://discuss.elastic.co/t/java-version-in-elasticsearch-7-8-0/247329 "2020-09-03T07:04:21Z")
Elasticsearch 7.8.0 comes with Java 14 and it is build using it. As per the elastic document, we can use our own version of Java and it is recommended to use a supported LTS version of Java. So, we are installing and u… --- ## [Set number of shards of index created by dateindexname processor](https://discuss.elastic.co/t/set-number-of-shards-of-index-created-by-dateindexname-processor/247263)
**Author:** [@matteocalisti](https://discuss.elastic.co/u/matteocalisti)\ **Replies:** 2\ **Last updated:** [September 3, 2020, 6:56am UTC](https://discuss.elastic.co/t/set-number-of-shards-of-index-created-by-dateindexname-processor/247263 "2020-09-03T06:56:25Z")
Hello! I'd like to know if it is possible to set the number of shards of an index created by a dateindexname processor. Right now, my pipeline creates a new index based on a date field, but creates only one primary sha… --- ## [Can we use workload Identity for leasticsearch backup and restore](https://discuss.elastic.co/t/can-we-use-workload-identity-for-leasticsearch-backup-and-restore/247232)
**Author:** [@knagasri](https://discuss.elastic.co/u/knagasri)\ **Replies:** 2\ **Last updated:** [September 3, 2020, 6:33am UTC](https://discuss.elastic.co/t/can-we-use-workload-identity-for-leasticsearch-backup-and-restore/247232 "2020-09-03T06:33:54Z")
Can we use workload Identity instead of creating k8s secrets manually for easticsearch backup and restore for elasticsearch 7.4 --- ## [Elastic search: Regex for matching longest string from list of strings in autocomplete suggester](https://discuss.elastic.co/t/elastic-search-regex-for-matching-longest-string-from-list-of-strings-in-autocomplete-suggester/247322)
**Author:** [@SatyaAditya](https://discuss.elastic.co/u/SatyaAditya)\ **Replies:** 0\ **Last updated:** [September 3, 2020, 3:48am UTC](https://discuss.elastic.co/t/elastic-search-regex-for-matching-longest-string-from-list-of-strings-in-autocomplete-suggester/247322 "2020-09-03T03:48:23Z")
I am very new to elastic search and trying to implement autocomplete suggester with regex queries. Once i receive a query, i am taking last 5 words of query and forming a list of tokens in this format query - i am tryin… --- ## [Snapshot repository encryption with FS type](https://discuss.elastic.co/t/snapshot-repository-encryption-with-fs-type/247323)
**Author:** [@nethisandeep](https://discuss.elastic.co/u/nethisandeep)\ **Replies:** 0\ **Last updated:** [September 3, 2020, 4:03am UTC](https://discuss.elastic.co/t/snapshot-repository-encryption-with-fs-type/247323 "2020-09-03T04:03:35Z")
Any inbuilt functionality that we can use for encrypting elasticsearch snapshot repository using "FS" type? or any other known solutions? May I know in which version of elasticsearch can we see this feature https://gith… --- ## [Security Header](https://discuss.elastic.co/t/security-header/247167)
**Author:** [@champes](https://discuss.elastic.co/u/champes)\ **Replies:** 7\ **Last updated:** [September 3, 2020, 3:48am UTC](https://discuss.elastic.co/t/security-header/247167 "2020-09-03T03:48:21Z")
Any thoughts on how to configure the following HTTP secure headers: X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 ; includeSubDomains … --- ## [Where to see forcemerge detail](https://discuss.elastic.co/t/where-to-see-forcemerge-detail/247302)
**Author:** [@taidengpub](https://discuss.elastic.co/u/taidengpub)\ **Replies:** 1\ **Last updated:** [September 3, 2020, 12:36am UTC](https://discuss.elastic.co/t/where-to-see-forcemerge-detail/247302 "2020-09-03T00:36:42Z")
i run a forcemerge api ,and the forcemerge failed ,where to see the task detail to find out the reason? --- ## [Elasticsearch port 9200 or 9300?](https://discuss.elastic.co/t/elasticsearch-port-9200-or-9300/72080)
**Author:** [@nanshan](https://discuss.elastic.co/u/nanshan)\ **Replies:** 4\ **Last updated:** [September 2, 2020, 11:25pm UTC](https://discuss.elastic.co/t/elasticsearch-port-9200-or-9300/72080 "2020-09-02T23:25:36Z")
Can anyone explain which port number is elasticsearch listening? When I am running elasticsearch and I can see tcp6 0 0 :::9200 :::\* LISTEN 12390/java tcp6… --- ## [FORBIDDEN/12/index read-only / allow delete (api)\]](https://discuss.elastic.co/t/forbidden-12-index-read-only-allow-delete-api/110282)
**Author:** [@Tal\_Druckmann](https://discuss.elastic.co/u/Tal_Druckmann)\ **Replies:** 7\ **Last updated:** [September 2, 2020, 11:24pm UTC](https://discuss.elastic.co/t/forbidden-12-index-read-only-allow-delete-api/110282 "2020-09-02T23:24:17Z")
I am running logstash on windows 2016 vm . I use it from administrator command line. I keep getting this message. It won't let me save my visualization on kibana and keeps me from shutting it down (ctrl+c). This is the … --- ## [How much space do keys take?](https://discuss.elastic.co/t/how-much-space-do-keys-take/247297)
**Author:** [@pcb](https://discuss.elastic.co/u/pcb)\ **Replies:** 0\ **Last updated:** [September 2, 2020, 10:44pm UTC](https://discuss.elastic.co/t/how-much-space-do-keys-take/247297 "2020-09-02T22:44:20Z")
Hi ya all, I'm thinking of adding a bunch of boolean flags to my documents and I'm curious about space usage. Would these two have similar storage? { "A": false } { "abcdefghijklmnopqrstuvwxyz1234567890ABCDEFGHIJKLM… --- ## [Time in a field of type date](https://discuss.elastic.co/t/time-in-a-field-of-type-date/247221)
**Author:** [@Alex9](https://discuss.elastic.co/u/Alex9)\ **Replies:** 1\ **Last updated:** [September 2, 2020, 10:33pm UTC](https://discuss.elastic.co/t/time-in-a-field-of-type-date/247221 "2020-09-02T22:33:07Z")
Good day :slightly\_smiling\_face: Please tell me how to set up the field correctly so that the time in it does not differ from the incoming data? PUT service100 { "mappings": { "properties": { "DELIVERY\_TIME… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=817) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=819)